Two insurance companies have sued a data security firm seeking the return of US$30 million that they paid out to a payment processing company over a data breach.