It certainly varies from victim to victim. As you said yourself, having a credit card compromised may not cost you specifically. I suppose it would depend on to what extent the data is being used. We have some criminal organizations that will use your data to develop an entire persona and, through that, get perhaps government services, bank loans, mortgages, etc. The greater the identity that has been duplicated from you, the greater the cost. So trying to re-establish your identity after it has been compromised to the point where you have 20 or 30 creditors calling you weekly to say you owe them a considerable amount of money can take a long time, sometimes two or three years. Beyond dollar value for cost, there can also be an emotional cost, with the pain and suffering and the grief for those two or three years.
On September 28th, 2009. See this statement in context.