Your contract is with your card issuer, who provided your personal information to the credit agencies. But you probably agreed not to sue them as part of your agreement when you asked them to issue you a card.
If you don't want to pay for LifeLock, which I agree is a bit steep, you can usually get an identity theft protection policy from most major insurances companies. The premiums vary, but are usually a fraction of LifeLock's fees. Just be sure you understand what's covered.
I use both of those and it costs me $25/yr total.
You can check the Fair Credit Reporting Act for more information about various parties' responsibilities in handling your credit information. However, I don't think you'd be able to sue lenders/creditors in this case. They are distinct from the credit reporting agency that seems to be at fault.
> They only monitor TransUnion and Equifax data
Where do you see that they monitor Equifax data? I only see TransUnion mentioned.
"I checked myself, my wife, you and your brother. To the best of my knowledge none of us have Equifax accounts, but it says they probably got our address & driver's license for all four of us.
I don't want to waste money on LifeLock. What can I do? Just watch my accounts?"
Is Visa, MasterCard, etc. at least partially to blame here for picking a bad solution? My personal ties are not with Equifax, I have no direct means as a consumer to express dissatisfaction. Can I sue Visa? They are they ones (I presume anyway) who did the actual information collection from me, and then it was mishandled.
We need more tools for dealing with data breaches. Things aren't slowing down, and they aren't going to unless something big changes.