It really doesn’t matter. Compensation has been dispensed to customers in data breaches such as credit/ssn info, no harm proof needed. Potential for harm is enough. Breach of contract, as a customer do I have a reasonable expectation that this data is not exposed? of course I do. No one could very seriously argue it’s a zero sum.
Is there no harm, or is there harm that is hard to show in court?
A bit of both.
Most people aren't going to have their identity stolen (or insert w/e crime). Those that do will have trouble proving it was from this leak.