Twelve US states join for the first time to file multistate data breach lawsuit