If, in fact hackers broke into CORI's data system, your information has already been sold to another scammer over the internet. (but it's usually credit cards and passwords that they obtain/ sell) There are the people who buy and sell card numbers in online markets, sometimes called “carding forums” or “card malls.”
It is also likely that it is just a scammer using CORI's letterhead and this was random. If hundreds of shoppers were sent out the fake Cori mail, then it seems 4+ have reported it to CORI. That may not make it a breach, but just the same, if 100's received Sinclair fake mail (example) and some report it, it's just a random name the scammers have used.
I was a victim in another state, where the state tax department was hacked into, affecting millions. They had my bank# and routing# because HR-BLOCK had to give the state my information, so they could send my state tax refund to my bank account. So we are supposed to get identity theft protection for a certain amount of time. (hopefully forever).
But, about 6 months ago someone was trying to get into my account. I thought the bank email was fake ( phishing) and called the bank. Not fake. They locked my account after 3 attempts. So, someone that bought my information (scammer) tried to get in and clean my account.
Pretty scary stuff. I would continue trying to find out if this was a true breach or if this was a random scammer using CORI to send out checks.