PIN not needed for network branded (Visa/MC) debit cards if they are processed under the signature (option). Best bet is to have the card replaced with a different number. In all these breaches it would be interesting to find out what an issuer's dollar threshold is for investigating fraud claims as you know there is a good bit of friendly fraud going on as there is now a plausible cover story.