you're turning the case around- yes, you're right, the reporter and academic could sue, but it's not worth it (the defamation wasn't particularly effective) IMHO. It would mainly just make money for lawyers and mildly embarass the state.

Realistically, there's an IT executive in the Missouri government who screwed up, and the newspaper should be suing the state for criminal infosec practices (they did, after all, leak individual SSNs).