Can a company be sued for a data breach that exposed my personal information?

Yes, if a company that was holding your sensitive personal data failed to implement reasonable security practices and this negligence resulted in a data breach causing you wrongful loss, you may have grounds to seek compensation from them under applicable data protection and IT law.

Establishing this kind of claim typically requires showing the company's security practices were genuinely inadequate (falling short of reasonable industry standards) and that you suffered actual, provable harm as a result of the breach — such as financial fraud that followed from the exposed data, or other quantifiable loss, rather than just the fact that a breach occurred.

You can also report the breach to the relevant regulatory or data protection authority, which can independently investigate and take action against the company for its security failures, separate from any individual compensation claim you might pursue. Given how technical this area can be — proving inadequate security practices often requires some expert input — it would be worth consulting a lawyer experienced in data protection matters to assess whether your specific situation supports a viable claim.