If you have no connection with them, then you haven't signed anything indemnifying them for their actions with your data, so do you have grounds to sue for damages?