“That is how they’re constructing that fact pattern into what was supposed to be a clear data breach,” Dominique Shelton Leipzig, a partner at Perkins Coie in Los Angeles, said. “The private right of action was supposed to limited to a negligent breach.”