I think this is one of the problems of organisations not doing anything themselves, and offloading responsibility and liability to both external partners.

If you trusted Mozilla Monitor with your personal data, their legal contact information is listed on their terms page: https://www.mozilla.org/en-US/about/legal/terms/subscription...

The same terms page you agreed to which both limited their liability to $500, and granted them indemnification from liability.