The US Supreme Court is currently hearing a class action suit against Spokeo Inc, where the defendants are alleging they were harmed when Spokeo disseminated incorrect information about them.
The legal question is “whether a plaintiff can sue for a technical violation of federal consumer law even when there is a question about whether the person has been directly harmed.” This is relevant to the question posed when there is a data breach but the individuals whose records were compromised have not (yet) experienced any harm.