It might take an open-minded judge to accept this, but attorneys often fall back to common-law negligence when there are no stronger legal theories to rely on.

It might take an open-minded judge to accept this, but attorneys often fall back to common-law negligence when there are no stronger legal theories to rely on. All the elements of negligence seem to be here, except probably for duty of care. A judge would have to find that Facebook owes a duty of care to its users to protect the integrity of its identities, and that Facebook breached that duty. I can foresee Facebook and other information service providers fighting vigorously against such a legal conclusion, but maybe it's just the kind of law we need.