Six days, 2.76 million license numbers, and a mechanism the company will not confirm. Two plaintiffs could prove where the data went.