For Consumers, Injury Is Hard to Prove in Data-Breach Cases