Lawyers for the plaintiff maintain the companies should have been on notice of inadequate security measures after a reported data breach in 2022.