• 2008 — a foreign intelligence agency infected a computer in a US Department of Defense facility in the Middle East, that was spread to the [air-gapped] classified network [2] [3 [4] [5] [6]
  “It turns out there is always an idiot around who doesn’t think much about the thumb drive in their hand.”
  how Stuxnet infiltrated Natanz
• an attempted attack against Royal DSM, first reported by Dutch newspaper Dagblad De Limburger in July 2012 [3]
• Stuxnet crossed Iran's airgap via flash drive. [2] [3] (though it's unclear if it was installed directly via a double-agent, or if it was dropped in a parking lot)

Other instances that this attack vector is actually used in the real world:

• 2011 pentest of government buildings and contractors by DHS [2] [3]
• Dan O'Dowd calls it one of his favorite methods for pentesting

Rumors about US federal agencies using cement to ensure that USB ports won't be used:

• [1]
• [2]