[cabmandone]

From the reading I did after I found out my personal information (name, address, SS#) had been part of a medical records (thanks for that ACA!) office hack, you can't really sue until there are actual damages. The courts have ruled that just having your personal information stolen isn't enough.

If you really want to have fun, ask them what type of encryption they used for your data. The people at the medical records office were clueless as to what I was talking about.

The real gimmick is, they collect your data (SS# included) and charge you to freeze that information. They then charge you each time you unfreeze it. Some states it's mandatory that if you've been part of a data breach they can't charge you to freeze your credit. In others like Ohio, it's only free if you have actually had someone try to use that information to open an account. Pretty sweet racket places like Equifax, Experian and Transunion have.