You can assert compensation from the web site for that money harm as they have breached the information security regulation by not delivering suitable security when processing details. You might have the right to mandate an NGO to lodge a criticism on your behalf when the following problems are fulfilled: https://nathanlabsadvisory.com/achieving-fisma-certification-in-the-usa-ensuring-robust-information-security/