I wonder what recourse the organizations could take? A lawsuit? Going to the media?

it seems very unlikely, at face, that they’d have legal standing to sue here (for a variety of reasons but the biggest one is probably lack of a law being violated due to US privacy law being so poor) so probably bad PR at most to be honest