The lawsuit claims the university didn’t enact reasonable data security measures.