lawsuit over data breach