Breach may violate U.S. privacy act