A relatively new breed of data breach class action involves financial institutions suing merchants for expenses associated with credit card data breaches.