This isn't a legal Q&A site, but the question does have significant interest in IT security. Theoretically, you can sue any other entity (either an individual or a corporation) for doing anything that causes you a "tort" or harm. The burden is typically on the plaintiff (the suer) to prove "negligence"; the defendant (the one accused of harm; the sued) must be shown:
- To have known or been reasonably expected to know that the situation presented a significant potential for harm to others,
- To have known or been reasonably expected to know what specific actions or measures should be taken in order to prevent, avoid or mitigate the potential for harm to others,
- To have failed to take some or all of these actions or measures, and
- That said failure was the direct or proximate cause of a significant realized harm to the plaintiff (or in a class action suit, to a large number of individuals primarily identified by some definable relationship to the defendant and their actions or inactions).
This is harder than it sounds, especially in situations of IT security:
Many relationships involving IT security that can result in harm are contractually based; the plaintiff is a subscriber to services performed by the defendant, or similar. The plaintiff is not always required to sign the agreement as such in order to be bound by it; for instance, the plaintiff may signal their agreement to the terms of a warranty or service agreement simply by using the product or service. Such contracts often contain clauses limiting damages, or forcing the subscriber to submit their dispute to arbitration instead of battling it out in court.
You typically have to be able to subpoena reasonably detailed documentation of the defendant's security processes. While the court can force the release of information, the defendant will fight any such request tooth and nail, as there is, practically always, a known weakness in process or implementation, whether it was exploited or not, that would become public record at trial and could cause other problems once known.
You usually have to be able to subpoena relatively willing witnesses that can testify to procedural or other failures inside the walls of the company; "whistleblowers". Someone's got to be willing to say that the company, their bread and butter, did something wrong. While intentionally false testimony given at trial is perjury, that's just as hard to prove; you have to have independent proof that not only was the statement false, but the person making that statement knew it was false when they made it.
Two wrongs don't make a right, but in civil law they often cancel out. You're also on trial here; you must show that you took reasonable action to avoid or mitigate harm in the same situation, whether you knew of or suspected any negligence by the defendant at the time. If the defendant can show that the leak was in fact caused by inadequate measures on your part, such as using the same password for every information service you access, or keeping a copy of said password in an accessible place, the defendant can turn it around on you and can even claim you caused them harm, if the leak of your sensitive information by you allowed the attacker to do damage on their side not limited to your account. Similarly, if you are harmed by, say, having your bank account information stolen, but don't immediately take steps to prevent further harm by reporting it to the proper authorities, then as soon as you knew there was a problem, all the damages happening after that time are on you.
Remember the situation that is causing you to file suit against them; they have money, you've lost enough money that it hurts. Of the two, who's more able to hire a good legal representation?
That said, failures by firms that store sensitive information about their customers can and have resulted in civil and criminal penalties, and in fact, this practice is apparently on the rise. Here are a few:
MAPCO Express: Facing class action lawsuit for breach of customers' credit card information.
LinkedIn: Facing a $5 million lawsuit for breach of sensitive data including hashed passwords of 8 million subscribers.
Trustwave, and the State of South Carolina: Found negligent in a suit brought by a state senator following a hacking of an S.C. government website.
A host of other reports of lawsuits filed can be found in the pages of SC Magazine.