Ask HN: LastPass Legal Liability

I pay for LastPass premium and after months they have finally acknowledged the extent of their breach and their recommended steps to protect yourself. These steps include: updating algorithm security, changing passwords, changing master password, and resetting MFA. Basically, they have completely failed to do the only thing I pay them to do, and they continue to use the lowest recommended algorithm by OWASP for encrypting passwords. I do not have the finances to hire a lawyer and I would like to know if there are any legal steps I can take for remediation? Personal or class action or arbitration? I understand that responses are not legal advice - I am seeking recommendations for what legal advice to seek.