Class Action Complaint — Shelia Edwards v. DialAmerica Marketing, Inc. (Document 1, filed May 16, 2022)
Summary
Class Action Complaint for Damages, Injunctive and Equitable Relief filed in the Southern District of California by Representative Plaintiff Shelia Edwards against Defendant DialAmerica Marketing, Inc. It alleges that a cyberattack between February 2, 2021 and July 9, 2021 (the "Data Breach") let cybercriminals access personally identifiable information and financial information stored in the defendant's information network. It alleges that the defendant did not begin notifying victims until April 2022 and that the letter to Representative Plaintiff is dated April 6, 2022. The complaint lists claims for Negligence, Breach of Implied Contract, Breach of the Implied Covenant of Good Faith and Fair Dealing, Unfair Business Practices, and Unjust Enrichment, and demands a jury trial.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Class Action Complaint — Shelia Edwards v. DialAmerica Marketing, Inc. (Document 1, filed May 16, 2022).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/court-filing-no-3-22-cv-00689-dkt-1-s-d-cal-4a290f9103/
, SHA-256 71f63f6f0c632d26c07367d923184d194ddb42d0b6b077de7b5eeed359dbe859.Full text
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.36 Page 1 of 33
1 Scott Edward Cole, Esq. (S.B. #160744)
Laura Grace Van Note, Esq. (S.B. #310160)
2 Cody Alexander Bolce, Esq. (S.B. #322725)
COLE & VAN NOTE
3 555 12th Street, Suite 1725
Oakland, California 94607
4 Telephone: (510) 891-9800
Facsimile: (510) 891-7030
5 Email: sec@colevannote.com
Email: lvn@colevannote.com
6 Email: cab@colevannote.com
Web: www.colevannote.com
7
'22CV0689 LL BGS
8 Attorneys for Representative Plaintiff
and the Plaintiff Class(es)
9
10 UNITED STATES DISTRICT COURT
11 SOUTHERN DISTRICT OF CALIFORNIA
12
COLE & VAN NOTE
13 SHELIA EDWARDS, individually, and on Case No.
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
behalf of all others similarly situated,
14 CLASS ACTION
OAKLAND, CA 94607
Plaintiff,
15 vs. COMPLAINT FOR DAMAGES,
TEL: (510) 891-9800
INJUNCTIVE AND EQUITABLE RELIEF
16 DIALAMERICA MARKETING, INC., FOR:
17 Defendant. 1. NEGLIGENCE;
2. BREACH OF IMPLIED CONTRACT;
18 3. BREACH OF THE IMPLIED COVENANT
OF GOOD FAITH AND FAIR DEALING;
19 4. UNFAIR BUSINESS PRACTICES;
5. UNJUST ENRICHMENT;
20
21 [JURY TRIAL DEMANDED]
22
23
24
25
26
27
28
-1-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.37 Page 2 of 33
1 Representative Plaintiff alleges as follows:
2
3 INTRODUCTION
4 1. Representative Shelia Edwards (“Edwards” or “Representative
5 Plaintiff”) brings this class action against Defendant DialAmerica Marketing, Inc.
6 (“DialAmerica” or “Defendant”) for its failure to properly secure and safeguard
7 Representative Plaintiff’s and Class Members’ personally identifiable information
8 stored within Defendant’s information network, including, without limitation, their
9 full names, addresses, Social Security numbers, employer assigned identification
10 numbers, and financial account information (these types of information, inter alia,
11 being hereafter referred to, collectively, as “personally identifiable information” or
12 “PII”),1 and to properly secure and safeguard Representative Plaintiff’s and Class
COLE & VAN NOTE
13 Members’ PII and financial information stored within Defendant’s information
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 network.
OAKLAND, CA 94607
15 2. With this action, Representative Plaintiff seeks to hold Defendant
TEL: (510) 891-9800 16 responsible for the harms it caused and will continue to cause Representative
17 Plaintiff and the countless other similarly situated persons in the massive and
18 preventable cyberattack that occurred between February 2, 2021 and July 9, 2021,
19 by which cybercriminals infiltrated Defendant’s inadequately protected network
20 servers and accessed highly sensitive PII and financial information which was being
21 kept unprotected (the “Data Breach”).
22
23
24
25 1
Personally identifiable information (“PII”) generally incorporates information
that can be used to distinguish or trace an individual’s identity, either alone or
26 when combined with other personal or identifying information. 2 C.F.R. § 200.79.
At a minimum, it includes all information that on its face expressly identifies an
27 individual. PII also is generally defined to include certain identifiers that do not
on their face name an individual, but that are considered to be particularly
28 sensitive and/or valuable if in the wrong hands (for example, Social Security
numbers, passport numbers, driver’s license numbers, financial account numbers).
-2-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.38 Page 3 of 33
1 3. Representative Plaintiff further seeks to hold Defendant responsible for
2 not ensuring that the compromised PII was maintained in a manner consistent with
3 industry and other relevant standards.
4 4. While Defendant says unauthorized access to its network occurred as
5 early as July 4, 2021, it did not even begin notifying victims until April 2022—over
6 year after the breach initially occurred. It did not immediately report the security
7 incident to Representative Plaintiff or Class Members. Indeed, Representative
8 Plaintiff and Class Members were wholly unaware of the Data Breach until they
9 received letter(s) from Defendant informing them of it. Representative Plaintiff’s
10 letter is dated April 6, 2022.
11 5. Defendant acquired, collected and stored Representative Plaintiff’s and
12 Class Members’ PII and/or financial information.
COLE & VAN NOTE
13 6. Therefore, at all relevant times, Defendant knew, or should have
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 known, that Representative Plaintiff and Class Members would use Defendant’s
OAKLAND, CA 94607
15 networks to store and/or share sensitive data, including highly confidential PII,
TEL: (510) 891-9800 16 because Defendant required that they provide this information to receive their
17 products/services.
18 7. By obtaining, collecting, using, and deriving a benefit from
19 Representative Plaintiff’s and Class Members’ PII, Defendant assumed legal and
20 equitable duties to those individuals. These duties arise from state and federal
21 statutes and regulations as well as common law principles.
22 8. Defendant disregarded the rights of Representative Plaintiff and Class
23 Members by intentionally, willfully, recklessly, or negligently failing to take and
24 implement adequate and reasonable measures to ensure that Representative
25 Plaintiff’s and Class Members’ PII was safeguarded, failing to take available steps
26 to prevent an unauthorized disclosure of data, and failing to follow applicable,
27 required, and appropriate protocols, policies, and procedures regarding the
28 encryption of data, even for internal use. As a result, the PII of Representative
-3-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.39 Page 4 of 33
1 Plaintiff and Class Members was compromised through disclosure to an unknown
2 and unauthorized third-party—an undoubtedly nefarious third-party that seeks to
3 profit off this disclosure by defrauding Representative Plaintiff and Class Members
4 in the future. Representative Plaintiff and Class Members have a continuing interest
5 in ensuring that their information is and remains safe, and they are entitled to
6 injunctive and other equitable relief.
7
8 JURISDICTION AND VENUE
9 9. Jurisdiction is proper in this Court under 28 U.S.C. §1332 (diversity
10 jurisdiction). Specifically, this Court has subject matter and diversity jurisdiction
11 over this action under 28 U.S.C. § 1332(d) because this is a class action where the
12 amount in controversy exceeds the sum or value of $5 million, exclusive of interest
COLE & VAN NOTE
13 and costs, there are more than 100 members in the proposed class, and at least one
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 other Class Member is a citizen of a state different from Defendant.
OAKLAND, CA 94607
15 10. Supplemental jurisdiction to adjudicate issues pertaining to California
TEL: (510) 891-9800 16 state law is proper in this Court under 28 U.S.C. §1367.
17 11. Defendant routinely conducts business in California, has sufficient
18 minimum contacts in California, and has intentionally availed itself of this
19 jurisdiction by marketing, providing, and selling products/services, and by accepting
20 and processing payments for those products/services within California. Defendant
21 employed Representative Plaintiff in this judicial district. During all relevant times,
22 Representative Plaintiff has been domiciled in this district and she provided the
23 information accessed in the Data Breach to Defendant in this district.
24 12. Venue is proper in this Court under 28 U.S.C. § 1391 because the events
25 that gave rise to Representative Plaintiff’s claims took place within the Southern
26 District of California, and Defendant does business in this judicial district.
27
28
-4-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.40 Page 5 of 33
1 PLAINTIFF
2 13. Representative Plaintiff is an adult individual and, at all relevant times
3 herein, a resident of the State of California. Representative Plaintiff is a victim of
4 the Data Breach.
5 14. Prior to the Data Breach, Representative Plaintiff was employed by
6 Defendant.
7 15. Defendant collected PII and financial information from Representative
8 Plaintiff. As a result, Representative Plaintiff’s information was among the data
9 accessed by an unauthorized third-party in the Data Breach.
10 16. At all times herein relevant, Representative Plaintiff is and was a
11 member of the Classes.
12 17. Representative Plaintiff provided Defendant with highly sensitive
COLE & VAN NOTE
13 personal and financial information.
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 18. Representative Plaintiff’s PII was exposed in the Data Breach because
OAKLAND, CA 94607
15 Defendant stored and/or shared Representative Plaintiff’s PII and financial
TEL: (510) 891-9800 16 information. Representative Plaintiff’s PII and financial information was within the
17 possession and control of Defendant at the time of the Data Breach.
18 19. Representative Plaintiff received a letter from Defendant, dated April
19 6, 2022, informing Representative Plaintiff that her PII and/or financial information
20 was involved in the Data Breach (the “Notice”). The Notice explained that
21 Defendant detected unusual activity on its network and took steps to secure the
22 systems, but not until an unauthorized third-party gained access to Defendant’s
23 network and accessed Representative Plaintiff’s PII and financial information stored
24 thereon. Defendant claims to have detected and determined the breach itself took
25 place between February 2, 2021 and July 9, 2021. Defendant did not inform
26 Representative Plaintiff prior to the Notice dated April 6, 2022.
27 20. Representative Plaintiff has already spent and will continue to spend
28 time dealing with the consequences of the Data Breach. This includes, without
-5-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.41 Page 6 of 33
1 limitation, time spent verifying the legitimacy and impact of the Data Breach,
2 exploring credit monitoring and identity theft insurance options, self-monitoring
3 various accounts, and seeking legal counsel regarding options for remedying and/or
4 mitigating the effects of the Data Breach. This time has been lost forever and cannot
5 be recaptured.
6 21. Representative Plaintiff suffered actual injury in the form of damages
7 to and diminution in the value of Representative Plaintiff’s PII—a form of intangible
8 property that Representative Plaintiff entrusted to Defendant which was
9 compromised in and as a result of the Data Breach.
10 22. Representative Plaintiff suffered lost time, annoyance, interference, and
11 inconvenience as a result of the Data Breach and has anxiety and increased concerns
12 for the loss of privacy, as well as anxiety over the impact of cybercriminals accessing
COLE & VAN NOTE
13 and using sensitive PII and/or financial information.
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 23. Representative Plaintiff has suffered imminent and impending injury
OAKLAND, CA 94607
15 arising from the substantially increased risk of fraud, identity theft, and misuse
TEL: (510) 891-9800 16 resulting from Representative Plaintiff’s PII and financial information, in
17 combination with Representative Plaintiff’s name, being placed in the hands of
18 unauthorized third parties.
19 24. Representative Plaintiff has a continuing interest in ensuring that the
20 PII and financial information, which, upon information and belief, remains backed
21 up in Defendant’s possession, is protected and safeguarded from future breaches.
22
23 DEFENDANT
24 25. Defendant DialAmerica Marketing, Inc. is a Delaware corporation
25 with a principal place of business located at 960 Macarthur Boulevard Mahwah,
26 New Jersey 07430.
27 26. Defendant provides call center outsourcing services across the United
28 States.
-6-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.42 Page 7 of 33
1 27. The true names and capacities of persons or entities, whether
2 individual, corporate, associate, or otherwise, who may be responsible for some of
3 the claims alleged here are currently unknown to Representative Plaintiff.
4 Representative Plaintiff will seek leave of court to amend this Complaint to reflect
5 the true names and capacities of such other responsible parties when their identities
6 become known.
7
8 CLASS ACTION ALLEGATIONS
9 28. Representative Plaintiff brings this action pursuant to the provisions of
10 Rules 23(a), (b)(2), and (b)(3) of the Federal Rules of Civil Procedure, on behalf of
11 Representative Plaintiff and the following classes/subclass(es) (collectively, the
12 “Classes”):
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
Nationwide Class:
ATTORNEYS AT LAW
“All individuals within the United States of America whose PII
14 and/or financial information was exposed to unauthorized third
OAKLAND, CA 94607 parties as a result of the data breach that occurred between
15 approximately February 2, 2021 and July 9, 2021.”
TEL: (510) 891-9800 16
California Subclass:
17 “All individuals within the State of California whose PII and/or
financial information was exposed to unauthorized third parties
18 as a result of the data breach that occurred between
approximately February 2, 2021 and July 9, 2021.”
19
20 29. Excluded from the Classes are the following individuals and/or entities:
21 (a) Defendant and Defendant’s parents, subsidiaries, affiliates, officers and
22 directors, and any entity in which Defendant has a controlling interest; (b) all
23 individuals who make a timely election to be excluded from this proceeding using
24 the correct protocol for opting out; (c) any and all federal, state or local governments,
25 including but not limited to its departments, agencies, divisions, bureaus, boards,
26 sections, groups, counsels, and/or subdivisions; and (d) all judges assigned to hear
27 any aspect of this litigation, as well as their immediate family members.
28
-7-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.43 Page 8 of 33
1 30. Representative Plaintiff reserves the right to request additional
2 subclasses be added, as necessary, based on the types of PII and financial
3 information that were compromised and/or the nature of certain Class Members’
4 relationship(s) to the Defendant. At present, collectively, Class Members include,
5 inter alia, all persons within the United States whose data was accessed in the Data
6 Breach.
7 31. Representative Plaintiff reserves the right to amend the above definition
8 in subsequent pleadings and/or motions for class certification.
9 32. This action has been brought and may properly be maintained as a class
10 action under Federal Rule of Civil Procedure Rule 23 because there is a well-defined
11 community of interest in the litigation and membership in the proposed classes is
12 easily ascertainable.
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
a. Numerosity: A class action is the only available method for the
ATTORNEYS AT LAW
fair and efficient adjudication of this controversy. The members
14 of the Plaintiff Classes are so numerous that joinder of all
OAKLAND, CA 94607 members is impractical, if not impossible. Representative
15 Plaintiff is informed and believes and, on that basis alleges, that
TEL: (510) 891-9800
the total number of Class Members is in the hundreds of
16 thousands of individuals. Membership in the Classes will be
determined by analysis of Defendant’s records.
17
b. Commonality: Representative Plaintiff and the Class Members
18 share a community of interests in that there are numerous
common questions and issues of fact and law which predominate
19 over any questions and issues solely affecting individual
members, including, but not necessarily limited to:
20
1) Whether Defendant had a legal duty to Representative
21 Plaintiff and the Classes to exercise due care in collecting,
storing, using, and/or safeguarding their PII;
22
2) Whether Defendant knew, or should have known, of the
23 susceptibility of its data security systems to a data breach;
24 3) Whether Defendant’s security procedures and practices to
protect its systems were reasonable in light of the measures
25 recommended by data security experts;
26 4) Whether Defendant’s failure to implement adequate data
security measures allowed the Data Breach to occur;
27 5) Whether Defendant failed to comply with its own policies
and applicable laws, regulations, and industry standards
28 relating to data security;
-8-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.44 Page 9 of 33
1
6) Whether Defendant adequately, promptly, and accurately
2 informed Representative Plaintiff and Class Members that
their PII had been compromised;
3
7) How and when Defendant actually learned of the Data
4 Breach;
5 8) Whether Defendant’s conduct, including its failure to act,
resulted in or was the proximate cause of the breach of its
6 systems, resulting in the loss of the PII of Representative
Plaintiff and Class Members;
7
9) Whether Defendant adequately addressed and fixed the
8 vulnerabilities which permitted the Data Breach to occur;
9 10) Whether Defendant engaged in unfair, unlawful, or
deceptive practices by failing to safeguard the PII of
10 Representative Plaintiff and Class Members;
11 11) Whether Representative Plaintiff and Class Members are
entitled to actual and/or statutory damages and/or whether
12 injunctive, corrective and/or declaratory relief and/or an
accounting is/are appropriate as a result of Defendant’s
COLE & VAN NOTE
13 wrongful conduct;
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 12) Whether Representative Plaintiff and Class Members are
OAKLAND, CA 94607
entitled to restitution as a result of Defendant’s wrongful
15 conduct.
TEL: (510) 891-9800 16 c. Typicality: Representative Plaintiff’s claims are typical of the
claims of the Plaintiff Classes. Representative Plaintiff and all
17 members of the Plaintiff Classes sustained damages arising out
of and caused by Defendant’s common course of conduct in
18 violation of law, as alleged herein. The same event and conduct
that gave rise to Representative Plaintiff’s claims are identical to
19 those that give rise to the claims of every Class Member because
Representative Plaintiff and Class Members’ Stored Data was
20 compromised in the same way by the same conduct of
Defendant. Representative Plaintiff and Class Members face
21 identical threats resulting from the resetting of their hard drives
and/or access by cybercriminals to the Stored Data maintained
22 thereon.
23 d. Adequacy of Representation: Representative Plaintiff in this
class action is an adequate representative of each of the Plaintiff
24 Classes in that Representative Plaintiff has the same interest in
the litigation of this case as the Class Members, is committed to
25 vigorous prosecution of this case, and has retained competent
counsel who are experienced in conducting litigation of this
26 nature. Representative Plaintiff is not subject to any individual
defenses unique from those conceivably applicable to other Class
27 Members or the Classes in their entirety. Representative Plaintiff
anticipates no management difficulties in this litigation.
28 Representative Plaintiff and its counsel will fairly and adequately
protect the interests of all Class Members.
-9-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.45 Page 10 of 33
1
e. Superiority of Class Action: The damages suffered by individual
2 Class Members are significant but may be small relative to the
enormous expense of individual litigation by each member. This
3 makes, or may make it, impractical for members of the Plaintiff
Classes to seek redress individually for the wrongful conduct
4 alleged herein. Even if Class Members could afford such
individual litigation, the court system could not. Should separate
5 actions be brought or be required to be brought by each
individual member of the Plaintiff Classes, the resulting
6 multiplicity of lawsuits would cause undue hardship and expense
for the Court and the litigants. The prosecution of separate
7 actions would also create a risk of inconsistent rulings which
might be dispositive of the interests of other Class Members who
8 are not parties to the adjudications and/or may substantially
impede their ability to adequately protect their interests.
9 Individualized litigation increases the delay and expense to all
parties, and to the court system, presented by the complex legal
10 and factual issues of the case. By contrast, the class action device
presents far fewer management difficulties and provides benefits
11 of single adjudication, economy of scale, and comprehensive
supervision by a single court.
12
33. Class certification is proper because the questions raised by this
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 Complaint are of common or general interest affecting numerous persons, such that
OAKLAND, CA 94607
15 it is impracticable to bring all Class Members before the Court individually.
TEL: (510) 891-9800 16 34. This class action is also appropriate for certification because Defendant
17 has acted and/or has refused to act on grounds generally applicable to the Classes,
18 thereby requiring the Court’s imposition of uniform relief to ensure compatible
19 standards of conduct toward Class Members and making final injunctive relief
20 appropriate with respect to the Classes in their entireties. Defendant’s policies
21 challenged herein apply to and affect Class Members uniformly. Representative
22 Plaintiff’s challenge of these policies hinges on Defendant’s conduct with respect to
23 all Class Members, not on facts or law uniquely applicable to the Representative
24 Plaintiff.
25 35. Unless a Class-wide injunction is issued, Defendant’s violations may
26 continue, and Defendant may continue to act unlawfully as set forth in this
27 Complaint.
28
-10-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.46 Page 11 of 33
1 COMMON FACTUAL ALLEGATIONS
2 The Cyberattack
3 36. In the course of the Data Breach, one or more unauthorized third parties
4 accessed Class Members’ sensitive data including, but not limited to, full names,
5 addresses, employer assigned identification numbers, Social Security numbers, and
6 financial account information. Representative Plaintiff was among the individuals
7 whose information was accessed in the Data Breach.
8 37. According to the sample data breach notification Defendant provided
9 to the California Attorney General’s Office on April 21, 2022,2 Defendant learned
10 that its network was accessed by an unauthorized third-party on July 4, 2021.
11 38. Representative Plaintiff was provided this information upon receipt of
12 the Notice, dated April 6, 2022. Representative Plaintiff was not aware of the Data
COLE & VAN NOTE
13 Breach until receiving the Notice.
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14
OAKLAND, CA 94607
15 Defendant’s Failed Response to the Breach
TEL: (510) 891-9800 16 39. Not until approximately nine months after it claims to have discovered
17 the Data Breach did Defendant begin sending the Notice to persons whose PII and/or
18 financial information Defendant confirmed was potentially compromised as a result
19 of the Data Breach. The Notice provided basic details of the Data Breach and
20 Defendant’s recommended next steps.
21 40. Upon information and belief, the unauthorized third-party
22 cybercriminals gained access to Representative Plaintiff’s and Class Members’ PII
23 and financial information with the intent of misusing, marketing and selling said
24 information.
25 41. Defendant had and continues to have obligations created by reasonable
26 industry standards, common law, state statutory law, and its own assurances and
27
2
28 https://oag.ca.gov/system/files/Dial%20America%20Sample%20Notice.pdf
(last accessed May 11, 2022).
-11-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.47 Page 12 of 33
1 representations to keep Representative Plaintiff’s and Class Members’ PII
2 confidential and to protect such PII from unauthorized access.
3 42. Representative Plaintiff and Class Members were required to provide
4 their PII and financial information to Defendant with the reasonable expectation and
5 mutual understanding that Defendant would comply with its obligations to keep such
6 information confidential and secure from unauthorized access.
7 43. Despite this, Representative Plaintiff and the Class Members remain,
8 even today, in the dark regarding what particular data was stolen, the particular
9 malware used, and what steps, if any, Defendant intends to take, to secure to secure
10 their PII and financial information going forward. Representative Plaintiff and Class
11 Members are left to speculate as to the full impact of the Data Breach and how
12 exactly Defendant intends to enhance its information security systems and
COLE & VAN NOTE
13 monitoring capabilities so as to prevent further breaches.
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 44. Representative Plaintiff’s and Class Members’ PII and financial
OAKLAND, CA 94607
15 information may end up for sale on the dark web, or simply fall into the hands of
TEL: (510) 891-9800 16 companies that will use the detailed PII and financial information for targeted
17 marketing without the approval of Representative Plaintiff and/or Class Members.
18 Either way, unauthorized individuals can now easily access the PII and/or financial
19 information of Representative Plaintiff and Class Members.
20
21 Defendant Collected/Stored Class Members’ PII and Financial Information
22 45. Defendant acquired, collected, and stored and assured reasonable
23 security over Representative Plaintiff’s and Class Members’ PII and financial
24 information.
25 46. Defendant required that Representative Plaintiff and Class Members
26 provide it with, inter alia, their full names, addresses, Social Security numbers, and
27 financial account information.
28
-12-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.48 Page 13 of 33
1 47. By obtaining, collecting, and storing Representative Plaintiff’s and
2 Class Members’ PII and financial information, Defendant assumed legal and
3 equitable duties and knew, or should have known, that it was thereafter responsible
4 for protecting Representative Plaintiff’s and Class Members’ PII and financial
5 information from unauthorized disclosure.
6 48. Representative Plaintiff and Class Members have taken reasonable
7 steps to maintain the confidentiality of their PII and financial information.
8 Representative Plaintiff and Class Members relied on Defendant to keep their PII
9 and financial information confidential and securely maintained, to use this
10 information for business purposes only, and to make only authorized disclosures of
11 this information.
12 49. Defendant could have prevented the Data Breach by properly securing
COLE & VAN NOTE
13 and encrypting and/or more securely encrypting its servers generally, as well as
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 Representative Plaintiff’s and Class Members’ PII and financial information.
OAKLAND, CA 94607
15 50. Defendant’s negligence in safeguarding Representative Plaintiff’s and
TEL: (510) 891-9800 16 Class Members’ PII and financial information is exacerbated by repeated warnings
17 and alerts directed to protecting and securing sensitive data, as evidenced by the
18 trending data breach attacks in recent years.
19 51. Due to the high-profile nature of many recent data breaches, Defendant
20 was and/or certainly should have been on notice and aware of such attacks occurring
21 and, therefore, should have assumed and adequately performed the duty of preparing
22 for such an imminent attack.
23 52. Yet, despite the prevalence of public announcements of data breach and
24 data security compromises, Defendant failed to take appropriate steps to protect
25 Representative Plaintiff’s and Class Members’ PII and financial information from
26 being compromised.
27
28
-13-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.49 Page 14 of 33
1 Defendant Had an Obligation to Protect the Stolen Information
2 53. Defendant’s failure to adequately secure Representative Plaintiff’s and
3 Class Members’ sensitive data breaches duties it owed Representative Plaintiff and
4 Class Members under statutory and common law. Representative Plaintiff and Class
5 Members surrendered their highly sensitive personal data to Defendant under the
6 implied condition that Defendant would keep it private and secure. Accordingly,
7 Defendant also had an implied duty to safeguard their data, independent of any
8 statute.
9 54. In addition to its obligations under federal and state laws, Defendant
10 owed a duty to Representative Plaintiff and Class Members to exercise reasonable
11 care in obtaining, retaining, securing, safeguarding, deleting, and protecting the PII
12 and financial information in Defendant’s possession from being compromised, lost,
COLE & VAN NOTE
13 stolen, accessed, and misused by unauthorized persons. Defendant owed a duty to
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 Representative Plaintiff and Class Members to provide reasonable security,
OAKLAND, CA 94607
15 including consistency with industry standards and requirements, and to ensure that
TEL: (510) 891-9800 16 its computer systems, networks, and protocols adequately protected the PII and
17 financial information of Representative Plaintiff and Class Members.
18 55. Defendant owed a duty to Representative Plaintiff and Class Members
19 to design, maintain, and test its computer systems, servers, and networks to ensure
20 that the PII and financial information in its possession was adequately secured and
21 protected.
22 56. Defendant owed a duty to Representative Plaintiff and Class Members
23 to create and implement reasonable data security practices and procedures to protect
24 the PII and financial information in its possession, including not sharing information
25 with other entities who maintained sub-standard data security systems.
26 57. Defendant owed a duty to Representative Plaintiff and Class Members
27 to implement processes that would detect a breach on its data security systems in a
28 timely manner.
-14-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.50 Page 15 of 33
1 58. Defendant owed a duty to Representative Plaintiff and Class Members
2 to act upon data security warnings and alerts in a timely fashion.
3 59. Defendant owed a duty to Representative Plaintiff and Class Members
4 to disclose if its computer systems and data security practices were inadequate to
5 safeguard individuals’ PII and/or financial information from theft because such an
6 inadequacy would be a material fact in the decision to entrust this PII and/or financial
7 information to Defendant.
8 60. Defendant owed a duty of care to Representative Plaintiff and Class
9 Members because they were foreseeable and probable victims of any inadequate data
10 security practices.
11 61. Defendant owed a duty to Representative Plaintiff and Class Members
12 to encrypt and/or more reliably encrypt Representative Plaintiff’s and Class
COLE & VAN NOTE
13 Members’ PII and financial information and monitor user behavior and activity in
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 order to identify possible threats.
OAKLAND, CA 94607
15
TEL: (510) 891-9800 16 Value of the Relevant Sensitive Information
17 62. The ramifications of Defendant’s failure to keep secure Representative
18 Plaintiff’s and Class Members’ PII and financial information are long lasting and
19 severe. Once PII and financial information is stolen, fraudulent use of that
20 information and damage to victims may continue for years. Indeed, the PII and/or
21 financial information of Representative Plaintiff and Class Members was taken by
22 hackers to engage in identity theft or to sell it to other criminals who will purchase
23 the PII and/or financial information for that purpose. The fraudulent activity
24 resulting from the Data Breach may not come to light for years.
25 63. These criminal activities have and will result in devastating financial
26 and personal losses to Representative Plaintiff and Class Members. For example, it
27 is believed that certain PII compromised in the 2017 Experian data breach was being
28 used, three years later, by identity thieves to apply for COVID-19-related benefits in
-15-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.51 Page 16 of 33
1 the state of Oklahoma. Such fraud will be an omnipresent threat for Representative
2 Plaintiff and Class Members for the rest of their lives. They will need to remain
3 constantly vigilant.
4 64. The FTC defines identity theft as “a fraud committed or attempted using
5 the identifying information of another person without authority.” The FTC describes
6 “identifying information” as “any name or number that may be used, alone or in
7 conjunction with any other information, to identify a specific person,” including,
8 among other things, “[n]ame, Social Security number, date of birth, official State or
9 government issued driver’s license or identification number, alien registration
10 number, government passport number, employer or taxpayer identification number.”
11 65. Identity thieves can use PII and financial information, such as that of
12 Representative Plaintiff and Class Members which Defendant failed to keep secure,
COLE & VAN NOTE
13 to perpetrate a variety of crimes that harm victims. For instance, identity thieves may
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 commit various types of government fraud such as immigration fraud, obtaining a
OAKLAND, CA 94607
15 driver’s license or identification card in the victim’s name but with another’s picture,
TEL: (510) 891-9800 16 using the victim’s information to obtain government benefits, or filing a fraudulent
17 tax return using the victim’s information to obtain a fraudulent refund.
18 66. There may be a time lag between when harm occurs versus when it is
19 discovered, and also between when PII and/or financial information is stolen and
20 when it is used. According to the U.S. Government Accountability Office (“GAO”),
21 which conducted a study regarding data breaches:
22 [L]aw enforcement officials told us that in some cases, stolen data may
be held for up to a year or more before being used to commit identity
23 theft. Further, once stolen data have been sold or posted on the Web,
fraudulent use of that information may continue for years. As a result,
24 studies that attempt to measure the harm resulting from data breaches
cannot necessarily rule out all future harm.3
25
26
27
3
28 Report to Congressional Requesters, GAO, at 29 (June 2007), available at:
http://www.gao.gov/new.items/d07737.pdf (last accessed November 4, 2021).
-16-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.52 Page 17 of 33
1 67. If cybercriminals manage to access to personally sensitive data—as
2 they did here—there is no limit to the amount of fraud to which Defendant may have
3 exposed Representative Plaintiff and Class Members.
4 68. Data breaches are preventable.4 As Lucy Thompson wrote in the DATA
5 BREACH AND ENCRYPTION HANDBOOK, “[i]n almost all cases, the data breaches that
6 occurred could have been prevented by proper planning and the correct design and
7 implementation of appropriate security solutions.”5 She added that “[o]rganizations
8 that collect, use, store, and share sensitive personal data must accept responsibility
9 for protecting the information and ensuring that it is not compromised . . . .”6
10 69. “Most of the reported data breaches are a result of lax security and the
11 failure to create or enforce appropriate security policies, rules, and procedures …
12 Appropriate information security controls, including encryption, must be
COLE & VAN NOTE
13 implemented and enforced in a rigorous and disciplined manner so that a data breach
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 never occurs.”7
OAKLAND, CA 94607
15 70. Here, Defendant knew of the importance of safeguarding PII and
TEL: (510) 891-9800 16 financial information and of the foreseeable consequences that would occur if
17 Representative Plaintiff’s and Class Members’ PII and financial information was
18 stolen, including the significant costs that would be placed on Representative
19 Plaintiff and Class Members as a result of a breach of this magnitude. Defendant had
20 the resources to deploy robust cybersecurity protocols. It knew, or should have
21 known, that the development and use of such protocols were necessary to fulfill its
22 statutory and common law duties to Representative Plaintiff and Class Members.
23 Defendant’s failure to do so is, therefore, intentional, willful, reckless, and/or grossly
24 negligent.
25
4
26 Lucy L. Thompson, “Despite the Alarming Trends, Data Breaches Are
Preventable,” in DATA BREACH AND ENCRYPTION HANDBOOK (Lucy Thompson,
27 ed., 2012).
5
Id. at 17.
28 6 Id. at 28.
7
Id.
-17-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.53 Page 18 of 33
1 71. Defendant disregarded the rights of Representative Plaintiff and Class
2 Members by, inter alia, (i) intentionally, willfully, recklessly, or negligently failing
3 to take adequate and reasonable measures to ensure that its network servers were
4 protected against unauthorized intrusions; (ii) failing to disclose that it did not have
5 adequately robust security protocols and training practices in place to adequately
6 safeguard Representative Plaintiff’s and Class Members’ PII and/or financial
7 information; (iii) failing to take standard and reasonably available steps to prevent
8 the Data Breach; (iv) concealing the existence and extent of the Data Breach for an
9 unreasonable duration of time; and (v) failing to provide Representative Plaintiff and
10 Class Members prompt and accurate notice of the Data Breach.
11
12 FIRST CLAIM FOR RELIEF
Negligence
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
(On behalf of the Nationwide Class)
ATTORNEYS AT LAW
14 72. Each and every allegation of the preceding paragraphs is incorporated
OAKLAND, CA 94607
15 in this cause of action with the same force and effect as though fully set forth herein.
TEL: (510) 891-9800 16 73. At all times herein relevant, Defendant owed Representative Plaintiff
17 and Class Members a duty of care, inter alia, to act with reasonable care to secure
18 and safeguard their PII and financial information and to use commercially
19 reasonable methods to do so. Defendant took on this obligation upon accepting and
20 storing the PII and financial information of Representative Plaintiff and Class
21 Members in its computer systems and on its networks.
22 74. Among these duties, Defendant was expected:
23 a. to exercise reasonable care in obtaining, retaining, securing,
safeguarding, deleting and protecting the PII and financial
24 information in its possession;
25 b. to protect Representative Plaintiff’s and Class Members’ PII and
financial information using reasonable and adequate security
26 procedures and systems that were/are compliant with industry-
standard practices;
27
c. to implement processes to quickly detect the Data Breach and to
28 timely act on warnings about data breaches; and
-18-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.54 Page 19 of 33
1
d. to promptly notify Representative Plaintiff and Class Members
2 of any data breach, security incident, or intrusion that affected or
may have affected their PII and financial information.
3
4
75. Defendant knew that the PII and financial information was private and
5
confidential and should be protected as private and confidential. Representative
6
Plaintiffs and Class Members were foreseeable and probable victims of any
7
inadequate security practices; thus, Defendant owed a duty of care to not subject
8
them to an unreasonable risk of harm.
9
76. Defendant knew, or should have known, of the risks inherent in
10
collecting and storing PII and financial information, the vulnerabilities of its data
11
security systems, and the importance of adequate security. Defendant knew about
12
numerous, well-publicized data breaches.
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
77. Defendant knew, or should have known, that its data systems and
14
OAKLAND, CA 94607
networks did not adequately safeguard Representative Plaintiff’s and Class
15
Members’ PII and financial information.
TEL: (510) 891-9800 16
78. Only Defendant was in the position to ensure that its systems and
17
protocols were sufficient to protect the PII and financial information that
18
Representative Plaintiff and Class Members had entrusted to it.
19
79. Defendant breached its duties to Representative Plaintiff and Class
20
Members by failing to provide fair, reasonable, or adequate computer systems and
21
data security practices to safeguard the PII and financial information of
22
Representative Plaintiff and Class Members.
23
80. Because Defendant knew that a breach of its systems could damage
24
millions of individuals, including Representative Plaintiff and Class Members,
25
Defendant had a duty to adequately protect those data systems and the PII and
26
financial information contained thereon.
27
81. Representative Plaintiff’s and Class Members’ willingness to entrust
28
Defendant with their PII and financial information was predicated on the
-19-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.55 Page 20 of 33
1 understanding that Defendant would take adequate security precautions. Moreover,
2 only Defendant had the ability to protect its systems and the PII and financial
3 information they stored on them from attack. Thus, Defendant had a special
4 relationship with Representative Plaintiff and Class Members.
5 82. Defendant also had independent duties under state and federal laws that
6 required it to reasonably safeguard Representative Plaintiff’s and Class Members’
7 PII and financial information and promptly notify them about the Data Breach.
8 These “independent duties” are untethered to any contract between Defendant and
9 Representative Plaintiff and/or the remaining Class Members.
10 83. Defendant breached its general duty of care to Representative Plaintiff
11 and Class Members in, but not necessarily limited to, the following ways:
12
a. by failing to provide fair, reasonable, or adequate computer
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
systems and data security practices to safeguard the PII and
ATTORNEYS AT LAW
financial information of Representative Plaintiff and Class
14 Members;
OAKLAND, CA 94607
15 b. by failing to timely and accurately disclose that Representative
TEL: (510) 891-9800
Plaintiff’s and Class Members’ PII and financial information had
16 been improperly acquired or accessed;
17 c. by failing to adequately protect and safeguard the PII and
financial information by knowingly disregarding standard
18 information security principles, despite obvious risks, and by
allowing unmonitored and unrestricted access to unsecured PII
19 and financial information;
20 d. by failing to provide adequate supervision and oversight of the
PII and financial information with which they were and are
21 entrusted, in spite of the known risk and foreseeable likelihood
of breach and misuse, which permitted an unknown third-party
22 to gather PII and financial information of Representative Plaintiff
and Class Members, misuse the PII, and intentionally disclose it
23 to others without consent.
24 e. by failing to adequately train its employees to not store PII and
financial information longer than absolutely necessary;
25
f. by failing to consistently enforce security policies aimed at
26 protecting Representative Plaintiff’s and the Class Members’ PII
and financial information;
27
g. by failing to implement processes to quickly detect data
28 breaches, security incidents, or intrusions; and
-20-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.56 Page 21 of 33
1
h. by failing to encrypt Representative Plaintiff’s and Class
2 Members’ PII and financial information and monitor user
behavior and activity in order to identify possible threats.
3
4 84. Defendant’s willful failure to abide by these duties was wrongful,
5 reckless, and grossly negligent in light of the foreseeable risks and known threats.
6 85. As a proximate and foreseeable result of Defendant’s grossly negligent
7 conduct, Representative Plaintiff and Class Members have suffered damages and are
8 at imminent risk of additional harms and damages (as alleged above).
9 86. The law further imposes an affirmative duty on Defendant to timely
10 disclose the unauthorized access and theft of the PII and financial information to
11 Representative Plaintiff and Class Members so that they could and/or still can take
12 appropriate measures to mitigate damages, protect against adverse consequences,
and thwart future misuse of their PII and financial information.
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 87. Defendant breached its duty to notify Representative Plaintiff and Class
OAKLAND, CA 94607
15 Members of the unauthorized access by waiting over a year after the Data Breach
TEL: (510) 891-9800 16 began and months after it was discovered to notify Representative Plaintiff and Class
17 Members and then by failing and continuing to fail to provide Representative
18 Plaintiff and Class Members sufficient information regarding the breach. To date,
19 Defendant has not provided sufficient information to Representative Plaintiff and
20 Class Members regarding the extent of the unauthorized access and continues to
21 breach its disclosure obligations to Representative Plaintiff and Class Members.
22 88. Further, through its failure to provide timely and clear notification of
23 the Data Breach to Representative Plaintiff and Class Members, Defendant
24 prevented Representative Plaintiff and Class Members from taking meaningful,
25 proactive steps to secure their PII and financial information.
26 89. There is a close causal connection between Defendant’s failure to
27 implement security measures to protect the PII and financial information of
28 Representative Plaintiff and Class Members and the harm suffered, or risk of
-21-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.57 Page 22 of 33
1 imminent harm suffered by Representative Plaintiff and Class Members.
2 Representative Plaintiff’s and Class Members’ PII and financial information was
3 accessed as the proximate result of Defendant’s failure to exercise reasonable care
4 in safeguarding such PII and financial information by adopting, implementing, and
5 maintaining appropriate security measures.
6 90. Defendant’s wrongful actions, inactions, and omissions constituted
7 (and continues to constitute) common law negligence.
8 91. The damages Representative Plaintiff and Class Members have
9 suffered (as alleged above) and will suffer were and are the direct and proximate
10 result of Defendant’s grossly negligent conduct.
11 92. Additionally, 15 U.S.C. §45 (FTC Act, Section 5) prohibits “unfair . . .
12 practices in or affecting commerce,” including, as interpreted and enforced by the
COLE & VAN NOTE
13 FTC, the unfair act or practice by businesses, such as Defendant, of failing to use
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 reasonable measures to protect PII and financial information. The FTC publications
OAKLAND, CA 94607
15 and orders described above also form part of the basis of Defendant’s duty in this
TEL: (510) 891-9800 16 regard.
17 93. Defendant violated 15 U.S.C. §45 by failing to use reasonable measures
18 to protect PII and financial information and not complying with applicable industry
19 standards, as described in detail herein. Defendant’s conduct was particularly
20 unreasonable given the nature and amount of PII and financial information it
21 obtained and stored and the foreseeable consequences of the immense damages that
22 would result to Representative Plaintiff and Class Members.
23 94. As a direct and proximate result of Defendant's negligence and
24 negligence per se, Representative Plaintiff and Class Members have suffered and
25 will suffer injury, including, but not limited to: (i) actual identity theft; (ii) the loss
26 of the opportunity of how their PII and financial information is used; (iii) the
27 compromise, publication and/or theft of their PII and financial information; (iv) out-
28 of-pocket expenses associated with the prevention, detection and recovery from
-22-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.58 Page 23 of 33
1 identity theft, tax fraud and/or unauthorized use of their PII and financial
2 information; (v) lost opportunity costs associated with effort expended and the loss
3 of productivity; (vi) addressing and attempting to mitigate actual and future
4 consequences, including, but not limited to, efforts spent researching ways to
5 prevent, detect, contest and/or recover from embarrassment and identity theft; (vii)
6 the continued risk to their PII and financial information, which may remain in
7 Defendant's possession and be the subject of further unauthorized disclosures so long
8 as Defendant fails to undertake adequate measures to protect Representative
9 Plaintiff's and Class Members' PII and financial information; and (viii) future costs
10 (e.g., time, effort, money) that may/will be expended to prevent, detect, contest
11 and/or repair the harm(s) attendant to the compromise of Representative Plaintiff's
12 and Class Members' PII and financial information.
COLE & VAN NOTE
13 95. As a direct and proximate result of Defendant’s negligence and
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 negligence per se, Representative Plaintiff and Class Members have suffered and
OAKLAND, CA 94607
15 will continue to suffer other forms of injury and/or harm, including, but not limited
TEL: (510) 891-9800 16 to, anxiety, emotional distress, loss of privacy, and other economic and non-
17 economic losses.
18 96. Additionally, as a direct and proximate result of Defendant’s
19 negligence and negligence per se, Representative Plaintiff and Class Members have
20 suffered and will suffer the continued risks of exposure of their PII and financial
21 information, which remain in Defendant’s possession and are subject to further
22 unauthorized disclosures so long as Defendant fails to undertake appropriate and
23 adequate measures to protect the PII and financial information in its continued
24 possession.
25
26
27
28
-23-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.59 Page 24 of 33
1 SECOND CLAIM FOR RELIEF
Breach of Implied Contract
2 (On behalf of the Nationwide Class)
3 97. Each and every allegation of the preceding paragraphs is incorporated
4 in this cause of action with the same force and effect as though fully set forth herein.
5 98. Through its course of conduct, Defendant, Representative Plaintiff, and
6 Class Members entered into implied contracts for Defendant to implement data
7 security adequate to safeguard and protect the privacy of Representative Plaintiff’s
8 and Class Members’ PII and financial information.
9 99. Defendant required Representative Plaintiff and Class Members to
10 provide and entrust their PII and financial information, including full names,
11 addresses, employer assigned identification numbers, Social Security numbers, and
12 financial account information.
100. Defendant solicited and invited Representative Plaintiff and Class
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 Members to provide their PII and financial information as part of Defendant’s
OAKLAND, CA 94607
15 regular business practices. Representative Plaintiff and Class Members accepted
TEL: (510) 891-9800 16 Defendant’s offers and provided their PII and financial information to Defendant.
17 101. As a condition of receiving services from Defendant, Representative
18 Plaintiff and Class Members provided and entrusted their PII and financial
19 information to Defendant. In so doing, Representative Plaintiff and Class Members
20 entered into implied contracts with Defendant by which Defendant agreed to
21 safeguard and protect such non-public information, to keep such information secure
22 and confidential, and to timely and accurately notify Representative Plaintiff and
23 Class Members if their data had been breached and compromised or stolen.
24 102. Defendant’s privacy policy provides that, except as outlined in its
25 policies, it “will not disclose, sell, or rent any of your information to any third parties
26 without your consent.” It further provides that it takes “certain physical,
27 administrative, and technical steps to protect personal information against
28
-24-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.60 Page 25 of 33
1 unauthorized access, use, or disclosure.”8 Based on these representations, Defendant
2 had a duty to take all reasonable steps to protect Representative Plaintiff’s and Class
3 Members’ data.
4 103. A meeting of the minds occurred when Representative Plaintiff and
5 Class Members agreed to, and did, provide their PII and financial information to
6 Defendant, in exchange for, amongst other things, the protection of their PII and
7 financial information.
8 104. Representative Plaintiff and Class Members fully performed their
9 obligations under the implied contracts with Defendant.
10 105. Defendant breached the implied contracts it made with Representative
11 Plaintiff and Class Members by failing to safeguard and protect their PII and
12 financial information and by failing to provide timely and accurate notice to them
COLE & VAN NOTE
13 that their PII and financial information was compromised as a result of the Data
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 Breach.
OAKLAND, CA 94607
15 106. As a direct and proximate result of Defendant’s above-described breach
TEL: (510) 891-9800 16 of implied contract, Representative Plaintiff and Class Members have suffered (and
17 will continue to suffer) (a) ongoing, imminent, and impending threat of identity theft
18 crimes, fraud, and abuse, resulting in monetary loss and economic harm; (b) actual
19 identity theft crimes, fraud, and abuse, resulting in monetary loss and economic
20 harm; (c) loss of the confidentiality of the stolen confidential data; (d) the illegal sale
21 of the compromised data on the dark web; (e) lost work time; and (f) other economic
22 and non-economic harm.
23
24 //
25 //
26 //
27
8
https://www.dialamerica.com/corporate/privacy-
28 policy/#:~:text=DialAmerica%20may%20use%20the%20information,content%2C
%20products%2C%20and%20services. (last accessed May 11, 2022).
-25-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.61 Page 26 of 33
1 THIRD CLAIM FOR RELIEF
Breach of the Implied Covenant of Good Faith and Fair Dealing
2 (On behalf of the Nationwide Class)
3 107. Each and every allegation of the preceding paragraphs is incorporated
4 in this cause of action with the same force and effect as though fully set forth herein.
5 108. Every contract has an implied covenant of good faith and fair dealing.
6 This implied covenant is an independent duty and may be breached even when
7 there is no breach of a contract’s actual and/or express terms.
8 109. Representative Plaintiff and Class Members have complied with and
9 performed all conditions of their contracts with Defendant.
10 110. Defendant breached the implied covenant of good faith and fair
11 dealing by failing to maintain adequate computer systems and data security practices
12 to safeguard PII and financial information, failing to timely and accurately disclose
the Data Breach to Representative Plaintiff and Class Members, and continued
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 acceptance of PII and financial information and storage of other personal
OAKLAND, CA 94607
15 information after Defendant knew, or should have known, of the security
TEL: (510) 891-9800 16 vulnerabilities of the systems that were exploited in the Data Breach.
17 111. Defendant acted in bad faith and/or with malicious motive in denying
18 Representative Plaintiff and Class Members the full benefit of their bargains as
19 originally intended by the parties, thereby causing them injury in an amount to be
20 determined at trial.
21
22
FOURTH CLAIM FOR RELIEF
23 Unfair Business Practices
(Cal. Bus. & Prof. Code, §17200, et seq.)
24 (On behalf of the California Subclass)
25 112. Each and every allegation of the preceding paragraphs is incorporated
26 in this cause of action with the same force and effect as though fully set forth herein.
27
28
-26-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.62 Page 27 of 33
1 113. Representative Plaintiff and California Subclass Members further bring
2 this cause of action, seeking equitable and statutory relief to stop the misconduct of
3 Defendant, as complained of herein.
4 114. Defendant has engaged in unfair competition within the meaning of
5 California Business & Professions Code §§17200, et seq., because Defendant’s
6 conduct is unlawful, unfair and/or fraudulent, as herein alleged.
7 115. Representative Plaintiff, the California Subclass Members, and
8 Defendant are each a “person” or “persons” within the meaning of § 17201 of the
9 California Unfair Competition Law (“UCL”).
10 116. The knowing conduct of Defendant, as alleged herein, constitutes an
11 unlawful and/or fraudulent business practice, as set forth in California Business &
12 Professions Code §§17200-17208. Specifically, Defendant conducted business
COLE & VAN NOTE
13 activities while failing to comply with the legal mandates cited herein. Such
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 violations include, but are not necessarily limited to:
OAKLAND, CA 94607
15 a. failure to maintain adequate computer systems and data security
TEL: (510) 891-9800
practices to safeguard PII and financial information;
16
b. failure to disclose that its computer systems and data security
17 practices were inadequate to safeguard PII and financial
information from theft;
18
c. failure to timely and accurately disclose the Data Breach to
19 Representative Plaintiff and California Subclass Members;
20 d. continued acceptance of PII and financial information and
storage of other personal information after Defendant knew or
21 should have known of the security vulnerabilities of the systems
that were exploited in the Data Breach; and
22
e. continued acceptance of PII and financial information and
23 storage of other personal information after Defendant knew or
should have known of the Data Breach and before they allegedly
24 remediated the Data Breach.
25
26 117. Defendant knew or should have known that its computer systems and
27 data security practices were inadequate to safeguard the PII and financial
28 information of Representative Plaintiff and California Subclass Members, deter
-27-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.63 Page 28 of 33
1 hackers, and detect a breach within a reasonable time and that the risk of a data
2 breach was highly likely.
3 118. In engaging in these unlawful business practices, Defendant has
4 enjoyed an advantage over its competition and a resultant disadvantage to the public
5 and California Subclass Members.
6 119. Defendant’s knowing failure to adopt policies in accordance with
7 and/or adhere to these laws, all of which are binding upon and burdensome to
8 Defendant’s competitors, engenders an unfair competitive advantage for Defendant,
9 thereby constituting an unfair business practice, as set forth in California Business
10 & Professions Code §§17200-17208.
11 120. Defendant has clearly established a policy of accepting a certain
12 amount of collateral damage, as represented by the damages to Representative
COLE & VAN NOTE
13 Plaintiff and California Subclass Members herein alleged, as incidental to its
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 business operations, rather than accept the alternative costs of full compliance with
OAKLAND, CA 94607
15 fair, lawful and honest business practices ordinarily borne by responsible
TEL: (510) 891-9800 16 competitors of Defendant and as set forth in legislation and the judicial record.
17 121. The UCL is, by its express terms, a cumulative remedy, such that
18 remedies under its provisions can be awarded in addition to those provided under
19 separate statutory schemes and/or common law remedies, such as those alleged in
20 the other causes of action of this Complaint. See Cal. Bus. & Prof. Code § 17205.
21 122. Representative Plaintiff and California Subclass Members request that
22 this Court enter such orders or judgments as may be necessary to enjoin Defendant
23 from continuing its unfair, unlawful, and/or deceptive practices and to restore to
24 Representative Plaintiff and California Subclass Members any money Defendant
25 acquired by unfair competition, including restitution and/or equitable relief,
26 including disgorgement or ill-gotten gains, refunds of moneys, interest, reasonable
27 attorneys’ fees, and the costs of prosecuting this class action, as well as any and all
28 other relief that may be available at law or equity.
-28-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.64 Page 29 of 33
1 123. Absent injunctive relief, Representative Plaintiff and Class Members
2 are under continued threat of future harm. Defendant maintains their data and has
3 not identified any specific steps it has taken to resolve the data security issues that
4 allowed the data breach to occur. Accordingly, Representative Plaintiff and Class
5 Members remain in the dark about what steps are being taken to secure their data,
6 let alone that Defendant is implementing all practices and processes to secure their
7 data. The only way they can be confident in the future security of this data is for this
8 Court to order Defendant to take the specific steps necessary to install a robust
9 cybersecurity protocol sufficient to adequately secure their data.
10
11 FIFTH CLAIM FOR RELIEF
Unjust Enrichment
12 (On behalf of the Nationwide Class)
COLE & VAN NOTE
13 124. Each and every allegation of the preceding paragraphs is incorporated
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 in this cause of action with the same force and effect as though fully set forth herein.
OAKLAND, CA 94607
15 125. By its wrongful acts and omissions described herein, Defendant has
TEL: (510) 891-9800 16 obtained a benefit by unduly taking advantage of Representative Plaintiff and Class
17 Members.
18 126. Defendant, prior to and at the time Representative Plaintiff and Class
19 Members entrusted their PII and financial information to Defendant, caused
20 Representative Plaintiff and Class Members to reasonably believe that Defendant
21 would keep such PII and financial information secure.
22 127. Defendant was aware, or should have been aware, that reasonable
23 consumers would have wanted their PII and financial information kept secure and
24 would not have contracted with Defendant, directly or indirectly, had they known
25 that Defendant’s information systems were sub-standard for that purpose.
26 128. Defendant was also aware that, if the substandard condition of and
27 vulnerabilities in its information systems were disclosed, it would negatively affect
28 Representative Plaintiff’s and Class Members’ decisions to seek services therefrom.
-29-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.65 Page 30 of 33
1 129. Defendant failed to disclose facts pertaining to its substandard
2 information systems, defects, and vulnerabilities therein before Representative
3 Plaintiff and Class Members made their decisions to make purchases, engage in
4 commerce therewith, and seek services or information. Instead, Defendant
5 suppressed and concealed such information. By concealing and suppressing that
6 information, Defendant denied Representative Plaintiff and Class Members the
7 ability to make a rational and informed purchasing decision and took undue
8 advantage of Representative Plaintiff and Class Members.
9 130. Defendant was unjustly enriched at the expense of Representative
10 Plaintiff and Class Members. Defendant received profits, benefits, and
11 compensation, in part, at the expense of Representative Plaintiff and Class Members.
12 By contrast, Representative Plaintiff and Class Members did not receive the benefit
COLE & VAN NOTE
13 of their bargain because they paid for products/services that did not satisfy the
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 purposes for which they bought/sought them.
OAKLAND, CA 94607
15 131. Since Defendant’s profits, benefits, and other compensation were
TEL: (510) 891-9800 16 obtained by improper means, Defendant is not legally or equitably entitled to retain
17 any of the benefits, compensation, or profits it realized from these transactions.
18 132. Representative Plaintiff and Class Members seek an Order of this
19 Court requiring Defendant to refund, disgorge, and pay as restitution any profits,
20 benefits, and other compensation obtained by Defendant from its wrongful conduct
21 and/or the establishment of a constructive trust from which Representative Plaintiff
22 and Class Members may seek restitution.
23
24 RELIEF SOUGHT
25 WHEREFORE, Representative Plaintiff, individually and on behalf and
26 each member of the proposed National Class and the California Subclass,
27 respectfully requests that the Court enter judgment in favor of the Plaintiff Class(es)
28 and for the following specific relief against Defendant as follows:
-30-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.66 Page 31 of 33
1 1. That the Court declare, adjudge, and decree that this action is a proper
2 class action and certify each of the proposed classes and/or any other appropriate
3 subclasses under F.R.C.P. Rule 23 (b)(1), (b)(2), and/or (b)(3), including
4 appointment of Representative Plaintiff’s counsel as Class Counsel;
5 2. For an award of damages, including actual, nominal, and consequential
6 damages, as allowed by law in an amount to be determined;
7 3. That the Court enjoin Defendant, ordering it to cease and desist from
8 unlawful activities in further violation of California Business and Professions Code
9 §17200, et seq.;
10 4. For equitable relief enjoining Defendant from engaging in the wrongful
11 conduct complained of herein pertaining to the misuse and/or disclosure of
12 Representative Plaintiff’s and Class Members’ PII, and from refusing to issue
COLE & VAN NOTE
13 prompt, complete, and accurate disclosures to Representative Plaintiff and Class
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14 Members;
OAKLAND, CA 94607
15 5. For injunctive relief requested by Representative Plaintiff, including
TEL: (510) 891-9800 16 but not limited to, injunctive and other equitable relief as is necessary to protect the
17 interests of Representative Plaintiff and Class Members, including but not limited to
18 an Order:
19 a. prohibiting Defendant from engaging in the wrongful and
unlawful acts described herein;
20
b. requiring Defendant to protect, including through encryption, all
21 data collected through the course of business in accordance with
all applicable regulations, industry standards, and federal, state,
22 or local laws;
23 c. requiring Defendant to delete and purge the PII of Representative
Plaintiff and Class Members unless Defendant can provide to the
24 Court reasonable justification for the retention and use of such
information when weighed against the privacy interests of
25 Representative Plaintiff and Class Members;
26 d. requiring Defendant to implement and maintain a comprehensive
Information Security Program designed to protect the
27 confidentiality and integrity of Representative Plaintiff’s and
Class Members’ PII;
28
-31-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.67 Page 32 of 33
1 e. requiring Defendant to engage independent third-party security
auditors and internal personnel to run automated security
2 monitoring, simulated attacks, penetration tests, and audits on
Defendant’s systems on a periodic basis;
3
f. prohibiting Defendant from maintaining Representative
4 Plaintiff’s and Class Members’ PII on a cloud-based database;
5 g. requiring Defendant to segment data by creating firewalls and
access controls so that, if one area of Defendant’s network is
6 compromised, hackers cannot gain access to other portions of
Defendant’s systems;
7
h. requiring Defendant to conduct regular database scanning and
8 securing checks;
9 i. requiring Defendant to establish an information security training
program that includes at least annual information security
10 training for all employees, with additional training to be provided
as appropriate based upon the employees’ respective
11 responsibilities with handling PII, as well as protecting the PII of
Representative Plaintiff and Class Members;
12
j. requiring Defendant to implement a system of tests to assess its
COLE & VAN NOTE
13 respective employees’ knowledge of the education programs
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
discussed in the preceding subparagraphs, as well as randomly
14 and periodically testing employees’ compliance with
OAKLAND, CA 94607
Defendant’s policies, programs, and systems for protecting
15 personal identifying information;
TEL: (510) 891-9800 16 k. requiring Defendant to implement, maintain, review, and revise
as necessary a threat management program to appropriately
17 monitor Defendant’s networks for internal and external threats,
and assess whether monitoring tools are properly configured,
18 tested, and updated;
19 l. requiring Defendant to meaningfully educate all Class Members
about the threats that they face as a result of the loss of their
20 confidential personal identifying information to third parties, as
well as the steps affected individuals must take to protect
21 themselves.
22
23 6. For prejudgment interest on all amounts awarded, at the prevailing legal
24 rate;
25 7. For an award of attorneys’ fees, costs, and litigation expenses, as
26 allowed by law;
27 8. For all other Orders, findings, and determinations identified and sought
28 in this Complaint.
-32-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
Case 3:22-cv-00689-LL-BGS Document 1 Filed 05/16/22 PageID.68 Page 33 of 33
1 JURY DEMAND
2 Representative Plaintiff, individually and on behalf of the Plaintiff Class(es)
3 and/or Subclass(es), hereby demands a trial by jury for all issues triable by jury.
4
5 Dated: May 16, 2022 COLE & VAN NOTE
6
7 Cody A. Bolce
By: _______________
8 Cody A. Bolce, Esq.
Attorneys for Representative Plaintiff
9 and the Plaintiff Class(es)
10
11
12
COLE & VAN NOTE
13
555 12TH STREET, SUITE 1725
ATTORNEYS AT LAW
14
OAKLAND, CA 94607
15
TEL: (510) 891-9800 16
17
18
19
20
21
22
23
24
25
26
27
28
-33-
COMPLAINT FOR DAMAGES,
INJUNCTIVE AND EQUITABLE RELIEF
File and source
- File
- 1.pdf
- Size
- 449,107 bytes
- SHA-256
- 71f63f6f0c632d26c07367d923184d194ddb42d0b6b077de7b5eeed359dbe859
- Our copy
- 1.pdf
- Original
- No public link identified.