It's charging subpar password security and lousy user notification: Zynga has yet to notify users to warn them of the breach, the suit says.