Thanks. What kind of harm could be done?
Where to start...
It depends on who was behind the breach. A breach of that scale and type is unlikely to be "just kids", so presume it's either organised crime or a group of people who were looking specifically for CC/personal info. Sometimes the breaches are just people showing off and they have no intention of using or selling the information, but better to err on the side of caution as I doubt there was a community of people wanting to take AXA or SuperValu down a peg or two and so this seems very targetted.
A simple option would be to use the info for a series of smallish purchases on ebay etc. When you've info in the hundreds of thousands, that's not insignificant. But they won't be buying old LPs and Star Wars figures, more likely that they're buying from themselves and laundering the money that way.
Another way is to register the accounts at gambling sites and lose the money to yourself, again laundering the money.
And it could be used to produce cloned cards among other things (such as identity theft).
The main thing is that when CC info is used, it tends to be for a series of small payments each time (though this can be several times in a day or week) to escape the obvious sudden big purchase flag. And it is rarely if at all used to go to an atm and clear out the account, it is as described, a series of small purchases to launder the money.
Security companies, CC companies and banks tend to downplay the risk, but there is a significant black market for this information, so somebody is making money off it.
Companies must notify customers of a breach, so if you've been informed, I'd keep regular, daily checks on the account and flag up any fraudulant charges no matter how small.