As other posted noted, US cc is, by far, the easiest piece of information to acquire by a determined actor. Possible and inconvenience, but that is about it.

Why is that? Well, not to search very far, I just got a breach notice from a company I never heard of the other day. They are sorry.