Yep, I had one hacked before the envelope was opened. And that one was a replacement for one that was hacked.
I use a Cap1 card and the virtual numbers now for online use and no trouble since.