Arkansas vendor sued over data breach