This may change as the plaintiff's bar gets more sophisticated. Many probably remember the Home Depot data breach a few years ago. The card issuers brought a class action against HD and the complaint (under MDL No. 14-02583-TWT) reads like a nice treatise on causes of action in various states implicated by a breach.