No actual break involving SHA-1 and using a structural weakness of SHA-1 has been currently fully demonstrated in academic conditions, let alone in the wild.
The best we have right now is a theoretical collision attack that should allow an attacker to compute a SHA-1 collision with effort "about 261", which is huge but still substantially less than the 280 resistance expected from a "perfect" hash function with 160-bit output. While 261 is within reach of existing technology, it is too expensive for even rich universities to casually indulge into that kind of experiment. So no actual collision has been produced yet. Moreover, for a practical attacker, computing a collision rarely grants a lot of power -- the attacker must usually compute a collisions with some degree of control on the contents of the colliding messages, which may be harder (or not).
Another parameter is that even if SHA-1 is perfect, its output size (160 bits) implies a maximum bound to its collision resistance at about 280, which is half a million times 261 (so quite more expensive), but at the same time not ultimately expensive. A 280 computation can be envisioned with existing technology and resources available on Earth without needing to invoke some sci-fi stuff or breaking laws of physics.
Since switching algorithms in deployed applications takes a lot of time (hey, we are still trying to get people to stop using SSL 3.0 and instead go to TLS 1.0, more than 15 years after TLS 1.0 was published), we'd better get it going now, so that SHA-1 is really phased out when technology has improved to the point that the 280 effort has become feasible in practice.