re: the Economist or PlayFair?
Why choose? Make them both pay. One to cover the cost of the additional credit monitoring services they also should have recommended and the should pay the monetary compensation to the compromised users. I think 3 years is the standard for these sorts of things at the moment. No, I don't think you should have to prove you were infected. Visiting their site during the time interval should be sufficient.
