Class action suits regularly end up getting you "$5" worth of credit monitoring from the exact company who lost your data. It's a joke. Class action suits as they exist today in the US are an abject failure of justice.

If they end up with the company having to pay anything, it is greater than fines imposed by regulatory agencies… who should be doing this job.

showing damages is hard

Imagine the GDPR fine

Up to 4% of income. This is not the end of the world either.