On May 3, lawyers for victims of Marriott's 2018 cyberattack scored a victory that's practically unheard of in data breach cases: class certification.