The third party being sued is the (as yet unidentified) person who used the key to obtain & leak the data.