My credit card was used a few months ago, the company called and asked me to confirm some transactions, the two were < $10 purchases at obscure sites they said are often used with stolen card numbers prior to a big hit.

Interestingly I had only used it a few times in previous months - once as a regular debit for an Easynews subscription (unlikely to be the source), a few days earlier to purchase an LCD TV (possible, but I think they are reputable and likely to be security conscious). The previous uses were back in January at various shops and restaurants while on holiday in California - this is possibly the most likely place, although I would have thought they would make use of captured card numbers sooner.