As far as I remember, you could enter any random information into their form and it will say you were affected. That is the proof that Legalist is asking to provide the basis for the suit.
I've had friends enter information into that form and it said they weren't affected. AFAIK the Equifax backend is complete garbage and they've been very careful to disclaim a positive match by saying your information is "potentially impacted." Seems like they have no idea of knowing/proving whether someone actually has your specific information, but can check whether your information resided at one point on the specific server/database that was compromised?
How do you prove this in court?
"Your honor, I gave a Dark Web hacker some bitcoin and they said I was definitely affected."