Two lawsuits claim university officials failed to prevent a cyberattack affecting 93,000 students and were then slow to notify victims.