Let's say a private e-mail address used by a senior citizen (in WA) is provided to a company (also operating in WA). Assume the address is unique to the citizen's use of the company's services. No other company has been provided with the same e-mail address, with the intent of identifying sources of abuse.
Later, the senior citizen begins receiving an increasing stream of messages that appear to be targeted phishing because they are addressed to the special address given only to the one company.
Would negligent release of PII be a cause of action if causes a senior citizen to be subject to a series of attempted financial fraud?
Assume Washington State law might apply. I've read the WA elder abuse law are stronger than the average. Would actual financial loss through a scam be required to succeed in pressing this matter?