Vanderbilt faces class action lawsuit after cyberattack; law professor says victims could receive as little as $20