Happened to me the morning of 7/16 - had two emails at 5:00am in my inbox saying that my points had been redeemed at Amazon.com. I was up when they came in and saw that my point balance had gone from ~900K down to 70K.
I sent an email to the fraud dept at Hilton and called as soon as the Diamond desk opened (Lifetime Diamond).
They said they'd take care of it.
I hadn't heard anything until I got an email saying that my email address had been changed - when I logged on, it had been changed to an @
hilton.com address. When I called in, they said that the fraud dept had taken control of the account & I would be issued a new one....
Have now been issued a new HHonors# & all points reinstated. Knowing what I know about frauds like this - no effort will be made to pursue the people who did it - free stuff.