I think that this can end up resulting in less bureaucratic churn then the other approach. In this particular case a bunch of users had their data forwarded by one entity - if CA had harvested data from multiple sources using the Facebook API then I think it'd be unreasonable for those users to need to legally pursue each terms violator - Facebook may also refuse to share the identity of the breach for a variety of reasons[1] making the lawsuit without an identified defendant which doesn't really help matters.

1. Proprietary customer information, privacy, just generally not talking.