Having AAdvantage numbers compromised would imply that they are confidential and that a breach might result in fraud. However, I have not noticed my number being treated by AA like a credit card number. Last I noticed, it was printed on my boarding passes; it is certainly included in e-mails from AAdvantage. So what might changing the number now (which they have not done, yet, in my case) achieve that could not be achieved by changing the password?