A Des Moines company is facing a potential class action lawsuit over an alleged cyberattack that may have exposed the health data of 1.6 million people to unauthorized disclosure.