When Sarah Luke found out her personal details had been shared on the dark web, she never imagined it would lead to two US court actions and a million-dollar damages bill.