I know I'm posting late to the thread. I'm in Bangalore, and first I knew was when I woke up and checked the mails on my phone the morning the story broke. Email from BA explaining it all. I had booked in the time period (I'm travelling every week). I checked the BA website and the link to details was very obvious.
Called BA Amex number and recorded message said no need to cancel card at this time.
So for my part, I think BA have handled this well. Clear information on the website with no attempt to hide it at the bottom like Ry*nair probably would.
I had use stored card details so only actually keyed my 4-digit CVV, but I don't think anyone has confirmed if stored details were vulnerable or not. I've also reset my BAEC password (eventually - forgot my password link) and also opted for Amex alerts when charges hit the card.
Once BA knew about it, they seemed to act quickly and communicate quickly. And I've personally no issues about how long it took them, as my booking was made on the first day of the time window.
Fingers are crossed.