The federal suit, which seeks class-action status, alleges a data breach exposed 40,000 customers' private data.