Personal data breach.

As a technical matter, this may be grounds for a lawsuit. However, I would not consider initiating one simply on the basis of one isolated email. Moreover, there are other factual inquiries that should be made to evaluate the strength of your case. For example, the privacy policy of the company should be evaluated to see if it was breached or if either the absence of or failure of such document to address this situation agravates their conduct. Also, you should be aware the lawsuits commenced on the basis of an antcipated harm, as opposed to one where an actual harm (usually loss of monies) has been experienced, are rare. So in this case, the ptential absence of harm shold be considered as potentially weighing again initiating a suit.

I hope this helps.

Disclaimer: This answer is for informational purposes only and does not constitute general or specific legal advice, nor create an attorney client relationship.