Lawsuit accuses University of Minnesota of not doing enough to prevent data breach