Not a lawyer but this just screams legal action. Their systems clearly aren't sufficiently secure to prevent large scale fraud
And the form to get that settlement meant giving some random authority more personal information than these companies even have.
I would keep going too.