No confirmed fraud?
Last week our company credit card suddenly had two transactions, one for £2k and another for £300, appear fraudulently. Looking back over the usage logs (every purchase is recorded), the only known hacked site it had been used on was BA on Sept 4th - one day before the hack was fixed.
So yeah, BA, pretty sure that counts as confirmed fraud.
(Anonymous cos, y'know)