Are there any examples of class-action lawsuits or legal consequences against companies that expose sensitive data like this in the U.S.?