It shouldn’t be a matter of suing; the companies (and their executives personally) should be criminally prosecuted for violating the Computer Fraud and Abuse Act by exceeding authorized access. Nobody legitimately consents to having their property sabotaged and used to exploit them, so this enshittification should be treated like any other instance of malicious hacking.