This isn't how the legal system works. You can't proceed with a lawsuit without some kind of defined damages. Unless you can point to something bad that has happened to you, how can Home Depot argue in their defense? How can a jury judge their defense? How can a fair penalty be agreed upon?

Possibly having your data leaked isn't enough of a harm for the courts to hear the lawsuit. If you can force a company to respond to a lawsuit based on the potential that they lost your data, what stops larger companies from suing smaller competitors constantly forcing them to prove they haven't leaked any data? They always could have leaked data.