I don't think it would be a "take them to court" job - in particular you'd struggle to prove actual damages. However you most definitely can report them to your country's Information Commissioner's Office, then leave the matter with them.
I kind of feel like they'll just brush it under the rug, though. But really that is the correct course of action.
Sounds more like this is the Cyberpunk v1.0 we were supposed to get.