Breaches like this need to have legally enforceable punishments. Things such as mandatory recompense for each and every affected user, plus a fine. Too many companies are lax on their IT security because they don't want to pay for the staff to maintain the systems required. Make it more expensive to have a breach than to pay the IT people to monitor for it...otherwise these breaches will continue.

Yeah, they sent me an email basically saying "we're sorry" with no offer for free credit monitoring or anything.

I guess it's too late to unpair my RBC credit card from my petropoints...ugh

Another bites the dust... cue the music!