Have any of the affected people contacted the FBI? This is a significant case of computer crime perpetrated against Americans/American computer systems. Whilst I'm under no illusion that they'll find the perpetrators a call from the Feds might at least cause UA to sharpen their act.
Also in the UK credit card companies are jointly and severally liable for anything where you put more than $100 on the card (even if it's only partial payment for a service), is that the case in the US and if so is there a route through the credit card company?