I would say that figure is likely to be much larger, especially if it isn't a worldwide figure.
Not to mention anyone giving their credit card details to pay for a rogue antivirus or antispyware programs, could well suffer further fraudulent activity on their credit card.