I wouldn't say "might be able to make a case." I think you've just made the case right there. The company has proven their inability to determine whether or n

I wouldn't say "might be able to make a case." I think you've just made the case right there. The company has proven their inability to determine whether or not you are who you say you are, by their own admission that your personal information was lifted from their servers. I don't know who's signing up for these "free" identity protection services anyway. This company has failed to protect the personal information of roughly half the population of the entirety of US. (I understand they are not limited to US, but those are the numbers.) They do not need to be "protecting" anybody after that. They should be tarred and feathered for putting up these websites after what they've done, and whatever lawyer advised them to sneak in a provision against class action lawsuit should be immediately disbarred, in my not so humble opinion. How many digits of my SSN do I need to enter into this five-day-old website that provides me with no clue what they're going to do next, in order to see if I need any further "protection" from this group with which I have no direct relationship, and whom I've never done business with, but that has diligently kept records on me for my entire adult life?