The Information Regulator has ordered Dis-Chem to take remedial action to address a hack that led to the personal data of 3.6 million customers being breached last year or face a fine of up to R10 million.