That post yesterday : https://news.ycombinator.com/item?id=21147865 shows a side channel attack on smartcards. In the links we can see the FIPS140-compliant affected hardwares. Maybe it contributes to show that FIPS140-02 is not as much a reference than it used to be?