The massive car dealership cyberattack has sparked a second lawsuit over exposing personal data