Potentially. But see how Lastpass dealt with a potential breach [1]. Have not heard of them being sued. I don't think "cover it up to avoid getting sued" is the right message.

[1] http://blog.lastpass.com/2011/05/lastpass-security-notificat...