A hacker who leaked personal data under titles including boozy, HIV and abortions, could have been stopped by basic security measures, a class action alleges.