Legal action underway over University of Cumbria data breach