I do not see why at the very least civil lawsuits could not be pursued by Nunes, Giuliani and Sekulow, among others, against AT&T, and possibly Shiff (though AT&T is clearly in the wrong). This is NOT a criminal investigation and does NOT involve subpoenas.
You don’t need the NSA or the Deep State to get these records, just a subpoena. Of course, the subpoenas from Congress aren’t signed by a judge or by any member of the judiciary branch (in some states, a legal clerk can sign that type of subpoena). This precedent is VERY bad.