Having worked at a hedge fund that suffered a data theft, I'd expect the criminal charges, if any, to come several months from now. It takes time for the police to build their case, collect evidence, interview possible witnesses or suspects, etc. All that happens before formal charges are filed. A lawsuit can be filed immediately.