Lawsuit seeks class-action status in a case in which a phishing scam allowed access to a wide range of sensitive information.