I'm speaking hypothetically of course, I haven't actually been affected by this leak (so far).

But that doesn't seem hard to prove at all. At the very least, you could claim that Facebook's leak forced you to pay for identity theft protection/monitoring as a very reasonable precaution, and whatever that cost you would be the damages.

Then of course there's the possibility that someone did actually steal your identity and used it to drain money from your accounts, or simply caused you to waste a bunch of time hunting down for example fake accounts opened using your information, credit cards, etc.

And I'm not a lawyer, but I'm pretty sure somewhere in all this fuckupery you can throw in some punitive damages.