RSA had to recall its SecurID tokens after Chinese hackers stole its keys, cloned tokens, and used them to break into defense contractors. So: it does happen.