One has to think there will be a massive class action lawsuit over something like this in the near future.
Yes, there shall be, but those can be dragged on forever. When a Company has SS numbers of customers, I would think somewhere in the laws would be a requirement that they take every possible step in protecting that (Federal) information. A criminal violation is what I'm wondering about.....