My Uncle had his account breached and he called AA today after discovering that award tickets were booked with his miles.
The agent was very helpful, she cancelled the tickets and said she would notify the relevant people to get it all cleaned up. She apparently said this was her 5th call in as many days with this sort of issue.
I warned my Uncle that from reading this thread AA may accuse him at first, but as he did nothing wrong, they will eventually return the stolen miles too him.
I had him change his password and I warned him to be prepared to talk to the Police and have a Police report filled.
He checked his other accounts, bank, etc., and they appear untouched, good news there. He changed those password as a prophylactic.