Possible to sue companies for lack of security/support?

Nexon has acknowledged data base leaks before, so if someone were to sue them, the ball would be in Nexon's court to prove that they have kept your information secure. Supposing they argue that the only information that was lost was your login ID/password (well, IDs and passwords are the same thing now), then they would have to prove that nothing else was lost, not the other way around (least that's what I think...I wouldn't know).

I believe the burden of proof would be on the user. We can't just allege that Nexon had a database leak that included e-mails and names without proof of that (since they only admitted to ID's and pass). It wouldn't Nexon's responsibility to "defend" itself, if you get what I mean.