UFCW Local 135 faces a lawsuit for delaying breach notifications after 20,000 members' personal data was stolen.