Like others have said about this happening to Costco too, this is all because CVS, Costco, Sam’s Club, Walmart Canada, and Rite Aid use PNI Media as a backend for their photo services and PNI seems to have been hacked:

http://krebsonsecurity.com/2015/07/cvs-probes-card-breach-at...