According to the plaintiff's (not very detailed) theory of liability, possession or possibly knowing possession of "stolen property" (the leaked data) is all it

According to the plaintiff's (not very detailed) theory of liability, possession or possibly knowing possession of "stolen property" (the leaked data) is all it should take, though there are some bits about inflicting emotional distress too. I'm not even sure what sort of property this is supposed to be, nor did they explain beyond their quoting of a Canadian case. For copyright, it's not really a creative work and we don't have 'database rights' like other countries do. It might have been a trade secret but it's not really secret any more. Patents and trademarks aren't even relevant, so unless there's something esoteric, I am not clear on how they can even make the 'property' part of 'stolen property' fit. Also, I agree with you in that I doubt they could have filed a proper DMCA notice. They'd have to claim ownership of the dump itself, which they cannot. And if someone had tried that, it can actually trigger the infamous 'perjury' penalty clause because they don't own the dump. Yes, one could also 'misidentify' a work they really do own as being infringed upon by the dumps but that would never survive a counter-claim--presuming one was filed, a lot of people never challenge these because the next step up is an expensive federal copyright lawsuit. Also, they might have some difficulty explaining their 'good faith' belief the work was infringing if someone called them on it. Calling someone on it, of course requires it to actually go to that expensive courtroom, which is why it almost never seems to happen in spite of the parade of ridiculous DMCA notices. It's simply too expensive to fight over little things, at least for most normal people.