2.8M US folks learn their personal info was swiped months ago in Sav-Rx IT heist