Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 1 of 92 PageID# 14841

IN THE UNITED STATES DISTRICT COURTFOR THE EASTERN DISTRICT OF VIRGINIAALEXANDRIA DIVISIONIN RE: CAPITAL ONE CONSUMERDATA SECURITY BREACH LITIGATION)))MDL No. 1:19md2915 (AJT/JFA)JURY TRIAL DEMANDEDThis Document Relates to the Consumer Cases
SECOND AMENDED REPRESENTATIVE CONSUMER CLASS ACTIONCOMPLAINT

553501.1

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 2 of 92 PageID# 14842

The representative Plaintiffs identified below (collectively, “Plaintiffs”), individually andon behalf of the classes defined below of similarly situated persons, allege the following against
Defendants Capital One Financial Corporation, Capital One Bank (USA) N.A., and Capital One,
N.A. (collectively, the “Capital One Defendants” or “Capital One”), and against Amazon.com,
Inc., and Amazon Web Services, Inc. (collectively, the “Amazon Defendants” or “Amazon”; with
the Capital One and Amazon Defendants collectively, “Defendants”), based upon personal
knowledge with respect to themselves and on information and belief derived from, among otherthings, investigation of counsel and review of public documents as to all other matters.
PREAMBLE
On October 2, 2019, the Judicial Panel on Multidistrict Litigation established this MDL to“serve the convenience of the parties and witnesses and promote the just and efficient conduct of
this litigation.” In Pretrial Order No. 1, the Court stated it was considering “requiring defendants
to file an answer on a consolidated basis by answering a single representative complaint or a
generic complaint, to be prepared that contains factual allegations common to all cases or classesof cases.” Doc. 3 at 20. On January 27, 2020, Plaintiffs’ Lead Counsel stated they intended to filea representative complaint that “presents factual allegations and select claims from many of theconstituent complaints in this MDL,” so that “both the parties and the Court can advance thelitigation on threshold issues to evaluate the strengths and weaknesses of the claims and defenses
and prospects for settlement.” Doc. 295 at 5. Subsequently, in Pretrial Order No. 8 the Court
ordered Plaintiffs’ Lead Counsel to file this representative complaint. Doc. 302 at 1.
This is not a consolidated, wholly superseding complaint, though it is intended to be thesole operative complaint as to the claims stated herein. Therefore, this pleading contains factual
allegations common to all consumer actions in this MDL, along with representative claims statedunder the laws of Virginia, where the Capital One Defendants are located, Washington, where the553501.1

1Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 3 of 92 PageID# 14843

Amazon Defendants are located, as well as under the laws of states with the largest populations:
California, Florida, New York, and Texas. These claims broadly cover the facts alleged inconstituent cases, the theories of Article III standing and damages alleged in all consumer cases,
and—with the exception of claims under the Racketeer Influenced and Corrupt Organizations Act
and claims for common law fraud asserted in Broderick, No. 1:19-cv-01454-AJT-JFA—the rangeof types of claims asserted by consumers in this MDL. Consistent with Pretrial Order No. 1,
pleading and litigating these wide-ranging representative claims while other state-by-state claims
remain abated is intended by Plaintiffs to streamline dispositive motions and discovery, and further
the Court’s stated goal to “complete pre-trial proceedings . . . expeditiously, efficiently and fairly,
while eliminating duplicative discovery, preventing inconsistent pre-trial rulings . . . andconserving the resources of the parties, their counsel, and the judiciary.” Doc. 3 at 1-2.
INTRODUCTION
1.

On July 29, 2019, Capital One, one of the largest banks and credit card issuers in the

United States, announced it had experienced a data breach that affected over 100 million people in
the United States and six million people in Canada (the “Data Breach”).1
2.

The approximately 106 million individuals affected were largely consumers andsmall businesses who applied for credit card products between 2005 and 2019. The stolen datareported included names, addresses, zip codes, phone numbers, email addresses, dates of birth, selfreported income, approximately 140,000 Social Security Numbers, 80,000 bank account numbers,
credit scores, credit card limits, credit card balances, credit card payment history, and fragments oftransaction data from 23 days during 2016, 2017, and 2018 (collectively, “PII”).

1

Capital
One
Form
8-K
(July
29,
2019)
https://sec.report/Document/0000927628-19-000262/.
553501.1

2(“July29Form8-K”),

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 4 of 92 PageID# 14844

3.

Through their failure to adequately protect Plaintiffs’ and class members’ PII, theCapital One Defendants and the Amazon Defendants, which hosted the PII on Amazon Web
Services (“AWS”), allowed Paige A. Thompson (“Thompson”), a former Amazon employee, toobtain access to and to surreptitiously view, remove, and make public Plaintiffs’ and class members’
PII entrusted to Defendants.
4.

The massive breach went undiscovered by Defendants despite the fact that the

hacker had posted publicly about the breach on Twitter and other social media sites over the courseof several months2 and despite the fact that Capital One had records of the unauthorized intrusion.
Moreover, Capital One—which has almost limitless resources to protect the vulnerable data
entrusted to it and in the face of well publicized data breaches sustained by numerous othercompanies, including financial institutions in the United States—was fully aware of the perils of adata breach and its legal responsibility to protect against a data breach, acknowledging publicly that“[s]afeguarding our customers’ information is essential to our mission as a financial institution.”3
And all Defendants knew of the particular security vulnerabilities that permitted the Data Breach,but still failed to protect Plaintiffs’ and class members’ PII.
5.

Capital One claimed that it was able to “immediately address[] the configuration

vulnerability” after the Data Breach,4 but it was too little too late for the millions of Americans
whose privacy has been compromised and who now must contend with the loss of this valuable
data and resultant and imminent identity theft and fraud. And despite Capital One’s assurances, vast
amounts of PII belonging to Plaintiffs and class members remains dangerously exposed and2

Krebs on Security, Capital One Data Theft Impacts 106M People (July 30, 2019),
https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/.
3
July 29 Form 8-K.
4
Id.
553501.1

3

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 5 of 92 PageID# 14845

vulnerable to theft and fraud as currently maintained and used by Amazon and Capital One for theirown profit.
JURISDICTION AND VENUE
6.

This Court has subject matter jurisdiction pursuant to the Class Action Fairness Act

of 2005 (“CAFA”), 28 U.S.C. § 1332(d). The amount in controversy exceeds the sum of $5,000,000
exclusive of interest and costs, there are more than 100 putative class members, and minimal
diversity exists because many putative class members are citizens of a different state than
Defendants. This Court also has supplemental jurisdiction pursuant to 28 U.S.C. § 1367(a) because
all claims alleged herein form part of the same case or controversy.
7.

This Court has personal jurisdiction over Capital One because it is headquartered inand maintains its principal place of business in this District. Capital One is authorized to andregularly conducts business in Virginia. In this District, Capital One makes decisions regarding
corporate governance and management of its credit card business, including decisions regarding thesecurity measures to protect its customers’ PII. Capital One intentionally avails itself of thisjurisdiction by promoting, selling and marketing its services from Virginia to millions of consumers
nationwide.
8.

This Court has personal jurisdiction over Amazon because it is authorized to andregularly conducts business in Virginia and has sufficient minimum contacts in Virginia such that
Amazon intentionally avails itself of this Court’s jurisdiction by conducting operations here andpromoting, selling and marketing its services in this District.
9.

Venue is proper in this District under 28 U.S.C. § 1391(a) through (d) because

Capital One’s headquarters and principal place of business are located in this District, Capital One
resides in this District, and substantial parts of the events or omissions giving rise to the claims
occurred in or emanated from this District, including, without limitation, decisions made by Capital
553501.1

4Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 6 of 92 PageID# 14846

One’s governance and management personnel or inaction by those individuals that led tomisrepresentations, invasions of privacy, and the Data Breach. Moreover, Amazon maintains
physical facilities in this District, conducts business in this District, provided services to Capital
One in this District, and is executing plans to build a new headquarters in this District.
DEFENDANTS
10.

Defendant Capital One Financial Corporation is a bank holding company thatspecializes in credit cards, auto loans, and banking and savings accounts. It is headquartered in
McLean, Virginia, and incorporated under the laws of the State of Delaware.
11.

Defendant Capital One, N.A. is a national bank with its principal place of businessin McLean, Virginia. Defendant Capital One, N.A. is a wholly-owned subsidiary of Capital One
Financial Corporation.
12.

Defendant Capital One Bank (USA), N.A. is a national bank with its principal placeof business in McLean, Virginia. Defendant Capital One Bank (USA), N.A. is a wholly-owned
subsidiary of Capital One Financial Corporation.
13.

Defendant Amazon.com, Inc. is a corporation with its headquarters and principal

place of business in Seattle, Washington, and incorporated under the laws of the State of Delaware.
14.

Defendant Amazon Web Services, Inc. is a corporation with its headquarters andprincipal place of business in Seattle, Washington, and incorporated under the laws of the State of
Delaware. Amazon Web Services, Inc. is a subsidiary of Amazon.com, Inc.
NAMED PLAINTIFFS
15.

Plaintiffs are individuals who, upon information and belief, had their PII

compromised in the Data Breach, and bring this action on behalf of themselves and all thosesimilarly situated both across the United States and within their State residence. The following
allegations are made upon information and belief derived from, among other things, investigation
553501.1

5Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 7 of 92 PageID# 14847

of counsel, public sources, and the facts and circumstances as currently known. Because Defendants
have exclusive knowledge of what information was compromised for each individual, Plaintiffs
reserve their right to supplement their allegations with additional facts and injuries as they are
discovered.
16.

Plaintiffs place significant value in the security of their PII. Plaintiffs entrusted their

sensitive PII to Defendants with the understanding, based on Defendants’ statements andrepresentations, that Defendants would keep their information secure and employ reasonable andadequate security measures to ensure that it would not be compromised. If Plaintiffs had known of
Defendants’ lax security practices with respect to Plaintiffs’ PII, they would not have done businesswith Capital One, would not have applied for Capital One credit cards, would not have opened,
used, or continued to use Capital One credit cards or banking services at the applicable interest rates
and on the applicable terms, or would have paid less because of the diminished value of Capital
One’s services.
17.

Plaintiffs’ PII remains at risk because Defendants continue to store and use that data

in a manner that unreasonably exposes it to targeting by malicious third parties for identity theft,
fraud, and misuse.
CALIFORNIA
18.

Plaintiff Brandon Hausauer is a resident and citizen of San Francisco, California.

Prior to the Data Breach, Plaintiff Hausauer applied for and used a personal Capital One credit card,a business credit card, and a business checking and savings account, and provided his PII to Capital
One in order to do so. On August 7, 2019, he received a letter from Capital One informing him thathackers had obtained his name and Business Tax Identification number, which is also his Social
Security Number, as part of the Data Breach. Capital One also stated that the hackers may haveobtained his: name, address, zip code/postal code, phone number, email address, date of birth, self553501.1

6

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 8 of 92 PageID# 14848

reported income, credit card customer data including customer status data (for example, creditscores, credit limits, balances, payment history and contact information) and fragments oftransactional data from 23 days during 2016, 2017 and 2018. If Plaintiff Hausauer had known that
Capital One’s data security measures were inadequate to safeguard customers’ PII from theft, hewould not have applied for or used a Capital One credit card or provided his PII. As a result of theData Breach, Plaintiff Hausauer spent time and effort regularly monitoring his accounts to detectfraudulent activity in order to mitigate against potential harm. Given the highly-sensitive nature of
the information stolen, Plaintiff Hausauer remains at a substantial and imminent risk of future harm.
19.

Plaintiff Caralyn Tada is a resident and citizen of Los Angeles, California. Prior to

the Data Breach, Plaintiff Tada applied for and used a Capital One credit card, and provided her PII
to Capital One in order to do so. On or around the end of August 2019, Plaintiff Tada received
notice of the Data Breach from Capital One. Plaintiff Tada then spoke by phone to a Capital One
representative who confirmed that Ms. Tada’s PII had been compromised in the Data Breach. Since
the Data Breach, Plaintiff Tada has experienced several incidents of attempted fraud on several ofher bank accounts, including at least one large charge, which has caused Plaintiff Tada to expend
significant time, effort, and worry. Further, as a result of the Data Breach, Plaintiff Tada spent timeand effort regularly monitoring her accounts to detect fraudulent activity in order to mitigate against
potential harm. Plaintiff Tada also purchased and continues to pay $25 per month for creditmonitoring due to the Data Breach. If Plaintiff Tada had known that Capital One’s data security
measures were inadequate to safeguard customers’ PII from theft, she would not have applied foror used Capital One credit cards or provided her PII. Given the highly-sensitive nature of theinformation stolen, Plaintiff Tada remains at a substantial and imminent risk of future harm.

553501.1

7Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 9 of 92 PageID# 14849

FLORIDA
20.

Plaintiff Emily Behar is a resident and citizen of Delray Beach, Florida. Prior to the

Data Breach, Plaintiff Behar applied for and used a Capital One credit card, and provided her PII
to Capital One in order to do so. On August 7, 2019, Plaintiff Behar received a letter from Capital
One informing her that hackers had obtained her name and Social Security number as part of theData Breach. Capital One also stated that the hackers may have obtained her: name, address, zip
code/postal code, phone number, email address, date of birth, self-reported income, credit cardcustomer data including customer status data (for example, credit scores, credit limits, balances,payment history and contact information) and fragments of transactional data from 23 days during
2016, 2017 and 2018. After the Data Breach, Plaintiff Behar suffered identity theft and fraud in theform of unauthorized charges. As a result of the Data Breach, Plaintiff Behar spent time and effort
dealing with the unauthorized charges as well as regularly monitoring her accounts to detectfraudulent activity and monitoring her credit accounts in order to mitigate against potential harm.
If Plaintiff Behar had known that Capital One’s data security measures were inadequate to safeguardcustomers’ PII from theft, she would not have applied for or used a credit card or provided her PII.
Given the highly-sensitive nature of the information stolen, Plaintiff Behar remains at a substantial
and imminent risk of future harm.
21.

Plaintiff Gary Zielicke is a resident and citizen of Clewiston, Florida. Prior to the

Data Breach, Plaintiff Zielicke applied for and used a Capital One credit card, and provided his PII
to Capital One in order to do so. After the Data Breach, Plaintiff Zielicke experienced identity theft
and fraud, including that his cell phone, a number associated with his Capital One credit card, hadbeen de-activated by an unauthorized individual and large unauthorized charges had been charged
to his Capital One credit card. Plaintiff Zielicke was not able to recover control over his cell phone
number for several days, during which he expended time and money in his efforts to re-gain control.
553501.1

8Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 10 of 92 PageID# 14850

Plaintiff Zielicke also spent significant time reporting the identity theft to the police and working
to resolve it. When Plaintiff Zielicke contacted Capital One about the identity theft of his Capital
One card, representatives of Capital One informed him that the identity theft may be related to the
Data Breach. In subsequent months, Plaintiff Zielicke has experienced further identity theft wherein
an unauthorized individual opened an account in his name and used the account to pay tens of
thousands of dollars in his name, which was then registered as a delinquent account in his nameresulting in his credit score dropping several hundred points. Because of the multiple incidents ofidentity theft, Plaintiff Zielicke has frozen his credit. He has also expended significant amounts oftime, effort, and money in resolving the issues, including continuing to regularly monitor his
accounts to detect any future fraudulent activity. If Plaintiff Zielicke had known that Capital One’s
data security measures were inadequate to safeguard customers’ PII from theft, he would not haveapplied for or used Capital One credit cards or provided his PII. Given the highly-sensitive natureof the information stolen, Plaintiff Zielicke remains at a substantial and imminent risk of futureharm.
NEW YORK
22.

Plaintiff Emily Gershen is a resident and citizen of Brooklyn, New York. Prior to

the Data Breach, Plaintiff Gershen applied for and used her Capital One credit card in New York,and provided her PII to Capital One in order to do so. After the Data Breach, Plaintiff Gershen
experienced identity theft and fraud when an unauthorized person attempted to open numerous
credit card, bank accounts, and loans in her name. On September 27, 2019, after an inquiry, Capital
One sent Plaintiff Gershen an “Update About the Capital One Data Security Incident.” Plaintiff
Gershen has spent significant amounts of time to resolve the unauthorized efforts to exploit her PII
and to protect against further attacks on her credit, including placing freezes on her credit reports
and spending many hours ensuring there were no further unauthorized charges or accounts and that553501.1

9Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 11 of 92 PageID# 14851

the fraudulent accounts were closed. Plaintiff Gershen also expended time filing a police report
regarding the identity theft, and recently learned that the identity theft she has suffered will impact
the filing of her taxes this year and in the years to come. If Plaintiff Gershen had known that Capital
One’s data security measures were inadequate to safeguard customers’ PII from theft, she would
not have applied for or used Capital One credit cards or provided her PII. Given the highly-sensitive
nature of the information stolen, Plaintiff Gershen remains at a substantial and imminent risk of
future harm.
TEXAS
23.

Plaintiff Brandi Edmondson is a resident and citizen of Dallas, Texas. Prior to the

Data Breach, Plaintiff Edmondson applied for and used a Capital One credit card, and provided her
PII to Capital One in order to do so. As a result of the Data Breach, Plaintiff Edmondson spent timeand effort dealing with these unauthorized account requests and expended further time and effort
regularly monitoring her accounts to detect fraudulent activity in order to mitigate against potential
harm. If Plaintiff Edmondson had known that Capital One’s data security measures were
inadequate to safeguard customers’ PII from theft, she would not have applied for or used Capital
One credit cards or provided her PII. Given the highly-sensitive nature of the information stolen,
Plaintiff Edmondson remains at a substantial and imminent risk of future harm.
VIRGINIA
24.

Plaintiff John Spacek is a resident and citizen of Richmond, Virginia. Prior to the

Data Breach, Plaintiff Spacek applied for and used a Capital One credit card, and provided his PII
to Capital One in order to do so. Plaintiff Spacek received an email from Capital One in or around
Summer 2019 informing him of the Data Breach, and shortly thereafter, Plaintiff Spacek
experienced unauthorized charges on his accounts. As a result of the Data Breach, Plaintiff Spacek
spent time and effort dealing with these unauthorized charges and expended further time and effort
553501.1

10Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 12 of 92 PageID# 14852

regularly monitoring his accounts to detect fraudulent activity in order to mitigate against potential
harm. If Plaintiff Spacek had known that Capital One’s data security measures were inadequate tosafeguard customers’ PII from theft, he would not have applied for or used Capital One credit cards
or provided his PII. Given the highly-sensitive nature of the information stolen, Plaintiff Spacek
remains at a substantial and imminent risk of future harm.
WASHINGTON
25.

Plaintiff Sara Sharp is a resident of Ocean Shores, Washington. Prior to the Data

Breach, Plaintiff Sharp applied for and used a Capital One credit card, and provided her PII to
Capital One in order to do so. After the Data Breach, Plaintiff Sharp suffered identity theft and fraudin the form of unauthorized charges on her bank account, as well as reports of fraudulent charges
made in her name. As a result of this fraud, Plaintiff Sharp spent time investigating the source ofthe fraud and unauthorized charges. On January 11, 2020, after an inquiry, Capital One sent Plaintiff
Sharp an “Update About the Capital One Data Security Incident.” If Plaintiff Sharp had known that
Capital One’s data security measures were inadequate to safeguard customers’ PII from theft, shewould not have applied for or used a Capital One credit card or provided her PII. As a result of theData Breach, Plaintiff Sharp spent time and effort regularly monitoring her accounts to detectfraudulent activity in order to mitigate against potential harm. Given the highly-sensitive nature of
the information stolen, Plaintiff Sharp remains at a substantial and imminent risk of future harm.
FACTUAL ALLEGATIONS“We’re building a technology company that does banking.”
Richard D. Fairbank - Chairman, CEO and President of Capital One, February 20, 2019A.

Capital One’s Collection and Use of Customer Data
26.

Capital One is one of the largest banks and credit card issuers in the United States.

In 2018 it recorded over $28 billion in revenues and had $107.35 billion in credit card loans

553501.1

11

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 13 of 92 PageID# 14853

outstanding in the United States, with credit cards representing 47.3% of total loans outstanding. In
addition to credit card loans, Capital One offers banking services, including checking accounts,
saving accounts, and money market accounts as well as retail and auto loans. As of December 31,
2018, the company had $2.864 billion in retail loans outstanding and $56.341 billion in auto financeloans outstanding, representing 24.1% of total loans outstanding.5
27.

Capital One routinely collects PII from consumers and small businesses applying

for its credit. Applicants are asked for name, date of birth, social security number, address, phone
number, annual income, mortgage information, bank account information, and other personal
financial information. The PII collected by Capital One is not simply used to process a card or loan
application, but is also used to determine credit limits, interest rates, fees, and other terms of credit.
28.

In addition to this customary use of PII to make credit decisions, Capital One

maintains and mines the data for purposes of product development, targeted solicitation for new
products, and target marketing of new partners—all in an effort to boost its profits.
29.

From its beginning, Capital One adopted this “Information Based Strategy,” or IBS,

to obtain a competitive advantage. In its very first Form 10-K in 1996, Capital One explained:
The Company’s IBS is designed to allow the Company to differentiate
among customers based on credit risk, usage and other characteristics andto match customer characteristics with appropriate product offerings. IBS
involves developing sophisticated models, information systems, welltrained personnel and a flexible culture to create credit card or otherproducts and services that address the demands of changing consumer andcompetitive markets. By using sophisticated statistical modelingtechniques, the Company is able to segment its potential customer lists
based upon the integrated use of credit scores, demographics, customer
behavioral characteristics and other criteria. By actively testing a wide
variety of product and service features, marketing channels and otheraspects of its offerings, the Company can design and target customized
solicitations at various customer segments, thereby enhancing customer
5

Capital One 2018 Annual Report, at 3, 78, available at https://ir-capitalone.gcs-web.com/staticfiles/04c57bd9-b351-418c-9f18-ed91d4bfad23.
553501.1

12Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 14 of 92 PageID# 14854

response levels and maximizing returns on investment within given
underwriting parameters.630.

In its 2018 Annual Report, Capital One recalled its 25-year history of using

technology to advance its business:
Capital One Was the Original “FinTech.” It didn’t come easy at first. We
had more passion than customers and more belief than believers. The term
didn’t exist yet, but in the early days of Capital One, we were a FinTech.
For a while it was unclear if our little company would get a chance to makea big impact. We were a start-up: recruiting talent, building modern
technology from scratch, conducting tests, and incubating results. And allalong the way, we worked to keep the dream alive. While the initial idea
came quickly, it took five lonely years until we had our first success.
Against all odds, it finally worked, and we haven’t looked back. We built
one of the nation’s largest credit card businesses and then did the same thing
in auto finance and small business cards.7
31.

As technology improved throughout the 1990’s and 2000’s, Capital One’s

Information Based Strategy moved to a digitally based system. For example, Capital One’s 2011
Form 10-K stated that Capital One “leverage[s] information technology to achieve our businessobjectives and to develop and deliver products and services that satisfy our customers’ needs [a key
aspect of which is] the development of efficient, flexible computer and operational systems to
support complex marketing and account management strategies and the development of new anddiversified products.”8 This strategy also prompted Capital One to utilize artificial intelligence toanalyze customer data, which would require Capital One to collect, store, and mine customer dataon an unprecedented scale.

6

CapitalOne
Financial
Corporation,
1996
Form
10-K,
available
http://getfilings.com/o0000950133-97-001012.html.
7
Capital One 2018 Annual Report, at 3.
8
CapitalOne
Financial
Corporation,
2011
Form
10-K,
available
http://investor.capitalone.com/static-files/9982f071-158b-4ecd-9a42-77200b9d2442.
553501.1

13

at
at

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 15 of 92 PageID# 14855

32.

Machine learning is an application of artificial intelligence through which computer

algorithms are given raw data and “learn” on their own to discern patterns and accomplish tasks.
As an example, in the financial services industry, machine learning is used to detect unauthorized
use of a credit card by analyzing customer data to discern patterns suggestive of unauthorizedtransactions. Artificial intelligence programs can detect patterns in data that are difficult for humans
to perceive.
33.

Machine learning requires data. There is a direct correlation between the amount ofdata provided to the machine learning algorithm and the effectiveness of the machine learningalgorithm.9 Thus, the more data made available to these artificial intelligence programs, the moreaccurate and useful the programs will be.
34.

To store, process, and mine sensitive customer data, banks like Capital One

traditionally use a dedicated-server or private-cloud solution for their storage and processing needs.
Dedicated servers assign specific hardware and software to perform specific tasks, while private
clouds allow hardware and software to be assigned dynamically. In both scenarios, the equipment
is dedicated to a single company that exercises control over the infrastructure. And, in bothscenarios, the costs to maintain the needed infrastructure rises with the increase in the amount ofdata collected.
B.

Capital One Partners With AWS For Cloud Computing
35.

As the costs of dedicated-servers or private-cloud solutions have increased, public

clouds hosted and run by third parties, such as Amazon’s AWS, Microsoft’s Azure, IBM’s Cloud,9

See William Sundblad, Data is the Foundation For Artificial Intelligence and Machine Learning,
FORBES(Oct.
18,2018),
availableathttps://www.forbes.com/sites/willemsundbladeurope/2018/10/18/data-is-the-foundation-forartificial-intelligence-and-machine-learning/#45c9c0551b49.
553501.1

14

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 16 of 92 PageID# 14856

and Google Cloud, have developed as a cheaper alternative. Those third parties own and maintainthe infrastructure, which is then leased on a scalable, dynamic basis to businesses. Because
resources can be scaled to meet demand, with server space expanding or contracting based on use,
a contracting business using a public cloud service may save money by only paying for thecomputing power and storage that it needs and not having to pay for the cost of excessive capacity
or maintaining the infrastructure required of dedicated servers or a private cloud.
36.

The primary downsides of public cloud computing are the increased data security

risk inherent in their use,10 and the related difficulty of meeting regulatory hurdles regarding thesecurity of sensitive information.11 Accordingly, banks proved to be reticent to use public cloudservices, as moving to the public cloud would require addressing access, encryption, and legal andcompliance issues.12
37.

Despite these inherent security risks, in 2015 Capital One announced that it would

move all of its data to the public cloud, and in 2016, Capital One announced that it would makeAWS its predominant public cloud provider.
38.

Amazon touted the AWS cloud environment as a technology-forward solution for

Capital One’s aggressive data collection strategy. Partnering with AWS allowed Capital One to use
Amazon’s data scientists and artificial intelligence tools13 to analyze the trove of customer data itcollected from credit applicants.

10

See, e.g., 12 Risks, Threats, & Vulnerabilities in Moving to the Cloud, CARNEGIE MELLONUNIVERSITY BLOG (March 5, 2018), available at https://insights.sei.cmu.edu/sei_blog/2018/03/12risks-threats-vulnerabilities-in-moving-to-the-cloud.html.
11
Federal Reserve Bank of Atlanta, Supervisory Considerations in Cloud Computing in the
Financial Services Industry (May 8, 2018), available at https://www.frbatlanta.org/economymatters/banking-and-finance/viewpoint/2018/05/supervisory-considerations-in-cloud-computingin-the-financial-services-industry.
12
See id.
13
AWS,
AWS
Marketplace,
Data
ScienceTools,
available
at553501.1

15

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 17 of 92 PageID# 14857

39.

The strategy was an aggressive move into uncharted territory for a major bank.

Migration to AWS’s cloud servers would mean that customer data would no longer be in the bank’s
physical custody; instead, it would be in the hands of a third-party partner, AWS.
40.

For this move to work, Capital One would have to convince its present andprospective customers that their information would be safe. With this in mind, both Capital One
and AWS charted a course to make deceptive, false, misleading and unfair representations regarding
the collection of customer data sitting on the public cloud.
41.

For example, in July 2015, Capital One Chief Executive Officer Rich Fairbanks,

noting that “increasingly we’re focusing on cloud computing,” assured customers that “[w]e’reinvesting in cyber security. This is an incredibly important area and we are putting a lot of very top
talent and a lot of energy and investment into that.”1442.

In October 2015, at an Amazon-sponsored industry event known as “AWS re:Invent

2015,” Capital One’s Chief Information Officer Rob Alexander used his keynote address toannounce that Capital One would be shifting its data to the cloud. In those remarks he stated:[S]ecurity is critical for us. The financial services industry attracts some of
the worst cyber criminals so we work closely with the Amazon team todevelop a security model which we believe enables us to operate moresecurely in the public cloud than we can even in our own data centers.15
43.

Despite these public statements suggesting a commitment to data security, including

data security in the cloud, Capital One instead undertook a risky move of consumer data to AWS,an environment with well-known data security vulnerabilities.
https://aws.amazon.com/marketplace/solutions/machine-learning/data-science-tools (last visited
March 2, 2020).
14
Sara Hoisington, Capital One: Banking Is Inherently A Digital Business (July 24, 2015),
available at https://conferencetrackerblog.wordpress.com/2015/07/24/capital-one-banking-isinherently-a-digital-business/.
15
Rob Alexander (CIO of Capital One), AWS re:Invent 2015 Keynote, available athttps://www.youtube.com/watch?v=0E90-ExySb8.
553501.1

16Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 18 of 92 PageID# 14858

C.

AWS Cloud Computing’s Default Settings Have Known Vulnerabilities
44.

The AWS cloud environment has long suffered from a widely known flaw. As

explained in detail below, AWS servers—unlike those run by its competitors—were not secured
against what are known as Server Side Request Forgery (“SSRF”) attacks. Simply stated, SSRF
attacks allow an intruder to penetrate a firewall and exfiltrate data to a third-party server. Year after
year this flaw was the subject of discussion at some of the largest cybersecurity conferences in the
United States. Each year, presentations were made expressly calling out the SSRF vulnerability in
AWS’s cloud computing services.16
45.

AWS’s servers facilitate machine learning by allowing large amounts of data to becollected in a common pool, which is segmented into folders. This AWS configuration allows fordifferent web applications to draw from a vast collection of data but also allows for theconfiguration of access “policies” to allow the application to only pull the data it needs, and nothing
more. One way to do this is through Identity and Access Management (“IAM”) roles.
46.

An IAM role is an identity created in an account that has specific permissions that

determines what the identity can or cannot do in AWS. Unlike a username or credential associatedwith a specific person, an IAM role is intended to be assumable by anyone who needs it. An entity
can use IAM roles to delegate access to users, applications, or services that do not normally haveaccess to the restricted AWS data, or resources, stored by the owner of the cloud.17 These IAM roles

16

Rob Wright, Capital One Hack Highlights SSRF Concerns for AWS, TECHTARGET (Aug. 5,2019), available at https://searchsecurity.techtarget.com/news/252467901/Capital-One-hackhighlights-SSRF-concerns-for-AWS; see also, Sen Ron Wyden and Sen. Elizabeth Warren, Letter
to
FTC
(Oct.
24,
2019),
availableathttps://www.wyden.senate.gov/imo/media/doc/102419%20Wyden%20Warren%20Letter%20to%20FTC%20RE%20Amazon%20Capital%20One%20Hack.pdf.
17
AWS, AWS Identity and Access Management User Guide, available athttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html (last visited March 2, 2020).
553501.1

17Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 19 of 92 PageID# 14859

are used on AWS to allow various computers access to particular resources on a dynamic basis. For
example, a computer on Capital One’s system with an IAM role configured to allow broad access,as required to run machine learning algorithms for example, could allow that computer to accessthe entire data collection while another computer with a more restrictive IAM role may restrict
access only to a small subset of consumer data.
47.

While the IAM roles work to regulate access to data within the AWS server, the only

defense protecting the data from outside penetration is a firewall. A firewall is, in effect, a shieldplaced between a server and traffic originating from the outside the server. It is designed to block
unauthorized access while permitting authorized access and outward communication.
48.

A firewall uses programmed rules to distinguish between legitimate access requests,

which it permits, and unauthorized and illegitimate access requests, which it denies. If a request islegitimate, then the firewall automatically assigns the requester a “role.” These roles establish what
portions of the server the requester will have access to as well as the conditions of that access. The
requester receives temporary credentials assigned to that role.
49.

A firewall also, among other purposes, ensures that sensitive resources on acomputer network are not exposed directly to the Internet. For web applications that need to passdata to and from a user on the open Internet—such as a credit card application—a Web Application
Firewall (“WAF”) is used. A WAF filters, monitors, and blocks web traffic to and from a web
application.
50.

But the firewalls used on the AWS cloud are known to be vulnerable to an SSRF

attack. In an SSRF attack, an attacker tricks a server—in this case the WAF—into thinking that theattacker is permitted to request and access data from the server. By tricking a server into thinking

553501.1

18

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 20 of 92 PageID# 14860

that it is receiving a legitimate request for resources from inside the firewall (rather than an
illegitimate request from outside), the attacker obtains a foothold inside the targeted network.
51.

However, despite this being a well-known problem deployed by hackers, AWS has

no protections built into its systems to protect against an SSRF attack. Instead, because Amazon
uses IAM roles to control access to sensitive resources, such as data stored on the cloud, an attacker
who gains access to a resource behind a firewall can then assume a privileged IAM role and cangain access to whatever data the role can access.
52.

This vulnerability to SSRF attacks is a well-known flaw in AWS-based systems. By

contrast, Amazon’s competitors, such as Google and Microsoft, have built protections against SSRF
into their cloud-based products.18
53.

According to Evan Johnson, manager of the product security team at Cloudflare,“SSRF has become the most serious vulnerability facing organizations that use public clouds . . . .
The impact of SSRF is being worsened by the offering of public clouds, and the major players like
AWS are not doing anything to fix it. The problem is common and well-known, but hard to preventand does not have any mitigations built into the AWS platform.”19
54.

In 2016, Capital One and AWS jointly announced that together they had developed

a new product it called Cloud Custodian. Defendants announced that with Cloud Custodian they
had solved the security problems inherent in using the AWS cloud for machine learning at scale,20

18

See Letter from Senators Elizabeth Warren and Ron Wyden to the Federal Trade Commission
(Oct.
24,
2019),
availableathttps://www.wyden.senate.gov/imo/media/doc/102419%20Wyden%20Warren%20Letter%20to%20FTC%20RE%20Amazon%20Capital%20One%20Hack.pdf; see also Is AWS Liable in
CapitalOne
Data
Breach,THREATPOST
(Oct.
25,
2019),
availableathttps://threatpost.com/capital-one-breach-senators-aws-investigation/149567/.
19
What We Can Learn from the Capital One Hack, KREBS ON SECURITY (Aug. 2, 2019), available
at https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/.
20
Henrik Johanson and Kapil Thangavlu, AWS Summit: Protecting Your Data In AWS, (Apr. 19,553501.1

19

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 21 of 92 PageID# 14861

and have billed Cloud Custodian as a comprehensive cloud security tool which would automaticallydetect and fix security flaws.21
55.

Defendants represented that Cloud Custodian would, among other things,

automatically scan Capital One’s internal systems to ensure that all of the servers and permissions
were set according to defined policies.22 Additionally, Defendants represented that Cloud Custodian
would grant the minimum amount of access necessary to complete a given task.23
56.

Moreover, Defendants boasted that Cloud Custodian would automatically encrypt

all data on the AWS servers.24 But encrypting the data stored on the AWS servers did not solve thesecurity vulnerability. Credentials assigned with IAM roles automatically decrypt the data the roleis allowed to access. Therefore, if an intruder is able to gain access to an IAM role and get past the
firewall, the IAM role will decrypt the data, allowing the unauthorized user access to unencrypted
data. In other words, one key unlocks both sets of doors—the firewall and the encryption.
57.

At Amazon’s yearly re:Invent conference in November 2018, Capital One’s SeniorDistinguished Engineer Kapil Thangavelu gave a presentation showcasing Cloud Custodian.25
Several minutes into his presentation, Thangavelu discussed IAM roles and described the precise

2016), available at https://www.slideshare.net/AmazonWebServices/protecting-your-data-in-aws61113337 (last visited March 2, 2020); see also, AWS, Announcing Cloud Custodian Integration
with
AWS
Security
Hub
(Nov.
29,
2018),
availableathttps://aws.amazon.com/blogs/opensource/announcing-cloud-custodian-integration-aws-securityhub/.
21
See Kapil Thangavelu, AWS re:Invent 2018: Cloud Custodian- Open Source AWS Security &Governance (DEM78), available at https://www.youtube.com/watch?v=oY8Nmh6B7P8.
22
Kapil Thangavelu, Cloud Custodian A Serverless Rules Engine For the Cloud (Nov. 2018),
available at https://www.youtube.com/watch?v=hm9Bx2MHyNw (last visited March 2, 2020).
23
Id.
24
Kim Nash, CIO Voices: Capital One’s Rob Alexander on How to Win in Banking, WALL STREETJOURNAL CIO JOURNAL (Nov. 30, 2016), available at https://blogs.wsj.com/cio/2016/11/30/ciovoices-capital-ones-rob-alexander-on-how-to-win-in-banking/.
25
Kapil Thangavelu, AWS re:Invent 2018: Cloud Custodian - Open Source AWS Security &Governance (DEM78), available at https://www.youtube.com/watch?v=oY8Nmh6B7P8553501.1

20

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 22 of 92 PageID# 14862

vulnerability in “S3”26—the AWS cloud service—that would result in the Data Breach the nextyear:
In the cloud, all these resources are just available via URL so those are partof your network boundary. And those resources that have embedded IAM
policies need special care and attention because they can be enabled to beaccessible outside of your account. I think everyone’s familiar with some of
the things around S3 but that extends out to a lot of the other resources I
called out a couple here.27
58.

With S3, IAM roles determine what buckets of data on the server the user is allowed

to access. Thus, if a company grants broad permissions to its IAM roles, then an unauthorized user
who gains access to an IAM role also gains broad access to all of the now-unencrypted data stored
in the cloud environment. With that presentation, Capital One’s Senior Distinguished Engineer28
acknowledged the known vulnerability in AWS’s system that persisted despite the implementationof Cloud Custodian in 2016. And that risk still existed in 2019.
59.

Capital One and Amazon appreciated and intentionally assumed a known risk that

despite any benefits of Cloud Custodian, a broadly configured IAM role, if assumed from inside
the firewall, would grant full access to the data stored on an AWS server. It was this known
vulnerability that allowed the theft of Capital One’s customer data in March 2019.
D.

The Known Vulnerability is Exploited60.

On July 29, 2019, Capital One announced in a filing with the Securities Exchange

Commission (“SEC”) that it had experienced a data breach affecting “approximately 100 million
individuals in the United States and approximately 6 million in Canada.”29

26

Amazon Simple Storage, known as S3.
AWS re:Invent 2018: Cloud Custodian¸ supra n. 27.
28
In January 2019, approximately one month after his presentation at re:Invent 2018, Thangavelu
left Capital One and joined Amazon AWS as a Principal OpenSource Technologist.
29
July 29 Form 8-K.
27

553501.1

21

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 23 of 92 PageID# 14863

61.

As detailed in the criminal complaint filed by the Federal Bureau of Investigation(“FBI”) against the alleged hacker, Paige A. Thompson (a/k/a “erratic”), Thompson publicly posted
instructions about how to access the stolen data on Github, a software development platform on
which users can share information or collaborate on open source code projects, in a file timestamped
April 21, 2019.30 Thompson had previously worked as a “systems engineer” for Defendant Amazon
Web Services.
62.

Capital One learned about the Data Breach from an anonymous tip sent by email on

July 17, 2019.31 The email advised that data belonging to Capital One had been posted on GitHub
and provided the address of the GitHub file containing the data.32

63.

According to Defendants, the intrusion occurred through a misconfigured Web

Application Firewall (WAF) that Capital One was using as part of its operations hosted in the cloudwith AWS.

30

See United States v. Paige A. Thompson, a/k/a “erratic,” Complaint at 10, Case No. 2:19-mj00344 (W.D. Wash.) (filed July 29, 2019) (hereinafter, “Thompson Criminal Complaint”),
available at https://www.justice.gov/usao-wdwa/press-release/file/1188626/download. On July29, 2019, Thompson was arrested by the FBI and charged by federal prosecutors in the UnitedStates District Court for the Western District of Washington. The charges included computer fraud
and abuse in violation of 18 U.S.C. § 1030(a)(2).
31
Id. at ¶ 9.
32
Id.
553501.1

22

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 24 of 92 PageID# 14864

64.

Capital One had worked closely with multiple groups at Amazon to set up the cloudsystems and to migrate the customer data to the cloud.33
65.

The firewall misconfiguration permitted commands that reached and were executedby a server. The commands executed by the hacker accomplished the following:a.

Obtained security credentials for an account known as WAF-Role thatallowed access to Capital One’s data folders on the AWS cloud;b.

Used the security credentials to list the names of the Capital One data
folders on the AWS cloud (“List Buckets Command”); and,c.

Used the security credentials to extract or copy data from the Capital One
data folders on the AWS cloud (“Sync Command”).34

66.

Capital One has confirmed that the commands function to obtain security credentials

on the AWS cloud environment and that these commands could be used to extract data.35
67.

Capital One has confirmed that the List Buckets Command was executed on April

21, 2019, which matches the timestamp of the Github file.36
68.

While AWS has blamed Capital One for the Data Breach, it has also admitted that

the SSRF vulnerability of its cloud environment played a role:
As Capital One outlined in their public announcement, the attack occurred
due to a misconfiguration error at the application layer of a firewall installed
by Capital One, exacerbated by permissions set by Capital One that werelikely broader than intended. After gaining access through the
misconfigured firewall and having broader permission to access resources,
we believe a SSRF attack was used (which is one of several ways an attacker

33

See, e.g., Stephen Orban, Capital One’s Cloud Journey Through the Stages of Adoption,
MEDIUM (April 5, 2017), available at https://medium.com/aws-enterprise-collection/capital-onescloud-journey-through-the-stages-of-adoption-bb0895d7772c.
34
Id. at ¶ 11.
35
Id. at ¶ 12.
36
Id.
553501.1

23

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 25 of 92 PageID# 14865

could have potentially gotten access to data once they got in through the
misconfigured firewall).37
69.

Online, the hacker publicly exposed the code and processes through which she had

discovered the vulnerability in the configuration of the AWS WAF used by Capital One, as well as
the code and processes she used to gain access to the stolen data through that misconfiguration.
70.

While the intrusion was sophisticated because of the abilities of the hacker and how

she performed the hack, the vulnerability of the AWS WAF used by the hacker to infiltrate was, as
described supra, well known.
71.

Shortly after the Data Breach, Capital One and AWS worked to fix the WAF

configuration to address the known vulnerability.
72.

Capital One subsequently determined that 1.75 terabytes of consumer data wasdownloaded on or about March 22-23, 2019, although the initial hacking began weeks before.
Capital One determined that the hacker first scanned its network on March 4, 2019 forvulnerabilities and first accessed its network on March 12, 2019, prior to her March 22-23 accessand download. Capital One believes the hacker probed their environment three additional times on
April 2, April 19, and May 26, 2019.38
73.

Capital One’s post-breach investigation revealed that the company’s logs showed anumber of connections or attempted connections to the AWS server from an Onion Router (alsoknown as “TOR”), an anonymity tool used by individuals to conceal their identities and their IP
address, and a number of connections from a specific IP address in March and April 2019.39 During
37

AWS Letter to The Honorable Ron Wyden, United States Senate, at 1 (August 13, 2019),
availableathttps://www.wyden.senate.gov/imo/media/doc/081319%20Amazon%20Letter%20to%20Sen%2
0Wyden%20RE%20Consumer%20Data.pdf.
38
Capital One Defendants’ Responses to Plaintiffs’ First Interrogatories, at Answer toInterrogatory 9.
39
Thompson Criminal Complaint at ¶ 13.
553501.1

24

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 26 of 92 PageID# 14866

these March and April 2019 connections, the WAF-Role account was used to execute the List
Buckets Command as well as the Sync Command to extract or copy data from Capital One’s data
folders on the AWS cloud environment.40 Capital One has confirmed that unauthorized activity
occurred on its AWS server on March 12, 22 and 23, 2019 and on April 21, 2019.41
74.

That Capital One’s own logs recorded multiple instances of unauthorized access andattempts of unauthorized access during March 2019, yet Capital One only learned of the Data
Breach four months later from an anonymous tip, suggests that Capital One did not have adequate
Security Incident and Event Management (“SIEM”) policies in place requiring IT-security events
to be logged in a centralized location and monitored in real time.
75.

Indeed, the length of time the Data Breach went unnoticed and undetected by

Defendants is astonishing, in light of both the public postings made by the alleged hacker Thompson
and the activity on the AWS server. Capital One, in its sworn interrogatory answers, admits that it
received alerts related to the breach on March 22, April 19, and May 20, 2019, which it purports tohave investigated. The May 20, 2019 alert came from Amazon who had received a handwritten note
warning Amazon and Capital One that “Open Socks Proxy **.***.**.136 Can Hit IMS – lots of
security credentials.” Capital One now believes that the hacker stole a valid Capital One AWS
Credential for its Instance Metadata Service (“IMS”) role – the role mentioned in the anonymousalert.42
76.

Capital One and Amazon also did not detect the Data Breach despite the fact thatthe hacker spent months posting publicly about the Data Breach online.

40

Id. at ¶¶ 11-13.
See July 29 Form 8-K; Thompson Criminal Complaint at ¶ 13.
42
Capital One Defendants’ Amended Responses to Plaintiffs’ First Interrogatories, at Answers toInterrogatories 8-9.
41553501.1

25

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 27 of 92 PageID# 14867

77.

On or about June 26, 2019, “erratic” publicly posted on a Slack channel a list of files

she claimed to possess, among which two referenced “WAF-Role.”43 The Sync Command placed
extracted files in a directory containing the name WAF-Role.
78.

On or about June 27, 2019, “erratic” posted about several companies, governmental

entities, and education entities, and referred to an account associated with Capital One.44
79.

On or about July 4, 2019, the alleged hacker Thompson posted a message seeking

information about the “Snappy Parquet File” which was a named file in the Capital One directoryon the AWS server and was determined to be one of the files exfiltrated from Capital One on March
22, 2019.45
80.

Cybersecurity investigative reporter Brian Krebs reported that Thompson posted

openly on her Twitter account over the course of several months about finding huge files of dataintended to be secured on various AWS cloud servers.46

43

Thompson Criminal Complaint at ¶ 18.
Id. at ¶ 19.
45
Id. at ¶ 22.
46
Capital One Data Theft Impacts 106M People, supra n.2.
44553501.1

26

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 28 of 92 PageID# 14868

81.

The length of time the Github file remained publicly posted without Defendants’knowledge suggests that neither Capital One nor Amazon employed threat intelligence to monitor
the dark web for activity involving its data, a standard practice in the financial industry.
82.

Because the hacker placed the script and code she used in public areas, the code andprocesses could have been used by others to gain access to CapitalOne’s customer data via the AWS
WAF vulnerability.
E.

The Scope of the Data Breach83.

The scope of the breach was staggering, with compromised data going back over a

decade to 2005.
84.

Capital One reported that the Data Breach impacted consumers who applied for

Capital One credit card products from 2005 through “early 2019,” and that the compromised
information included “personal information Capital One routinely collects at the time it receives
credit card applications, including names, addresses, zip codes/postal codes, phone numbers, email
addresses, dates of birth, and self-reported income.”47
85.

In addition, Capital One also admitted the Data Breach included consumers’ creditscores, credit limits, balances, payment histories, contact information, and “fragments of transaction
data from a total of 23 days during 2016, 2017 and 2018.”48
86.

Capital One further admitted that “about 140,000 Social Security numbers of [its]credit card customers” and “about 80,000 linked bank account numbers of our secured credit cardcustomers” were also disclosed in the Data Breach.49

47

July 29 Form 8-K.
Id.
49
Id.
48

553501.1

27

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 29 of 92 PageID# 14869

87.

Capital One’s retention of data far exceeds customers’ reasonable expectations of

how long their data would be stored and how their data would be used.
F.

Defendants’ Knowledge of Cyber Security Threats88.

At all relevant times, Defendants were well-aware, or reasonably should have beenaware, that the PII collected, maintained, and stored on the cloud is highly sensitive, susceptible toattack, and could be used for malicious purposes by third parties, such as identity theft, fraud andother misuse.
89.

Banking repositories and databases are popular and well-known targets forcyberattacks, especially given the extremely sensitive nature of the PII stored on those repositories
and databases. The frequency and prevalence of attacks make it imperative that banks such as
Capital One routinely and constantly monitor for exploits and cyberattacks and regularly update
their software and security procedures.
90.

Capital One was fully aware that it was a prime target of cyber threats. In its 2018

Form 10-K, Capital One discussed the threat of cyber-attacks at length, including acknowledging
that it is a target: “cyber and information security risks for large financial institutions like us havegenerally increased in recent years” and that “[w]e and other U.S. financial services providers
continue to be targeted with evolving and adaptive cybersecurity threats from sophisticated third
parties.”50
91.

With respect to cyber-security threats directed at the cloud, Capital One specifically

noted that it may “face an increasing number of attempted cyber-attacks as we expand . . . our usage

50

Capital One Financial Corporation, 2018 Form 10-K, at 24 (“2018 Form 10-K”), available athttps://www.sec.gov/Archives/edgar/data/927628/000092762819000093/cof1231201810kfinal.pdf.
553501.1

28

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 30 of 92 PageID# 14870

of mobile and cloud technologies and as we provide more of these services to a greater number ofretail clients.”51
92.

Capital One itself acknowledges that “[s]afeguarding our customers’ information isessential to our mission and our role as a financial institution.”52 To protect against these risks,
Capital One touted its “robust suite of authentication and layered information security controls,
including our cyber threat analytics, data encryption and tokenization technologies, anti-malware
defenses and vulnerability management program[.]”53 Yet Capital One’s supposedly robust systems
did not detect the repeated unauthorized access and access attempts of its system.
93.

Further, Capital One has experienced data breaches before. For example, in July

2017, Capital One disclosed to customers that a former employee had accessed customer
information over a three-month period. The customer information accessed in that data breach
included names, account numbers, telephone numbers, transaction history, dates of birth, and Social
Security Numbers.54
94.

In addition to its appreciation of threats imposed by external attacks, Capital One—and Amazon—were aware, or should have been aware, of security vulnerabilities posed by current
and former employees of both Capital One and Amazon, as well as the well-known security
vulnerabilities to the cloud, as described supra.
95.

Despite being the holder of PII for millions of individuals and businesses worldwide,

Capital One failed to prioritize data security by adopting reasonable data security measures toprevent and detect unauthorized access to their highly-sensitive databases. Capital One had the51

Id.
July 29 Form 8-K.
53
2018 Form 10-K, at 24.
54
July 2017 Capital One Data Breach Notice, available at https://dojmt.gov/wpcontent/uploads/Capital-One-1.pdf.
52553501.1

29

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 31 of 92 PageID# 14871

resources to prevent a breach and made significant expenditures to market their credit card andbanking services, but neglected to invest adequately in data security, despite the growing number
of well-publicized data breaches affecting the financial industry and similar industries.
G.

The Capital One Defendants Breached Their Promises to Plaintiffs
96.

Capital One’s Privacy and Opt-Out Notice promises its customers, a term defined toinclude applicants, current customers, and former customers of Capital One and its affiliates, that it
will protect the “personal information [the customers provide in order to obtain the services] fromunauthorized access and use [by employing] security measures that comply with federal law.”55
97.

Further, in its Privacy Statement, Capital One advises its customers:

At Capital One, we make your safety and security a top priority and are committed
to protecting your personal and financial information. If we collect identifying
information from you, we will protect that information with controls based uponinternationally recognized security standards, regulations, and industry-based bestpractices.56
98.

Capital One’s website also represents that “security is a top priority,” specifying thatit “prohibit[s] the unlawful disclosure of [applicant’s] Social Security number[s]” and that is uses
“some of the strongest forms of encryption commercially available for use on the Web today.”57
99.

Yet, despite these promises to protect its customers’ Personal Information, Capital

One failed to prioritize data security by adopting reasonable data security measures to prevent anddetect unauthorized access to Plaintiffs’ and class members data. Capital One had the resources toprevent a breach and made significant expenditures to market their credit card and banking services,

55

Capital One, Privacy and Opt-Out Notice, https://www.capitalone.com/privacy/notice/en-us/(last visited March 2, 2020).
56
Capital One, Capital One Online & Mobile Privacy Statement, available athttps://www.capitalone.com/bank/mobile-privacy-statement/disclosures/ (last visited March 2,2020).
57
CapitalOne,
Bank
Securely,https://www.capitalone.com/applications/identityprotection/commitment/ (last visited March 2, 2020).
553501.130

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 32 of 92 PageID# 14872

but neglected to adequately invest in data security, despite its promises to do so. As a result, an
unauthorized individual was able to exploit a well-known vulnerability and steal Capital One’s
customers’ unencrypted data.
H.

Defendants Failed to Comply with Regulatory Requirements and Industry Practices
100.

As Capital One acknowledges in its Privacy Statement, federal and state regulators

have established security standards and issued recommendations to temper data breaches and theresulting harm to consumers and financial institutions. There are a number of state and federal laws
and requirements and industry standards governing the protection of PII.
101.

For example, at least 24 states have enacted laws addressing data security practices

that require that businesses that own, license or maintain personal information, or PII, about aresident of that state to implement and maintain “reasonable security procedures and practices” andto protect PII from unauthorized access. California is one such state and requires that “[a] businessthat owns, licenses, or maintains personal information about a California resident shall implement
and maintain reasonable security procedures appropriate to the nature of the information, to protect
the personal information from unauthorized access, destruction, use modification or disclosure.”Cal. Civ. Code § 1798.81.5(b).
102.

The Federal Trade Commission (“FTC”), which is responsible for enforcing the

Safeguards Rule, has issued guidance and published regulatory decisions interpreting the measuresfinancial institutions must take to comply with the Safeguards Rule. The FTC recommends:

553501.1•

limiting access to customer information to employees who have a businessreason to see it;•

keeping customer information in encrypted files provides better protection
in case of theft;•

maintaining up-to-date and appropriate programs and controls to prevent
unauthorized access to customer information;
31

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 33 of 92 PageID# 14873

103.

•

using appropriate oversight or audit procedures to detect the improper
disclosure or theft of customer information;•

monitoring both in- and out-bound transfers of information for indicationsof a compromise, such as unexpectedly large amounts of data beingtransmitted from your system to an unknown user; and,•monitoring activity logs for signs of unauthorized access to customer
information.58

The Federal Trade Commission has also issued numerous guides for businesses

highlighting the importance of reasonable data security practices. According to the FTC, the needfor data security should be factored into all business decision-making.59
104.

In 2016, the FTC updated its publication, Protecting Personal Information: A Guide

for Business, which established guidelines for fundamental data security principles and practices
for business.60 The guidelines note businesses should protect the personal customer information thatthey keep; properly dispose of PII that is no longer needed; encrypt information stored on computer
networks; understand their network’s vulnerabilities; and implement policies to correct security
problems. The guidelines also recommend that businesses use an intrusion detection system toexpose a breach as soon as it occurs; monitor all incoming traffic for activity indicating someone is
attempting to hack the system; watch for large amounts of data being transmitted from the system;and have a response plan ready in the event of a breach.

58

Federal Trade Commission, Financial Institutions and Customer Information: Complying withtheSafeguards
Rule,availableathttps://www.ftc.gov/tips-advice/businesscenter/guidance/financial-institutions-customer-information-complying (last visited March 2,2020).
59
FederalTrade
Commission,
Start
With
Securityat2,
availableathttps://www.ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf(last visited March 2, 2020).
60
Federal Trade Commission, Protecting Personal Information: A Guide for Business, available
athttps://www.ftc.gov/system/files/documents/plain-language/pdf-0136_proteting-personalinformation.pdf (last visited March 2, 2020).
553501.1

32

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 34 of 92 PageID# 14874

105.

The FTC recommends that companies not maintain PII longer than is needed forauthorization of a transaction; limit access to sensitive data; require complex passwords to be usedon networks; use industry-tested methods for security; monitor for suspicious activity on the
network; and verify that third-party service providers have implemented reasonable security
measures.61
106.

The FTC has brought enforcement actions against businesses for failing toadequately and reasonably protect customer data, treating the failure to employ reasonable andappropriate measures to protect against unauthorized access to confidential consumer data as an
unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTC Act”),
15 U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses musttake to meet their data security obligations.
107.

The FTC has interpreted Section 5 of the FTC Act to encompass failures toappropriately store and maintain personal data. The body of law created by the FTC recognizes that
failure to restrict access to information62 and failure to segregate access to information63 may violate
the FTC Act.
108.

Defendants’ failure to employ reasonable and appropriate measures to protect

against unauthorized access to confidential consumer data (i.e., PII) constitutes an unfair act orpractice prohibited by Section 5 of the FTC Act, 15 U.S.C. § 45.

61

FTC, Start With Security, supra.
In the Matter of LabMD, Inc., Dkt. No. 9357, Slip Opinion, at 15 (“Procedures should be inplace that restrict users’ access to only that information for which they have a legitimate need.”),available at https://www.ftc.gov/system/files/documents/cases/160729labmd-opinion.pdf.
63
F.T.C. v. Wyndham Worldwide Corp., 799 F.3d 236, 258 (3d Cir. 2015) (companies should use“readily available security measures to limit access between” data storage systems).
62553501.1

33

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 35 of 92 PageID# 14875

109.

The PCI (Payment Card Industry) Security Standards Council, of which Capital One

is a participant, has published its Payment Card Industry (PCI) Data Security Standard:
Requirements and Security Assessment Procedures (“PCI-DSS”), the latest version of which (3.2.1)
is dated May 2018.64
110.

Capital One violated the mandates of PCI-DSS concerning data retention,

encryption, and access.
111.

In this case, Capital One was at all times fully aware of its obligation to protect thefinancial data—including PII—of Capital One’s applicants because of its status as a one of theUnited States’ largest financial institutions. Capital One was also aware of the significant
repercussions if it failed to do so because Capital One collected applicant data from millions ofconsumers daily and it knew that this data, if hacked, would result in injury to consumers, including
Plaintiffs and class members.
I.

Capital One is Subject to the Gramm-Leach-Bliley Act
112.

Capital One is a financial institution, as that term is defined by Section 509(3)(A) of

the Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. § 6809(3)(A), and thus is subject to the GLBA.
113.

The GLBA defines a financial institution as “any institution the business of whichis engaging in financial activities as described in Section 1843(k) of Title 12 [The Bank Holding
Company Act of 1956].” 15 U.S.C. § 6809(3)(A).
114.

Capital One collects nonpublic PII, as defined by 15 U.S.C. § 6809(4)(A), 16 C.F.R.

§ 313.3(n) and 12 C.F.R. § 1016.3(p)(1). Accordingly, during the relevant time period Capital One

64

Payment Card Industry Data Security Standard v3.2.1 (May 2018), available athttps://www.pcisecuritystandards.org/documents/PCI_DSS_v3-21.pdf?agreement=true&time=1580206053881.
553501.1

34

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 36 of 92 PageID# 14876

was subject to the requirements of the GLBA, 15 U.S.C. §§ 6801.1 et seq., and is subject tonumerous rules and regulations promulgated on the GLBA statutes.
115.

The GLBA Privacy Rule became effective on July 1, 2001. See 16 C.F.R. Part 313.

Since the enactment of the Dodd-Frank Act on July 21, 2010, the CFPB became responsible for
implementing the Privacy Rule. In December 2011, the CFPB restated the implementing
regulations in an interim final rule that established the Privacy of Consumer Financial Information,
Regulation P, 12 C.F.R. § 1016 (“Regulation P”), with the final version becoming effective on
October 28, 2014.
116.

Accordingly, Capital One’s conduct is governed by the Privacy Rule prior to

December 30, 2011, and by Regulation P after that date.
117.

Both the Privacy Rule and Regulation P require financial institutions to provide

customers with an initial and annual privacy notice. These privacy notices must be “clear andconspicuous.” 16 C.F.R. §§ 313.4 and 313.5; 12 C.F.R. §§ 1016.4 and 1016.5. “Clear andconspicuous means that a notice is reasonably understandable and designed to call attention to thenature and significance of the information in the notice.” 16 C.F.R. § 313.3(b)(1); 12 C.F.R. §1016.3(b)(1). These privacy notices must “accurately reflect[] [the financial institution’s] privacy
policies and practices.” 16 C.F.R. § 313.4 and 313.5; 12 C.F.R. §§ 1016.4 and 1016.5. They must
include specified elements, including the categories of nonpublic PII the financial institution
collects and discloses, the categories of third parties to whom the financial institution discloses theinformation, and the financial institution’s security and confidentiality policies and practices for
nonpublic PII. 16 C.F.R. § 313.6; 12 C.F.R. § 1016.6. These privacy notices must be provided “sothat each consumer can reasonably be expected to receive actual notice.” 16 C.F.R. § 313.9; 12
C.F.R. § 1016.9. As alleged herein, Capital One violated the Privacy Rule and Regulation P.

553501.1

35

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 37 of 92 PageID# 14877

118.

The Safeguards Rule, which implements Section 501(b) of the GLBA, 15 U.S.C. §6801(b), requires financial institutions to protect the security, confidentiality, and integrity ofcustomer information by developing a comprehensive written information security program that
contains reasonable administrative, technical, and physical safeguards, including: (1) designating
one or more employees to coordinate the information security program; (2) identifying reasonably
foreseeable internal and external risks to the security, confidentiality, and integrity of customer
information, and assessing the sufficiency of any safeguards in place to control those risks; (3)designing and implementing information safeguards to control the risks identified through risk
assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards’ key
controls, systems, and procedures; (4) overseeing service providers and requiring them by contract
to protect the security and confidentiality of customer information; and (5) evaluating and adjusting
the information security program in light of the results of testing and monitoring, changes to thebusiness operation, and other relevant circumstances. 16 C.F.R. §§ 314.3 and 314.4. As alleged
herein, Capital One violated the Safeguard Rule.
119.

Capital One failed to assess reasonably foreseeable internal and external risks to thesecurity, confidentiality, and integrity of customer information.
120.

Capital One’s conduct resulted in a variety of failures to follow GLB mandated rules

and regulations, many of which are also industry standard. Among such deficient practices, the Data
Breach demonstrates that Capital One failed to implement (or inadequately implemented)
information security policies or procedures such as effective employee training, adequate intrusion
detection systems, regular reviews of audit logs and records, and other similar measures to protect
the confidentiality of the PII it maintained in its data systems, instead outsourcing such
responsibilities to the Amazon Defendants.

553501.1

36

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 38 of 92 PageID# 14878

121.

More specifically, Capital One’s security failures demonstrate that it failed to honor

its express and implied promises by failing to:a.

Maintain an adequate data security system to reduce the risk of data
breaches and cyber attacks;b.

Adequately protect Plaintiff’s and class members’ PII;c.

Implement policies and procedures to prevent, detect, contain, and correct
security violations;d.

Implement procedures to regularly review records of information system
activity, such as audit logs, access reports, and security incident tracking
reports;e.

Protect against any reasonably anticipated threats or hazards to the security
or integrity of PII; andf.

Effectively train all members of its workforce on the policies and procedureswith respect to PII as necessary and appropriate for the members of its
workforce to carry out their functions and to maintain security of PII.

122.

Had Capital One implemented the above-described data security protocols, theconsequences of the data exposure could have been avoided, or at least significantly reduced as the
exposure could have been detected earlier, the amount of PII compromised could have been greatly
reduced, and affected consumers could have been notified—and taken protective/mitigating
actions—much sooner.
J.

Defendants’ Delays in Discovery and Notice of the Data Breach123.

It took Defendants approximately four months—from March to July 2019—torealize Capital One’s vast collection of customer PII stored on the AWS cloud had been breached.

553501.1

37

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 39 of 92 PageID# 14879

That discovery occurred not because of Defendants’ own diligence, but because an unknown third
party alerted Capital One.
124.

Further compounding the negative consequences of the Data Breach, Defendants

then failed to provide timely notice to affected class members. Remarkably, Capital One chose not
to directly notify the vast majority of individuals affected by the Data Breach; rather, it merely
published a press release, leaving victims in the dark as to whether their information had, in fact,
been compromised. Without detailed disclosures to Capital One’s customers, many class members
are even to this day unknowingly and unwittingly left exposed to continued misuse and ongoingrisk of misuse of their PII without being able to take necessary precautions to prevent imminent
harm.
125.

Defendants’ delays in discovering and announcing the breach left all Plaintiffs andclass members exposed and unable to take precautions.
K.

The Effect of the Data Breach on Impacted Customers
126.

Defendants’ failure to keep Plaintiffs’ and class members’ PII secure has severe

ramifications. Given the sensitive nature of the PII stolen in the Data Breach—names, addresses,
zip codes, phone numbers, email addresses, dates of birth, self-reported income, Social Security
Numbers, bank account numbers, credit scores, credit limits, credit balances, payment history, andfragments of transaction data—hackers have the ability to commit identity theft, financial fraud,and other identity-related fraud against Plaintiffs and class members now and into the indefinite
future.
127.

The PII exposed in the Data Breach is highly-coveted and valuable on undergroundor black markets. For example, a cyber “black market” exists in which criminals openly post andsell stolen consumer information on underground internet websites known as the “dark web”—

553501.1

38

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 40 of 92 PageID# 14880

exposing consumers to identity theft and fraud for years to come. Identity thieves can use the PII
to: (a) create fake credit cards that can be swiped and used to make purchases as if they were thereal credit cards; (b) reproduce stolen debit cards and use them to withdraw cash from ATMs; (c)commit immigration fraud; (d) obtain a fraudulent driver’s license or ID card in the victim’s name;(e) obtain fraudulent government benefits or medical treatment; (f) file a fraudulent tax return using
the victim’s information; (g) commit espionage; or (h) commit any number of other frauds, such as
obtaining a job, procuring housing, or giving false information to police during an arrest.
128.

This is especially true for data held by banks, given that the PII compromised in thisData Breach was precisely the PII Capital One used to extend credit to customers, meaning data
thieves had access to a single data set to commit fraud through, for example, opening new lines ofcredit.
129.

PII has significant monetary value in part because criminals continue their efforts toobtain this data.65 In other words, if any additional breach of sensitive data did not have incremental
value to criminals, one would expect to see a reduction in criminal efforts to obtain such additional
data over time. Instead, just the opposite has occurred. For example, the Identity Theft Resource
Center reported 1,473 data breaches in 2019, which represents a 17 percent increase from the total
number of breaches reported in 2018.66
130.

The PII of consumers remains of high value to identity criminals, as evidenced by

the prices criminals will pay through black-market sources on the dark web. Numerous sources cite

65

Data Breaches Rise as Cybercriminals Continue to Outwit IT, CIO MAGAZINE (Sept. 28, 2014),
availableat
http://www.cio.com/article/2686167/data-breach/data-breaches-rise-ascybercriminals-continue-to-outwit-it.html.
66
Identity Theft Center,2019 End-of-Year Data Breach Report (2019), available athttps://www.idtheftcenter.org/wp-content/uploads/2020/01/01.28.2020_ITRC_2019-End-ofYear-Data-Breach-Report_FINAL_Highres-Appendix.pdf.
553501.1

39

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 41 of 92 PageID# 14881

dark web pricing for stolen identity credentials, quantifying the loss to victims based on the valueof the data itself. For example, a complete set of bank account credentials can fetch a thousand
dollars or more.67
131.

Just as companies like Capital One and Amazon trade on the value of consumers’

PII, consumers recognize the value of their PII and offer it in exchange for goods and services.
Plaintiffs gave Capital One their PII in exchange for Capital One’s services, such as providing or
potentially providing credit. Further, the value of PII is key to unlocking many parts of the financial
sector for consumers. Whether someone can obtain a mortgage, credit card, business loan, tax
return, or even apply for a job depends on the integrity of their PII. Similarly, the businesses thatrequest (or require) consumers to share their PII as part of a commercial transaction do so with the
expectation that its integrity has not been compromised.
132.

Annual monetary losses for victims of identity theft are in the billions of dollars. In

2017, fraudsters stole $16.8 billion from consumers in the United States, which includes $5.1 billion
stolen through bank account take-overs.68
133.

The annual cost of identity theft is even higher. McAfee and the Center for Strategic

and International Studies estimates that the likely annual cost to the global economy fromcybercrime is $445 billion a year.69

67

Here’s How Much Thieves Make By Selling Your Personal Data Online, BUSINESS INSIDER(May 27, 2015), available at http://www.businessinsider.com/heres-how-much-your-personaldata-costs-on-the-dark-web-2015-5.
68
Javelin, 2018 Identity fraud: Fraud Enters A New Era of Complexity, available athttps://www.javelinstrategy.com/coverage-area/2018-identity-fraud-fraud-enters-new-eracomplexity (last visited March 2, 2020).
69
Insurance Information Institute, Facts + Statistics: Identity theft and cybercrime, available athttps://www.iii.org/fact-statistic/facts-statistics-identity-theft-and-cybercrime (last visited March
2, 2019).
553501.1

40

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 42 of 92 PageID# 14882

134.

For class members who had their Social Security Numbers exposed, theunauthorized disclosure can be particularly damaging because, unlike a credit card, Social Security
Numbers cannot easily be replaced. In order to obtain a new number, a person must prove, among
other things, he or she continues to be disadvantaged by the misuse. Thus, under current rules, no
new number can be obtained until the damage has been done. Furthermore, as the Social Security
Administration warns:
Keep in mind that a new number probably won’t solve all your problems. This isbecause other governmental agencies (such as the Internal Revenue Service andstate motor vehicle agencies) and private businesses (such as banks and credit
reporting companies) likely will have records under your old number. Along withother personal information, credit reporting companies use the number to identify
your credit record. So using a new number won’t guarantee you a fresh start. Thisis especially true if your other personal information, such as your name and address,
remains the same.
If you receive a new Social Security Number, you shouldn’t use the old number
anymore.
For some victims of identity theft, a new number actually creates new problems. If
the old credit card information is not associated with the new number, the absenceof any credit history under the new number may make it more difficult for you to
get credit.70
135.

Reimbursing a consumer for a financial loss due to fraud does not make that

individual whole again. On the contrary, in addition to the irreparable damage that may result fromthe theft of a Social Security Number, identity theft victims must spend numerous hours and theirown money repairing the impact to their credit. After conducting a study, the Department ofJustice’s Bureau of Justice Statistics (“BJS”) found that identity theft victims “reported spending70

Social Security Administration, Identity Theft and Your Social Security Number, available at
http://www.ssa.gov/pubs/10064.html (last visited March 2, 2020).
553501.1

41

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 43 of 92 PageID# 14883

an average of about 7 hours clearing up the issues” and resolving the consequences of fraud in2014.71
136.

And, the impact of identity theft can have ripple effects, which can adversely affectthe future financial trajectories of victims’ lives. For example, the Identity Theft Resource Center
reports that respondents to their surveys in 2013-2016 described that the identity theft theyexperienced affected their ability to get credit cards and obtain loans, such as student loans or
mortgages.72 For some victims, this could mean the difference between going to college or not,becoming a homeowner or not, or having to take out a high interest payday loan versus a lowerinterest loan.
137.

It is no wonder then that identity theft exacts a severe emotional toll on its victims.

The 2017 Identity Theft Resource Center survey73 evidences the emotional suffering experienced
by victims of identity theft:•

75% of respondents reported feeling severely distressed•

67% reported anxiety•

66% reported feelings of fear related to personal financial safety•

37% reported fearing for the financial safety of family members•

24% reported fear for their physical safety•

15.2% reported a relationship ended or was severely and negatively
impacted by the identity theft•

7% reported feeling suicidal.

71

U.S. Department of Justice, Victims of Identity Theft, 2014 (Revised November 13, 2017),
available at http://www.bjs.gov/content/pub/pdf/vit14.pdf (last visited March 2, 2020).
72
Identity Theft Resource Center, Identity Theft: The Aftermath 2017, available athttps://www.idtheftcenter.org/images/page-docs/Aftermath_2017.pdf (last visited March 2,2020).
73
Id.
553501.1

42Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 44 of 92 PageID# 14884

138.

Identity theft can also exact a physical toll on its victims. The same survey reported

that respondents experienced physical symptoms stemming from their experience with identity
theft:

139.

•

48.3% of respondents reported sleep disturbances•

37.1% reported an inability to concentrate / lack of focus•

28.7% reported they were unable to go to work because of physicalsymptoms•

23.1% reported new physical illnesses (aches and pains, heart palpitations,sweating, stomach issues)•

12.6% reported a start or relapse into unhealthy or addictive behaviors.74

There may also be a significant time lag between when PII is stolen and when it isactually misused. According to the U.S. Government Accountability Office (“GAO”), which
conducted a study regarding data breaches:[L]aw enforcement officials told us that in some cases, stolen data may be held for up to ayear or more before being used to commit identity theft. Further, once stolen data havebeen sold or posted on the Web, fraudulent use of that information may continue for years.
As a result, studies that attempt to measure the harm resulting from data breaches cannot
necessarily rule out all future harm.75
140.

As the result of the Data Breach, Plaintiff and class members have suffered and/or

will suffer or continue to suffer economic loss and other actual harm for which they are entitled todamages, including, but not limited to, the following:•purchasing services they would not have otherwise paid for and/or paying
more for services than they otherwise would have paid, had they known thetruth about Defendants’ substandard data security practices;•

losing the inherent value of their PII;74

Id.
U.S. Government Accountability Office, Report to Congressional Requesters (June 2007),
http://www.gao.gov/new.items/d07737.pdf (last visited March 2, 2020).
75553501.1

43Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 45 of 92 PageID# 14885

141.

•

losing the value of Capital One’s explicit and implicit promises of adequate
data security;•

identity theft and fraud resulting from the theft of their PII;•

costs associated with the detection and prevention of identity theft andunauthorized use of their financial accounts;•

costs associated with purchasing credit monitoring and identity theftprotection services;•

unauthorized charges and loss of use of and access to their financial accountfunds and costs associated with inability to obtain money from theiraccounts or being limited in the amount of money they were permitted toobtain from their accounts, including missed payments on bills and loans,late charges and fees, and adverse effects on their credit;•

lowered credit scores resulting from credit inquiries following fraudulent
activities;•

costs associated with time spent and the loss of productivity or theenjoyment of one’s life from taking time to address and attempt to mitigate
and address the actual and future consequences of the Data Breach,
including discovering fraudulent charges, cancelling and reissuing cards,
purchasing credit monitoring and identity theft protection services,
imposing withdrawal and purchase limits on compromised accounts, andthe stress, nuisance and annoyance of dealing with the repercussions of theData Breach; and•the continued imminent and certainly impending injury flowing frompotential fraud and identify theft posed by their PII being in the possessionof one or many unauthorized third parties.

Additionally, Plaintiff and class members place significant value in data security.

According to a recent survey conducted by cyber-security company FireEye, approximately 50%
of consumers consider data security to be a main or important consideration when making
purchasing decisions and nearly the same percentage would be willing to pay more in order to workwith a provider that has better data security. Likewise, 70% of consumers would provide lesspersonal information to organizations that suffered a data breach.76

76

FireEye, Beyond the Bottom Line: The Real Cost of Data Breaches (May 11, 2016),

553501.1

44

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 46 of 92 PageID# 14886

142.

Because of the value consumers place on data privacy and security, companies withrobust data security practices can command higher prices than those who do not. Indeed, if
consumers did not value their data security and privacy, companies like Capital One would have noreason to tout their data security efforts to their actual and potential customers.
143.

Consequently, had consumers known the truth about Defendants’ data security

practices—that Defendants would not adequately protect and store their data—they would not haveentrusted their PII to Capital One, applied for a Capital One credit card or remained a Capital One
customer, and would not have been willing to pay as much for Capital One’s services. As such,Plaintiffs and class members did not receive the benefit of their bargain with Capital One because
they paid for a value of services they expected but did not receive.
CLASS ACTION ALLEGATIONS
144.

Pursuant to Fed. R. Civ. P. 23(b)(2) and (b)(3), as applicable, and (c)(4), Plaintiffs

seek certification of the following nationwide class (the “Class” or the “Nationwide Class”):
All persons in the United States whose PII was compromised in the Data Breach.
145.

The Nationwide Class asserts claims against all Defendants for negligence (Count1), negligence per se (Count 2), unjust enrichment (Count 3), and declaratory judgment (Count 4),
and against the Capital One Defendants only for breach of confidence (Count 5), breach of contract(Count 6), and breach of implied contract (Count 7).
146.

Pursuant to Fed. R. Civ. P. 23(b)(2) and (b)(3), as applicable, and (c)(4), Plaintiffs

seek certification of state-by-state claims in the alternative to the nationwide claims, as well as
statutory claims under state data breach statutes and consumer protection statutes (Counts 8 throughhttps://www.fireeye.com/blog/executive-perspective/2016/05/beyond_the_bottomli.html
visited March 2, 2020).
553501.1

45

(last

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 47 of 92 PageID# 14887

15), on behalf of separate statewide subclasses for the States of California, Florida, New York,
Texas, Virginia, and Washington (the “State Subclasses”), defined as follows:
All persons in [name of state] whose PII was compromised in the Data Breach.
147.

Excluded from the Nationwide Class and each State Subclass are Defendants, any

entity in which any Defendant has a controlling interest, and Defendants’ officers, directors, legal
representatives, successors, subsidiaries, and assigns. Also excluded from the Nationwide Class andeach State Subclass are any judicial officer presiding over this matter, members of their immediatefamily, and members of their judicial staff.
148.

Plaintiffs hereby reserve the right to amend or modify the class definitions withgreater specificity or division after having had an opportunity to conduct discovery.
149.

Each of the proposed classes meets the criteria for certification under Rule 23(a),(b)(2), (b)(3) and (c)(4).
150.

Numerosity. Fed. R. Civ. P. 23(a)(1). Consistent with Rule 23(a)(1), the membersof the Nationwide Class and each State Subclass are so numerous and geographically dispersed thatthe joinder of all members is impractical. While the exact number of class members is unknown to
Plaintiffs at this time, Capital One has acknowledged that the PII of approximately 100 million
persons throughout the United States was compromised in the Data Breach. Those persons’ names
and addresses are available from Capital One’s records and in data maintained by Amazon, andclass members may be notified of the pendency of this action by recognized, Court-approved noticedissemination methods, which may include electronic mail, U.S. Mail, internet notice, and/or
published notice.
151.

Predominance of Common Issues. Fed. R. Civ. P. 23(a)(2) and (b)(3).

Consistent with Rule 23(a)(2) and with 23(b)(3)’s predominance requirement, this action involves

553501.1

46

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 48 of 92 PageID# 14888

common questions of law and fact that predominate over any questions affecting individual classmembers. The common questions include:a.

Whether Defendants knew or should have known that their computer anddata storage systems were vulnerable to attack, including but not limited to,that their web application firewall was vulnerable to attack by an SSRF;

b.

Whether Defendants omitted or misrepresented material facts regarding thesecurity of their computer and data storage systems and their inability toprotect the vast amounts of consumer data, including Plaintiffs’ and classmembers’ PII, hosted by the Amazon Defendants for the Capital One
Defendants;c.

Whether Defendants failed to take adequate and reasonable measures toensure such computer and data systems were protected;d.

Whether Defendants failed to take available steps to prevent and stop the
Breach from happening;e.

Whether Defendants owed tort duties to Plaintiffs and class members toprotect their PII;f.

Whether Defendants owed a duty to provide timely and accurate notice of
the Data Breach to Plaintiffs and class members;g.

Whether Defendants breached their duties to protect the PII of Plaintiffs andclass members by failing to provide adequate data security;h.

Whether Defendants’ failure to secure Plaintiffs’ and class members PII in
the manner alleged violated federal, state and local laws, or industry
standards;

553501.1

47

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 49 of 92 PageID# 14889

i.

Whether Defendants’ conduct, including their failure to act, resulted in or
was the proximate cause of the Data Breach, resulting in the unauthorizedaccess to and/or theft of Plaintiffs’ and class members’ PII;j.

Whether Capital One has a contractual obligation to use reasonable security
measures and whether it complied with such contractual obligation;k.

Whether Defendants’ conduct amounted to violations of state consumer
protection statutes, and/or state data breach statutes;l.

Whether, as a result of Defendants’ conduct, Plaintiffs and class members
face a significant threat of harm and/or have already suffered harm, and, if
so, the appropriate measure of damages to which they are entitled;m.

Whether the Capital One Defendants should retain the money paid by
Plaintiffs and class members to protect their PII;n.

Whether Defendants should retain Plaintiffs’ and class members’ valuable
PII;

o.

Whether, as a result of Defendants’ conduct, Plaintiffs and class members
are entitled to injunctive, equitable, declaratory and/or other relief, and, if so,
the nature of such relief.

152.

Typicality. Fed. R. Civ. P. 23(a)(3). As to the Nationwide Class and each State

Subclass, Plaintiffs’ claims are typical of other class members’ claims because Plaintiffs and classmembers were subjected to the same allegedly unlawful conduct and damaged in the same way.
153.

Adequacy. Fed. R. Civ. P. 23(a)(4). Consistent with Rule 23(a)(4), Plaintiffs areadequate representatives of the Classes because Plaintiffs are members of the Classes and arecommitted to pursuing this matter against Defendants to obtain relief for the Classes. Plaintiffs have553501.1

48

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 50 of 92 PageID# 14890

no conflicts of interest with the Classes. Plaintiffs’ Lead Counsel are competent and experienced inlitigating class actions, including extensive experience in data breach and privacy litigation.
Plaintiffs intend to vigorously prosecute this case and will fairly and adequately protect the interestsof all of the Classes.
154.

Superiority. Fed. R. Civ. P. 23(b)(3). Consistent with Rule 23(b)(3), a class action

is superior to any other available means for the fair and efficient adjudication of this controversy,
and no unusual difficulties are likely to be encountered in the management of this class action. The
purpose of the class action mechanism is to permit litigation against wrongdoers even whendamages to individual plaintiffs and class members may not be sufficient to justify individual
litigation. Here, the damages suffered by Plaintiffs and the class mmbers are relatively small
compared to the burden and expense required to individually litigate their claims against
Defendants, and thus, individual litigation to redress Defendants’ wrongful conduct would be
impracticable. Individual litigation by each class member would also strain the court system.
Individual litigation creates the potential for inconsistent or contradictory judgments, and increases
the delay and expense to all parties and the court system. By contrast, the class action device
presents far fewer management difficulties and provides the benefits of a single adjudication,
economies of scale, and comprehensive supervision by a single court.
155.

Injunctive and Declaratory Relief. Class certification is also appropriate under

Rule 23(b)(2) and (c). Each Defendant, through its uniform conduct, acted or refused to act on
grounds generally applicable to the Classes as a whole, making injunctive and declaratory relief
appropriate to the Classes as a whole.

553501.1

49

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 51 of 92 PageID# 14891

156.

Likewise, particular issues under Rule 23(c)(4) are appropriate for certification

because such claims present only particular, common issues, the resolution of which would advancethe disposition of this matter and the parties’ interests therein.
157.

Finally, all members of the proposed Classes are readily ascertainable. Capital One

has access to information, and Amazon hosts information, regarding which individuals wereaffected by the Data Breach. Using this information, the members of the Classes can be identified
and their contact information ascertained for purposes of providing notice to the Classes.
CLAIMS ON BEHALF OF THE NATIONWIDE CLASSCOUNT 1NEGLIGENCE
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
158.

Plaintiffs repeat and allege Paragraphs 1–157, as if fully alleged herein.

159.

The Capital One Defendants required Plaintiffs and class members to submit

sensitive personal information, including their PII, in order to obtain credit card and banking
services. The Capital One Defendants and the Amazon Defendants stored this vast treasure troveof PII on the Amazon Defendants’ cloud computing platforms.
160.

By collecting, storing, using, and profiting from this data, the Capital One

Defendants and the Amazon Defendants each had a duty of care to Plaintiffs and class members to
exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting
this PII in Defendants’ possession from being compromised, lost, stolen, accessed, and misused byunauthorized persons. More specifically, this duty included, among other things: (a) designing,
maintaining, and testing Defendants’ security systems and data storage architecture to ensure that
Plaintiffs’ and class members’ PII was adequately secured and protected; (b) implementing

553501.1

50Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 52 of 92 PageID# 14892

processes that would detect an unauthorized breach of Defendants’ security systems and data
storage architecture in a timely manner; (c) timely acting upon all warnings and alerts, including
public information, regarding Defendants’ security vulnerabilities and potential compromise of thecompiled data of Plaintiffs and millions of class members; and (d) maintaining data security
measures consistent with industry standards.
161.

The Capital One Defendants and the Amazon Defendants had common law duties

to prevent foreseeable harm to Plaintiffs and class members. These duties existed because Plaintiffs
and class members were the foreseeable and probable victims of any inadequate security practices.
In fact, not only was it foreseeable that Plaintiffs and class members would be harmed by the failure
to protect their PII because hackers routinely attempt to steal such information and use it fornefarious purposes, Defendants knew that it was more likely than not Plaintiffs and other classmembers would be harmed by such theft.
162.

Defendants had a duty to monitor, supervise, control, or otherwise provide oversightto safeguard the PII that was collected and stored on the Amazon Defendants’ cloud computing
platforms.
163.

Defendants’ duties to use reasonable security measures also arose as a result of thespecial relationship that existed between Defendants, on the one hand, and Plaintiffs and classmembers, on the other hand. The special relationship arose because Plaintiffs and class members
entrusted Defendants with their PII as part of the applications for, opening, or use of credit cards orbanking services with the Capital One Defendants. Defendants alone could have ensured that theirsecurity systems and data storage architecture were sufficient to prevent or minimize the Data
Breach.

553501.1

51

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 53 of 92 PageID# 14893

164.

Defendants’ duties to use reasonable data security measures also arose under Section

5 of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45, which prohibits “unfair . . .
practices in or affecting commerce,” including, as interpreted and enforced by the FTC, the unfair
practice of failing to use reasonable measures to protect PII. Various FTC publications and data
security breach orders further form the basis of Defendants’ duties. In addition, individual states
have enacted statutes based upon the FTC Act that also created a duty.
165.

Capital One’s duty to use reasonable security measures also arose under the GLBA,

under which Capital One was required to protect the security, confidentiality, and integrity ofcustomer information by developing a comprehensive written information security program that
contains reasonable administrative, technical, and physical safeguards.
166.

Defendants knew or should have known that the Amazon Defendants’ cloudcomputing systems and data storage architecture were vulnerable to unauthorized access andtargeting by hackers for the purpose of stealing and misusing confidential PII.
167.

Defendants breached the duties they owed to Plaintiffs and class members describedabove and thus were negligent. Defendants breached these duties by, among other things, failingto: (a) exercise reasonable care and implement adequate security systems, protocols and practices
sufficient to protect the PII of Plaintiffs and class members; (b) detect the breach while it was
ongoing or even promptly after it occurred; and (c) maintain security systems consistent withindustry standards.
168.

But for Defendants’ wrongful and negligent breach of their duties owed to Plaintiffs

and class members, their PII would not have been compromised.
169.

As a direct and proximate result of the Capital One Defendants’ negligence and the

Amazon Defendants’ negligence, Plaintiffs and class members have been injured and are entitled553501.1

52

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 54 of 92 PageID# 14894

to damages in an amount to be proven at trial. Such injuries include one or more of the following:
ongoing, imminent, certainly impending threat of identity theft crimes, fraud, and other misuse,
resulting in monetary loss and economic harm; actual identity theft crimes, fraud, and other misuse,
resulting in monetary loss and economic harm; loss of the value of their privacy and theconfidentiality of the stolen PII; illegal sale of the compromised PII on the black market; mitigation
expenses and time spent on credit monitoring, identity theft insurance, and credit freezes andunfreezes; time spent in response to the Data Breach reviewing bank statements, credit card
statements, and credit reports; expenses and time spent initiating fraud alerts; decreased creditscores and ratings; lost work time; lost value of the PII; lost benefit of their bargains and overcharges
for services; and other economic and non-economic harm.
COUNT 2NEGLIGENCE PER SE
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
170.

Plaintiffs repeat and allege Paragraphs 1–157, as if fully alleged herein.

171.

Section 5 of the FTC Act, 15 U.S.C. § 45, prohibits “unfair . . . practices in oraffecting commerce” including, as interpreted and enforced by the FTC, the unfair act or practiceby Defendants of failing to use reasonable measures to protect PII. Various FTC publications andorders also form the basis of Defendants’ duty.
172.

Defendants violated Section 5 of the FTC Act (and similar state statutes) by failingto use reasonable measures to protect PII and not complying with industry standards. Defendants’conduct was particularly unreasonable given the nature and amount of PII obtained and stored andthe foreseeable consequences of a data breach on Defendants’ systems.

553501.1

53

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 55 of 92 PageID# 14895

173.

Capital One’s duty to use reasonable security measures also arose under the GLBA,

under which Capital One was required to protect the security, confidentiality, and integrity ofcustomer information by developing a comprehensive written information security program that
contains reasonable administrative, technical, and physical safeguards.
174.

Defendants’ violation of Section 5 of the FTC Act (and similar state statutes)

constitutes negligence per se.
175.

Capital One’s violation of the GLBA and its Safeguards Rule constitutes negligence

176.

Class members are consumers within the class of persons Section 5 of the FTC Act

per se.

(and similar state statutes), and the GLBA, were intended to protect.
177.

Moreover, the harm that has occurred is the type of harm the FTC Act (and similarstate statutes) was intended to guard against. Indeed, the FTC has pursued over fifty enforcement
actions against businesses which, as a result of their failure to employ reasonable data security
measures and avoid unfair and deceptive practices, caused the same harm suffered by Plaintiffs andclass members. The GLBA, with its Safeguards Rule, was similarly intended.
178.

As a direct and proximate result of the Capital One Defendants’ negligence and the

Amazon Defendants’ negligence, Plaintiffs and class members have been injured and are entitledto damages in an amount to be proven at trial. Such injuries include one or more of the following:
ongoing, imminent, certainly impending threat of identity theft crimes, fraud, and other misuse,
resulting in monetary loss and economic harm; actual identity theft crimes, fraud, and other misuse,
resulting in monetary loss and economic harm; loss of the value of their privacy and theconfidentiality of the stolen PII; illegal sale of the compromised PII on the black market; mitigation
expenses and time spent on credit monitoring, identity theft insurance, and credit freezes and553501.1

54

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 56 of 92 PageID# 14896

unfreezes; time spent in response to the Data Breach reviewing bank statements, credit card
statements, and credit reports; expenses and time spent initiating fraud alerts; decreased creditscores and ratings; lost work time; lost value of the PII; lost benefit of their bargains and overcharges
for services; and other economic and non-economic harm.
COUNT 3
UNJUST ENRICHMENT
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
179.

Plaintiffs repeat and allege Paragraphs 1–157, as if fully alleged herein.

180.

Plaintiffs and class members have an interest, both equitable and legal, in the PII

about them that was conferred upon, collected by, and maintained by Defendants and that was
ultimately stolen in the Data Breach.
181.

Defendants were benefitted by the conferral upon them of the PII pertaining to

Plaintiffs and class members and by their ability to retain, use, and profit from that information.
Defendants understood that they were in fact so benefitted.
182.

Defendants also understood and appreciated that the PII pertaining to Plaintiffs andclass members was private and confidential and its value depended upon Defendants maintaining
the privacy and confidentiality of that PII.
183.

But for Defendants’ willingness and commitment to maintain its privacy andconfidentiality, that PII would not have been transferred to and entrusted with Defendants.
184.

Defendants continue to benefit and profit from their retention and use of the PII

while its value to Plaintiffs and class members has been diminished.
185.

Capital One also benefitted through its unjust conduct by selling credit card andbanking services for more than those services were worth to Plaintiffs and class members, who553501.1

55

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 57 of 92 PageID# 14897

would not have applied for or used Capital One credit cards at all, or at the terms offered by Capital
One, had they been aware that Capital One would fail to protect their PII.
186.

Capital One also benefitted through its unjust conduct by retaining money that itshould have used to provide reasonable and adequate data security to protect Plaintiffs’ and classmembers’ PII.
187.

It is inequitable for Defendants to retain these benefits.

188.

As a result of Defendants’ wrongful conduct as alleged in this Complaint (including,among things, their knowing failure to employ adequate data security measures, their continued
maintenance and use of the PII belonging to Plaintiffs and class members without having adequate
data security measures, and their other conduct facilitating the theft of that PII), Defendants havebeen unjustly enriched at the expense of, and to the detriment of, Plaintiffs and class members.
189.

Defendants’ unjust enrichment is traceable to, and resulted directly and proximately

from, the conduct alleged herein, including the compiling and use of Plaintiffs’ and class members’
PII, while at the same time failing to maintain that information secure from intrusion and theft byhackers and identity thieves.
190.

Under the common law doctrine of unjust enrichment, it is inequitable for

Defendants to be permitted to retain the benefits they received, and are still receiving, without
justification, from Plaintiffs and class members in an unfair and unconscionable manner.
Defendants’ retention of such benefits under circumstances making it inequitable to do soconstitutes unjust enrichment.
191.

The benefits conferred upon, received, and enjoyed by Defendants were notconferred officiously or gratuitously, and it would be inequitable and unjust for Defendants to retain
these benefits.

553501.1

56

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 58 of 92 PageID# 14898

192.

Plaintiffs have no adequate remedy at law.

193.

Defendants are therefore liable to Plaintiffs and class members for restitution or

disgorgement in the amount of the benefit conferred on Defendants as a result of their wrongfulconduct, including specifically: the value to Defendants of the PII that was stolen in the Data
Breach; the profits Defendants are receiving from the use of that information; the amounts that
Capital One overcharged Plaintiffs and class members for use of their credit card and banking
services; and the amounts that Capital One should have spent to provide reasonable and adequate
data security to protect Plaintiffs’ and class members’ PII.
COUNT 4
DECLARATORY JUDGMENT
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
194.

Plaintiffs repeat and allege Paragraphs 1–157, as if fully alleged herein.

195.

Under the Declaratory Judgment Act, 28 U.S.C. §§ 2201, et seq., the Court isauthorized to enter a judgment declaring the rights and legal relations of the parties and grant further
necessary relief. Furthermore, the Court has broad authority to restrain acts, such as here, that are
tortious and violate the terms of the federal and state statutes described in this Complaint.
196.

An actual controversy has arisen in the wake of the Data Breach regarding its present

and prospective common law and other duties to reasonably safeguard its customers’ PII andwhether Defendants are currently maintaining data security measures adequate to protect Plaintiffs
and class members from further data breaches that compromise their PII. Plaintiffs remain at
imminent risk that further compromises of their PII will occur in the future.
197.

Pursuant to its authority under the Declaratory Judgment Act, this Court should entera judgment declaring, among other things, the following:

553501.1

57

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 59 of 92 PageID# 14899

a.

Defendants continue to owe a legal duty to secure consumers’ PII and totimely notify consumers of a data breach under the common law, Section 5of the FTC Act, the GLBA, and various state statutes;b.

Defendants continue to breach this legal duty by failing to employ
reasonable measures to secure consumers’ PII.

198.

The Court also should issue corresponding prospective injunctive relief requiring

Defendants to employ adequate security practices consistent with law and industry standards toprotect consumers’ PII.
199.

If an injunction is not issued, Plaintiffs and class members will suffer irreparable

injury, and lack an adequate legal remedy, in the event of another data breach at Capital One or
Amazon. The risk of another such breach is real, immediate, and substantial. If another breachoccurs, Plaintiffs and class members will not have an adequate remedy at law because many of theresulting injuries are not readily quantified and they will be forced to bring multiple lawsuits torectify the same conduct.
200.

The hardship to Plaintiffs and class members if an injunction does not issue exceeds

the hardship to Defendants if an injunction is issued. Among other things, if another massive data
breach occurs at Capital One or Amazon, Plaintiffs and class members will likely be subjected to
fraud, identify theft, and other harms described herein. On the other hand, the cost to Defendants ofcomplying with an injunction by employing reasonable prospective data security measures isrelatively minimal, and Defendants have a pre-existing legal obligation to employ such measures.
201.

Issuance of the requested injunction will not disserve the public interest. To thecontrary, such an injunction would benefit the public by preventing another data breach at Capital

553501.1

58

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 60 of 92 PageID# 14900

One or Amazon, thus eliminating the additional injuries that would result to Plaintiffs and themillions of consumers whose PII would be further compromised
COUNT 5
BREACH OF CONFIDENCE
Against the Capital One Defendants, On Behalf of Plaintiffs and the Nationwide Class, or
Alternatively, on Behalf of Plaintiffs and the State Subclasses
202.

Plaintiffs restate and realleges paragraphs 1–157, as if fully set forth herein.

203.

At all times during Plaintiffs’ and class members’ interactions with Capital One,

Capital One was fully aware of the confidential and sensitive nature of Plaintiffs’ and classmembers’ PII.
204.

As alleged herein and above, Capital One’s relationship with Plaintiffs and classmembers was governed by terms and expectations that Plaintiffs’ and class members’ protected PII
would be collected, stored, and protected in confidence, and would not be disclosed to the public
or any unauthorized third parties.
205.

Plaintiffs and class members provided their respective PII to Capital One with theexplicit and implicit understandings that Capital One would protect and not permit the PII to bedisseminated to the public or any unauthorized parties.
206.

Plaintiffs and class members also provided their respective PII to Capital One withthe explicit and implicit understandings that Capital One would take precautions to protect the PII
from unauthorized disclosure, such as following basic principles of encryption and information
security practices.
207.

Capital One voluntarily received in confidence Plaintiffs’ and class members’ PII

with the understanding that PII would not be disclosed or disseminated to the public or any
unauthorized third parties.

553501.1

59

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 61 of 92 PageID# 14901

208.

Due to Capital One’s failure to prevent, detect, avoid the Data Breach fromoccurring by following best information security practices to secure Plaintiffs’ and class members’
PII, Plaintiffs’ and class members’ PII was disclosed and misappropriated to the public andunauthorized third parties beyond Plaintiffs’ and class members’ confidence, and without theirexpress permission.
209.

But for Capital One’s disclosure of Plaintiffs’ and class members’ PII in violationof the parties’ understanding of confidence, their PII would not have been compromised, stolen,
viewed, accessed, and used by unauthorized third parties. Capital One’s Data Breach was the direct
and legal cause of the theft of Plaintiffs’ and class members’ PII, as well as the resulting damages.
210.

The injury and harm Plaintiffs and class members suffered was the reasonably

foreseeable result of Capital One’s unauthorized disclosure of Plaintiffs’ and class members’ PII.
Capital One knew its computer systems and technologies for accepting, securing, and storing
Plaintiffs’ and class members’ PII had serious security vulnerabilities because Capital One failed
to observe even basic information security practices or correct known security vulnerabilities.
211.

As a direct and proximate result of Capital One’s breaches of confidence, Plaintiffs

and class members have been injured and are entitled to damages in an amount to be proven at trial.
Such injuries include one or more of the following: ongoing, imminent, certainly impending threatof identity theft crimes, fraud, and other misuse, resulting in monetary loss and economic harm;
actual identity theft crimes, fraud, and other misuse, resulting in monetary loss and economic harm;loss of the value of their privacy and the confidentiality of the stolen PII; illegal sale of thecompromised PII on the black market; mitigation expenses and time spent on credit monitoring,
identity theft insurance, and credit freezes and unfreezes; time spent in response to the Data Breachreviewing bank statements, credit card statements, and credit reports; expenses and time spent

553501.1

60

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 62 of 92 PageID# 14902

initiating fraud alerts; decreased credit scores and ratings; lost work time; lost value of the PII; lost
benefit of their bargains and overcharges for services; and other economic and non-economic harm.
COUNT 6
BREACH OF CONTRACT
Against the Capital One Defendants, On Behalf of Plaintiffs and the Nationwide Class, or
Alternatively, on Behalf of Plaintiffs and the State Subclasses
212.

Plaintiffs repeat and allege Paragraphs 1–157, as if fully alleged herein.

213.

Capital One’s Privacy and Opt-Out Notice (the “Notice”) is an agreement between

Capital One and persons who provided their PII to Capital One, including Plaintiffs and classmembers.
214.

Capital One’s Notice states that it applies to customers, applicants, and former

customers of Capital One, and it details how Capital One will both protect and use the PII provided
by customers and applicants of Capital One’s services.
215.

The Notice provides detailed information about what types of PII will be shared andwith what entities. It further promises that to “protect your personal information from unauthorizedaccess and use, we use security measures that comply with federal law.”
216.

Plaintiffs and class members on the one hand and Capital One on the other formed

a contract when Plaintiffs and class members provided PII to Capital One subject to the Notice.
217.

Plaintiffs and class members fully performed their obligations under the contract

with Capital One.
218.

Capital One breached its agreement with Plaintiffs and class members by failing toprotect their PII. Specifically, Capital One (1) failed to use reasonable measures to protect that
information; and (2) disclosed that information to unauthorized third parties, in violation of theagreement.

553501.1

61

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 63 of 92 PageID# 14903

219.

As a direct and proximate result of these breaches of contract, Plaintiffs and classmembers sustained actual losses and damages as described in detail above, including but not limited
to that they did not get the benefit of the bargain for which they paid and were overcharged by
Capital One for its services.
COUNT 7
BREACH OF IMPLIED CONTRACT
Against the Capital One Defendants, On Behalf of Plaintiffs and the Nationwide Class, or
Alternatively, on Behalf of Plaintiffs and the State Subclasses
220.

Plaintiffs repeat and allege Paragraphs 1–157, as if fully alleged herein, and assert

this claim in the alternative to their breach of contract claim to the extent necessary.
221.

Plaintiffs and class members also entered into an implied contract with Capital One

when they obtained services from Capital One, or otherwise provided PII to Capital One.
222.

As part of these transactions, Capital One agreed to safeguard and protect the PII of

Plaintiffs and class members.
223.

Plaintiffs and class members entered into implied contracts with the reasonable

expectation that Capital One’s data security practices and policies were reasonable and consistent
with industry standards. Plaintiffs and class members believed that Capital One would use part ofthe monies paid to Capital One under the implied contracts to fund adequate and reasonable data
security practices.
224.

Plaintiffs and class members would not have provided and entrusted their PII to

Capital One or would have paid less for Capital One’s services in the absence of the implied contract
or implied terms between them and Capital One. The safeguarding of the PII of Plaintiffs and classmembers was critical to realize the intent of the parties.

553501.1

62

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 64 of 92 PageID# 14904

225.

Plaintiffs and class members fully performed their obligations under the implied

contracts with Capital One.
226.

Capital One breached its implied contracts with Plaintiffs and class members toprotect their PII when it (1) failed to have security protocols and measures in place to protect that
information; and (2) disclosed that information to unauthorized third parties.
227.

As a direct and proximate result of Capital One’s breach of implied contract,

Plaintiffs and class members sustained actual losses and damages as described in detail above,
including that they did not get the benefit of the bargain for which they paid and were overcharged
by Capital One for its services.
CLAIMS ON BEHALF OF THE CALIFORNIA SUBCLASSCOUNT 8CALIFORNIA UNFAIR COMPETITION LAW,
Cal. Bus. & Prof. Code §§ 17200, et seq.
Against All Defendants
228.

The California Plaintiffs identified above (“Plaintiffs,” for purposes of this Count),

individually and on behalf of the California Subclass, repeat and allege Paragraphs 1–157, as if
fully alleged herein.
229.

Defendants are “person[s]” as defined by Cal. Bus. & Prof. Code §17201.

230.

Defendants violated Cal. Bus. & Prof. Code §§ 17200, et seq. (“UCL”) by engaging

in unlawful, unfair, and deceptive business acts and practices.
231.

Defendants’ “unfair” acts and practices include:a.

Defendants failed to implement and maintain reasonable security measures
to protect Plaintiffs’ and California Subclass members’ PII fromunauthorized disclosure, release, data breaches, and theft, which was a553501.1

63Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 65 of 92 PageID# 14905

direct and proximate cause of the Data Breach. Defendants failed to identify
foreseeable security risks, remediate identified security risks, andadequately improve security despite knowing the risk of cybersecurity
incidents. This conduct, with little if any utility, is unfair when weighedagainst the harm to Plaintiffs and the California Subclass, whose PII has
been compromised.
b.

Defendants’ failure to implement and maintain reasonable security
measures also was contrary to legislatively-declared public policy that seeks
to protect consumers’ data and ensure that entities that are trusted with it
use appropriate security measures. These policies are reflected in laws,
including the FTC Act, 15 U.S.C. § 45, and California’s Consumer Records
Act, Cal. Civ. Code § 1798.81.5.

c.

Defendants’ failure to implement and maintain reasonable security
measures also led to substantial consumer injuries, as described above, thatare not outweighed by any countervailing benefits to consumers orcompetition. Moreover, because consumers could not know of Defendants’
inadequate security, consumers could not have reasonably avoided theharms that Defendants caused.

d.

Engaging in unlawful business practices by violating Cal. Civ. Code §1798.82 and Cal. Fin. Code §§ 4050 et seq.

232.

Defendants have engaged in “unlawful” business practices by violating multiple

laws, including California’s Customer Records Act, Cal. Civ. Code §§ 1798.81.5 (requiring
reasonable data security measures) and 1798.82 (requiring timely breach notification), California’s

553501.1

64Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 66 of 92 PageID# 14906

Financial Information Privacy Act, Cal. Fin. Code §§ 4050, et seq., California’s Consumers Legal
Remedies Act, Cal. Civ. Code §§ 1780, et seq., the FTC Act, 15 U.S.C. § 45, the GLBA, andCalifornia common law.
233.

Defendants’ unlawful, unfair, and deceptive acts and practices include:a.

Failing to implement and maintain reasonable security and privacy
measures to protect Plaintiffs’ and California Subclass members’ PII, which
was a direct and proximate cause of the Data Breach;b.

Failing to identify foreseeable security and privacy risks, remediate
identified security and privacy risks, and adequately improve security andprivacy measures despite knowing the risk of cybersecurity incidents, which
was a direct and proximate cause of the Data Breach;c.

Failing to comply with common law and statutory duties pertaining to thesecurity and privacy of Plaintiffs’ and California Subclass members’ PII,
including duties imposed by the FTC Act, 15 U.S.C. § 45, the GLBA,
California’s Financial Information Privacy Act, Cal. Fin. Code §§ 4050, etseq., and California’s Customer Records Act, Cal. Civ. Code §§ 1798.80, etseq., which was a direct and proximate cause of the Data Breach;d.

Misrepresenting that they would protect the privacy and confidentiality of
Plaintiffs’ and California Subclass members’ PII, including byimplementing and maintaining reasonable security measures;e.

Misrepresenting that they would comply with common law and statutory
duties pertaining to the security and privacy of Plaintiffs’ and California
Subclass members’ PII, including duties imposed by the FTC Act, the553501.1

65

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 67 of 92 PageID# 14907

GLBA, 15 U.S.C. § 45, California’s Financial Information Privacy Act, Cal.
Fin. Code §§ 4050, et seq., and California’s Customer Records Act, Cal.
Civ. Code §§ 1798.80, et seq.;f.

Omitting, suppressing, and concealing the material fact that it did notreasonably or adequately secure Plaintiffs’ and California Subclassmembers’ PII; andg.

Omitting, suppressing, and concealing the material fact that they did notcomply with common law and statutory duties pertaining to the security andprivacy of Plaintiffs’ and California Subclass members’ PII, including
duties imposed by the FTC Act, 15 U.S.C. § 45, the GLBA, California’s
Financial Information Privacy Act, Cal. Fin. Code §§ 4050, et seq., andCalifornia’s Customer Records Act, Cal. Civ. Code §§ 1798.80, et seq.

234.

Defendants’ representations and omissions were material because they were likely

to deceive reasonable consumers about the adequacy of Defendants’ data security and ability toprotect the confidentiality of consumers’ PII.
235.

As a direct and proximate result of Defendants’ unfair, unlawful, and fraudulent acts

and practices, Plaintiffs and California Subclass members were injured and lost money or property:
the money received by the Capital One for its services; the loss of the benefit of their bargain withand overcharges by Capital One as they would not have paid the Capital One for services or would
have paid less for such services but for the violations alleged herein; losses from fraud and identity
theft; costs for credit monitoring and identity protection services; time and expenses related tomonitoring their financial accounts for fraudulent activity; loss of value of their PII; and anincreased, imminent risk of fraud and identity theft.

553501.1

66

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 68 of 92 PageID# 14908

236.

Defendants acted intentionally, knowingly, and maliciously to violate California’s

Unfair Competition Law, and recklessly disregarded Plaintiffs’ and California Subclass members’
rights. Defendants are of such a sophisticated and large nature that other data breaches and public
information regarding security vulnerabilities put them on notice that their security and privacy
protections were inadequate.
237.

Plaintiffs and California Subclass members seek all monetary and non-monetary

relief allowed by law, including restitution of all profits stemming from Defendants’ unfair,unlawful, and fraudulent business practices or use of their PII; declaratory relief; reasonable
attorneys’ fees and costs under California Code of Civil Procedure § 1021.5; injunctive relief; andother appropriate equitable relief.
COUNT 9CALIFORNIA CONSUMER LEGAL REMEDIES ACT,Cal. Civ. Code §§ 1750, et seq.
Against All Defendants
238.

The California Plaintiffs identified above (“Plaintiffs” for purposes of this Count),

individually and on behalf of the California Subclass, repeat and allege Paragraphs 1–157, as if
fully alleged herein.
239.

The Consumers Legal Remedies Act, Cal. Civ. Code §§ 1750, et seq. (“CLRA”) is

a comprehensive statutory scheme that is to be liberally construed to protect consumers against
unfair and deceptive business practices in connection with the conduct of businesses providing
goods, property or services to consumers primarily for personal, family, or household use.
240.

Defendants are “person[s]” as defined by Civil Code §§ 1761(c) and 1770, and haveprovided “services” as defined by Civil Code §§ 1761(b) and 1770.

553501.1

67

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 69 of 92 PageID# 14909

241.

Civil Code section 1770, subdivision (a)(5) prohibits one who is involved in atransaction from “[r]epresenting that goods or services have sponsorship, approval, characteristics,
ingredients, uses, benefits, or quantities which they do not have.”
242.

Civil Code section 1770, subdivision (a)(7) prohibits one who is involved in atransaction from “[r]epresenting that goods or services are of a particular standard, quality, or grade. . . if they are of another.”
243.

Plaintiffs and the California Subclass members are “consumer[s]” as defined by

Civil Code §§ 1761(d) and 1770, and have engaged in a “transaction” as defined by Civil Code §§1761(e) and 1770.
244.

Defendants’ acts and practices were intended to and did result in the sales of services

to Plaintiffs and the California Subclass members in violation of Civil Code § 1770, including, but
not limited to, the following:a.

Representing that goods or services have characteristics that they do not
have;

b.

Representing that goods or services are of a particular standard, quality, or
grade when they were not;c.

Advertising goods or services with intent not to sell them as advertised; andd.

Representing that the subject of a transaction has been supplied inaccordance with a previous representation when it has not.

245.

Defendants’ representations and omissions were material because they were likely

to and did deceive reasonable consumers about the adequacy of Defendants’ data security andability to protect the confidentiality of consumers’ PII.

553501.1

68Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 70 of 92 PageID# 14910

246.

Had the Defendants disclosed to Plaintiffs and class members that their computerand data storage systems were not secure and, thus, vulnerable to attack, Defendants would havebeen unable to continue in business and would have been forced to adopt reasonable data security
measures and comply with the law. Instead, the Defendants received, maintained, and compiled
Plaintiffs’ and class members’ PII as part of the services Defendants provided and for which
Plaintiffs and class members paid without advising Plaintiffs and class members that Defendants’
data security practices were insufficient to maintain the safety and confidentiality of Plaintiffs’ andclass members’ PII. Accordingly, Plaintiffs and the California Subclass members acted reasonably
in relying on the Defendants’ misrepresentations and omissions, the truth of which they could nothave discovered.
247.

As a direct and proximate result of the Defendants’ violations of California Civil

Code § 1770, Plaintiffs and California Subclass members have suffered and will continue to suffer
injury, ascertainable losses of money or property, and monetary and non-monetary damages,
including loss of the benefit of their bargain with and overcharges by Capital One, as they would
not have paid Capital One for services or would have paid less for such services but for theviolations alleged herein; losses from fraud and identity theft; costs for credit monitoring andidentity protection services; time and expenses related to monitoring their financial accounts forfraudulent activity; loss of value of their PII; and an increased, imminent risk of fraud and identity
theft.
248.

Plaintiffs and the California Subclass have provided notice of their claims fordamages to Defendants, in compliance with California Civil Code § 1782(a).

553501.1

69

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 71 of 92 PageID# 14911

249.

Plaintiffs and the California Subclass seek all monetary and non-monetary relief

allowed by law, including damages, an order enjoining the acts and practices described above,
attorneys’ fees, and costs under the CLRA.
CLAIMS ON BEHALF OF THE FLORIDA SUBCLASSCOUNT 10FLORIDA DECEPTIVE AND UNFAIR TRADE PRACTICES ACT,Fla. Stat. §§ 501.201, et seq.
Against All Defendants
250.

The Florida Plaintiffs identified above (“Plaintiffs,” for purposes of this Count),

individually and on behalf of the Florida Subclass, repeat and allege Paragraphs 1–157, as if fully
alleged herein.
251.

Plaintiffs and Florida Subclass members are “consumer[s]” as defined by Fla. Stat.

§ 501.203.
252.

The Defendants advertised, offered, or sold goods or services in Florida and engaged

in trade or commerce directly or indirectly affecting the people of Florida.
253.

The Defendants engaged in unconscionable, unfair, and deceptive acts and practices

in the conduct of trade and commerce, in violation of Fla. Stat. § 501.204(1), including:a.

Failing to implement and maintain reasonable security and privacy
measures to protect Plaintiffs’ and Florida Subclass members’ PII, which
was a direct and proximate cause of the Data Breach;b.

Failing to identify foreseeable security and privacy risks, remediate
identified security and privacy risks, and adequately improve security andprivacy measures despite knowing the risk of cybersecurity incidents, which
was a direct and proximate cause of the Data Breach;553501.1

70Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 72 of 92 PageID# 14912

c.

Failing to comply with common law and statutory duties pertaining to thesecurity and privacy of Plaintiffs’ and Florida Subclass members’ PII,
including duties imposed by the FTC Act, 15 U.S.C. § 45, and Florida’s
data security statute, F.S.A. § 501.171(2), which was a direct and proximate
cause of the Data Breach;d.

Misrepresenting that they would protect the privacy and confidentiality of
Plaintiffs’ and Florida Subclass members’ PII, including by implementing
and maintaining reasonable security measures;e.

Misrepresenting that they would comply with common law and statutory
duties pertaining to the security and privacy of Plaintiffs’ and Florida
Subclass members’ PII, including duties imposed by the FTC Act, 15
U.S.C. § 45, and Florida’s data security statute, F.S.A. § 501.171(2);f.

Omitting, suppressing, and concealing the material fact that they did notreasonably or adequately secure Plaintiffs’ and Florida Subclass members’
PII; andg.

Omitting, suppressing, and concealing the material fact that they did notcomply with common law and statutory duties pertaining to the security andprivacy of Plaintiffs’ and Florida Subclass members’ PII, including duties
imposed by the FTC Act, 15 U.S.C. § 45, and Florida’s data security statute,
F.S.A. § 501.171(2).

254.

The Defendants’ representations and omissions were material because they werelikely to deceive reasonable consumers about the adequacy of the Defendants’ data security andability to protect the confidentiality of consumers’ PII.

553501.1

71Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 73 of 92 PageID# 14913

255.

Had Defendants disclosed to Plaintiffs and class members that their data systems

were not secure and, thus, vulnerable to attack, the Defendants would have been unable to continue
in business and would have been forced to adopt reasonable data security measures and comply
with the law. Instead, the Defendants received, maintained, and compiled Plaintiffs’ and classmembers’ PII as part of the services the Defendants provided and for which Plaintiffs and classmembers paid without advising Plaintiffs and class members that the Defendants’ data security
practices were insufficient to maintain the safety and confidentiality of Plaintiffs’ and classmembers’ PII. Accordingly, Plaintiffs and the Florida Subclass members acted reasonably inrelying on the Defendants’ misrepresentations and omissions, the truth of which they could not havediscovered.
256.

As a direct and proximate result of the Defendants’ unconscionable, unfair, anddeceptive acts and practices, Plaintiffs and Florida Subclass members have suffered and willcontinue to suffer injury, ascertainable losses of money or property, and monetary and nonmonetary damages, including loss of the benefit of their bargain with and overcharges by Capital
One, as they would not have paid Capital One for services or would have paid less for such services
but for the violations alleged herein; losses from fraud and identity theft; costs for credit monitoringand identity protection services; time and expenses related to monitoring their financial accounts
for fraudulent activity; loss of value of their PII; and an increased, imminent risk of fraud andidentity theft.
257.

Plaintiffs and Florida Subclass members seek all monetary and non-monetary relief

allowed by law, including actual or nominal damages under Fla. Stat. § 501.211; declaratory andinjunctive relief; reasonable attorneys’ fees and costs, under Fla. Stat. § 501.2105(1); and any otherrelief that is just and proper.

553501.1

72

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 74 of 92 PageID# 14914

CLAIMS ON BEHALF OF THE NEW YORK SUBCLASSCOUNT 11
NEW YORK GENERAL BUSINESS LAW,
N.Y. Gen. Bus. Law §§ 349, et seq.
Against All Defendants
258.

The New York Plaintiff identified above (“Plaintiffs” for purposes of this Count),

individually and on behalf of the New York Subclass, repeat and allege Paragraphs 1–157, as if
fully alleged herein.
259.

The Defendants engaged in deceptive acts or practices in the conduct of theirbusiness, trade, and commerce or furnishing of services in New York, in violation of N.Y. Gen.
Bus. Law § 349, including:a.

Failing to implement and maintain reasonable security and privacy
measures to protect Plaintiffs’ and New York Subclass members’ PII, which
was a direct and proximate cause of the Data Breach;b.

Failing to identify foreseeable security and privacy risks, remediate
identified security and privacy risks, and adequately improve security andprivacy measures despite knowing the risk of cybersecurity incidents, which
was a direct and proximate cause of the Data Breach;c.

Failing to comply with common law and statutory duties pertaining to thesecurity and privacy of Plaintiffs’ and New York Subclass members’ PII,
including duties imposed by the FTC Act, 15 U.S.C. § 45, which was a
direct and proximate cause of the Data Breach;553501.1

73

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 75 of 92 PageID# 14915d.

Misrepresenting that they would protect the privacy and confidentiality of
Plaintiffs’ and New York Subclass members’ PII, including byimplementing and maintaining reasonable security measures;e.

Misrepresenting that they would comply with common law and statutory
duties pertaining to the security and privacy of Plaintiffs’ and New York
Subclass members’ PII, including duties imposed by the FTC Act, 15
U.S.C. § 45;f.

Omitting, suppressing, and concealing the material fact that they did notreasonably or adequately secure Plaintiffs’ and New York Subclassmembers’ PII; andg.

Omitting, suppressing, and concealing the material fact that they did notcomply with common law and statutory duties pertaining to the security andprivacy of Plaintiffs’ and Subclass members’ PII, including duties imposedby the FTC Act, 15 U.S.C. § 45.

260.

The Defendants’ representations and omissions were material because they werelikely to deceive reasonable consumers about the adequacy of the Defendants’ data security andability to protect the confidentiality of consumers’ PII.
261.

The Defendants acted intentionally, knowingly, and maliciously to violate New

York’s General Business Law, and recklessly disregarded Plaintiffs’ and New York Subclassmembers’ rights. Defendants are of such a sophisticated and large nature that other data breaches
and public information regarding security vulnerabilities put them on notice that their security andprivacy protections were inadequate.

553501.1

74

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 76 of 92 PageID# 14916

262.

As a direct and proximate result of the Defendants’ deceptive and unlawful acts andpractices, Plaintiffs and New York Subclass members have suffered and will continue to suffer
injury, ascertainable losses of money or property, and monetary and non-monetary damages,
including loss of the benefit of their bargain with and overcharges by Capital One, as they would
not have paid Capital One for services or would have paid less for such services but for theviolations alleged herein; losses from fraud and identity theft; costs for credit monitoring andidentity protection services; time and expenses related to monitoring their financial accounts forfraudulent activity; loss of value of their PII; and an increased, imminent risk of fraud and identity
theft.
263.

The Defendants’ deceptive and unlawful acts and practices complained of hereinaffected the public interest and consumers at large, including the millions of New Yorkers affectedby the Data Breach.
264.

The above deceptive and unlawful practices and acts by the Defendants caused

substantial injury to Plaintiffs and New York Subclass members that they could not reasonably
avoid.
265.

Plaintiffs and New York Subclass members seek all monetary and non-monetary

relief allowed by law, including actual damages or statutory damages of $50 (whichever is greater),treble damages, restitution, injunctive relief, and attorney’s fees and costs.
CLAIMS ON BEHALF OF THE TEXAS SUBCLASSCOUNT 12
DECEPTIVE TRADE PRACTICES—CONSUMER PROTECTION ACT,
Texas Bus. & Com. Code §§ 17.41, et seq.
Against All Defendants

553501.1

75

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 77 of 92 PageID# 14917

266.

The Texas Plaintiff identified above (“Plaintiffs” for purposes of this Count),

individually and on behalf of the Texas Subclass, repeats and alleges Paragraphs 1–157, as if fully
alleged herein.
267.

Defendants are “person[s]” as defined by Tex. Bus. & Com. Code § 17.45(3).

268.

Plaintiffs and the Texas Subclass members are “consumer[s]” as defined by Tex.

Bus. & Com. Code § 17.45(4).
269.

Defendants advertised, offered, or sold services in Texas and engaged in trade orcommerce directly or indirectly affecting the people of Texas, as defined by Tex. Bus. & Com.
Code § 17.45(6).
270.

Defendants engaged in false, misleading, or deceptive acts and practices, in violationof Tex. Bus. & Com. Code § 17.46(b), including:a.

Representing that goods or services have sponsorship, approval,
characteristics, ingredients, uses, benefits or quantities that they do not
have;

b.

Representing that goods or services are of a particular standard, quality or
grade, if they are of another;

c.
271.

Advertising goods or services with intent not to sell them as advertised.

The Defendants’ false, misleading, and deceptive acts and practices include:a.

Failing to implement and maintain reasonable security and privacy
measures to protect Plaintiffs’ and Texas Subclass members’ PII, which wasa direct and proximate cause of the Data Breach;b.

Failing to identify foreseeable security and privacy risks, remediate
identified security and privacy risks, and adequately improve security and553501.1

76

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 78 of 92 PageID# 14918

privacy measures despite knowing the risk of cybersecurity incidents, which
was a direct and proximate cause of the Data Breach;c.

Failing to comply with common law and statutory duties pertaining to thesecurity and privacy of Plaintiffs’ and Texas Subclass members’ PII,
including duties imposed by the FTC Act, 15 U.S.C. § 45, which was a
direct and proximate cause of the Data Breach;d.

Misrepresenting that they would protect the privacy and confidentiality of
Plaintiffs’ and Texas Subclass members’ PII, including by implementing
and maintaining reasonable security measures;e.

Misrepresenting that they would comply with common law and statutory
duties pertaining to the security and privacy of Plaintiffs’ and Texas
Subclass members’ PII, including duties imposed by the FTC Act, 15
U.S.C. § 45;f.

Omitting, suppressing, and concealing the material fact that it did notreasonably or adequately secure Plaintiffs’ and Texas Subclass members’
PII; andg.

Omitting, suppressing, and concealing the material fact that they did notcomply with common law and statutory duties pertaining to the security andprivacy of Plaintiffs’ and Texas Subclass members’ PII, including duties
imposed by the FTC Act, 15 U.S.C. § 45.

272.

Defendants intended to mislead Plaintiffs and Texas Subclass members and inducethem to rely on their misrepresentations and omissions.

553501.1

77

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 79 of 92 PageID# 14919

273.

The Defendants’ representations and omissions were material because they werelikely to deceive reasonable consumers about the adequacy of the Defendants’ data security andability to protect the confidentiality of consumers’ PII.
274.

Had Defendants disclosed to Plaintiffs and class members that their data systems

were not secure and, thus, vulnerable to attack, the Defendants would have been unable to continue
in business and would have been forced to adopt reasonable data security measures and comply
with the law. Instead, the Defendants received, maintained, and compiled Plaintiffs’ and classmembers’ PII as part of the services the Defendants provided and for which Plaintiffs and classmembers paid without advising Plaintiffs and class members that the Defendants’ data security
practices were insufficient to maintain the safety and confidentiality of Plaintiffs’ and classmembers’ PII. Accordingly, Plaintiffs and the Texas Subclass members acted reasonably in relying
on the Defendants’ misrepresentations and omissions, the truth of which they could not havediscovered.
275.

The Defendants had a duty to disclose the above facts due to the circumstances ofthis case and the sensitivity and extensivity of the PII in their possession. This duty arose because
Plaintiffs and the Texas Subclass members reposed a trust and confidence in the Defendants when
they provided their PII to the Defendants in exchange for the Defendants’ services. In addition, sucha duty is implied by law due to the nature of the relationship between consumers, including Plaintiffs
and the Texas Subclass, and the Defendants because consumers are unable to fully protect theirinterests with regard to their data, and placed trust and confidence in the Defendants. The
Defendants’ duty to disclose also arose from their:

553501.1a.

Possession of exclusive knowledge regarding the security of the PII;b.

Active concealment of the state of their security; and/or

78

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 80 of 92 PageID# 14920

c.

Incomplete representations about the security and integrity of their
computer and data storage systems, while purposefully withholding
material facts from Plaintiffs and the Texas Subclass that contradicted these
representations and omissions.

276.

The Defendants engaged in unconscionable actions or courses of conduct, in

violation of Tex. Bus. & Com. Code Ann. § 17.50(a)(3). The Defendants engaged in acts orpractices which, to consumers’ detriment, took advantage of consumers’ lack of knowledge, ability,
experience, or capacity to a grossly unfair degree.
277.

Consumers, including Plaintiffs and Texas Subclass members, lacked knowledge

about deficiencies in the Defendants’ data security because this information was known exclusively
by the Defendants. Consumers also lacked the ability, experience, or capacity to secure the PII in
the Defendants’ possession or to fully protect their interests with regard to their data. Plaintiffs andTexas Subclass members lack expertise in information security matters and do not have access to
the Defendants’ systems in order to evaluate their security controls. The Defendants took advantageof their special skill and access to the PII to hide their inability to protect the security andconfidentiality of Plaintiffs and Texas Subclass members’ PII.
278.

The Defendants intended to take advantage of consumers’ lack of knowledge,

ability, experience, or capacity to a grossly unfair degree, with reckless disregard of the unfairness
that would result. The unfairness resulting from the Defendants’ conduct is glaringly noticeable,
flagrant, complete, and unmitigated. The Data Breach, which resulted from the Defendants’unconscionable business acts and practices, exposed Plaintiffs and Texas Subclass members to awholly unwarranted risk to the safety of their PII and the security of their identity or credit, andworked a substantial hardship on a significant and unprecedented number of consumers. Plaintiffs

553501.1

79Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 81 of 92 PageID# 14921

and Texas Subclass members cannot mitigate this unfairness because they cannot undo the Data
Breach.
279.

The Defendants acted intentionally, knowingly, and maliciously to violate Texas’s

Deceptive Trade Practices-Consumer Protection Act, and recklessly disregarded Plaintiffs’ and theTexas Subclass members’ rights. Defendants are of such a sophisticated and large nature that otherdata breaches and public information regarding security vulnerabilities put them on notice that theirsecurity and privacy protections were inadequate.
280.

As a direct and proximate result of the Defendants’ unconscionable and deceptive

acts or practices, Plaintiffs and the Texas Subclass members have suffered and will continue tosuffer injury, ascertainable losses of money or property, and monetary and non-monetary damages,
including loss of the benefit of their bargain with and overcharges by Capital One, as they would
not have paid Capital One for services or would have paid less for such services but for theviolations alleged herein; losses from fraud and identity theft; costs for credit monitoring andidentity protection services; time and expenses related to monitoring their financial accounts forfraudulent activity; loss of value of their PII; and an increased, imminent risk of fraud and identity
theft.
281.

The Defendants’ unconscionable and deceptive acts or practices were a producing

cause of Plaintiffs’ and Texas Subclass members’ injuries, ascertainable losses and economic andnon-economic damages.
282.

The Defendants’ violations present a continuing risk to Plaintiffs and Texas Subclassmembers as well as to the general public.
283.

Plaintiffs and the Texas Subclass seek all monetary and non-monetary relief allowed

by law, including economic damages; treble damages for each act committed intentionally or

553501.1

80Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 82 of 92 PageID# 14922

knowingly; restitution; court costs; reasonably and necessary attorneys’ fees; injunctive relief; andany other relief which the court deems proper.
CLAIMS ON BEHALF OF THE VIRGINIA SUBCLASSCOUNT 13
VIRGINIA PERSONAL INFORMATION BREACH NOTIFICATION ACT,
Va. Code. Ann. §§ 18.2-186.6, et seq.
Against All Defendants
284.

The Virginia Plaintiff identified above (“Plaintiffs” for purposes of this Count),

individually and on behalf of the Virginia Subclass, repeat and allege Paragraphs 1–157, as if fully
alleged herein.
285.

Defendants are required to accurately notify Plaintiffs and Virginia Subclassmembers following discovery or notification of a breach of their data security system if unencrypted
or unredacted Personal Information was or is reasonably believed to have been accessed andacquired by an unauthorized person who will, or it is reasonably believed who will, engage in
identify theft or another fraud, without unreasonable delay under Va. Code Ann. § 18.2-186.6(B).
286.

The Defendants are entities that own, license, or maintain computerized data that

includes Personal Information as defined by Va. Code Ann. §§ 18.2-186.6(B), (D).
287.

Plaintiffs’ and Virginia Subclass members’ PII includes Personal Information ascovered under Va. Code Ann. § 18.2-186.6(A).
288.

Because Defendants discovered a breach of their security system in which

unencrypted or unredacted PII was or is reasonably believed to have been accessed and acquiredby an unauthorized person, who will, or it is reasonably believed who will, engage in identify theftor another fraud, Defendants had an obligation to disclose the data breach in a timely and accurate
fashion as mandated by Va. Code Ann. §§ 18.2-186.6(B), (D).

553501.1

81Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 83 of 92 PageID# 14923

289.

By failing to disclose the Data Breach in a timely and accurate manner, Defendants

violated Va. Code Ann. §§ 18.2-186.6(B), (D).
290.

As a direct and proximate result of Defendants’ violations of Va. Code Ann. §§ 18.2-

186.6(B), (D), Plaintiffs and Virginia Subclass members suffered damages, as described above.
291.

Plaintiffs and Virginia Subclass members seek relief under Va. Code Ann. § 18.2-

186.6(I), including actual damages.
CLAIMS ON BEHALF OF THE WASHINGTON SUBCLASSCOUNT 14WASHINGTON DATA BREACH NOTICE ACT,Wash. Rev. Code §§ 19.255.010, et seq.
Against All Defendants
292.

The Washington Plaintiff identified above (“Plaintiffs” for purposes of this Count),

individually and on behalf of the Washington Subclass, repeats and alleges Paragraphs 1–157, as if
fully alleged herein.
293.

Defendants are businesses that own, license, or maintain computerized data that

includes Personal Information as defined by Wash. 10 Rev. Code §§ 19.255.010(1), (2).
294.

Plaintiffs’ and Washington Subclass members’ PII includes Personal Information ascovered under Wash. Rev. Code § 19.255.010(5).
295.

Defendants are required to accurately notify Plaintiffs and Washington Subclassmembers following discovery or notification of the breach of their data security system if Personal
Information was, or is reasonably believed to have been, acquired by an unauthorized person and
the Personal Information was not secured, in the most expedient time possible and without
unreasonable delay under Wash. Rev. Code §§ 19.255.010(2), (11).

553501.1

82

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 84 of 92 PageID# 14924

296.

Because Defendants discovered a breach of their security system in which Personal

Information was, or is reasonably believed to have been, acquired by an unauthorized person and
the Personal Information was not secured, Defendants had an obligation to disclose the data breachin a timely and accurate fashion as mandated by Wash. Rev. Code §§ 19.255.010(2), (11).
297.

By failing to disclose the Data Breach in a timely and accurate manner, Defendants

violated Wash. Rev. Code §§ 19.255.010(2), (11).
298.

As a direct and proximate result of Defendants’ violations of Wash. Rev. Code §§19.255.010(2), (11), Plaintiffs and Washington Subclass members suffered damages, as describedabove.
299.

Plaintiffs and Washington Subclass members seek relief under Wash. Rev. Code §§19.255.010(13)(a) and 19.255.010(13)(b), including actual damages and injunctive relief.
COUNT 15WASHINGTON CONSUMER PROTECTION ACT,Wash. Rev. Code Ann. §§ 19.86.020, et seq.
300.

The Washington Plaintiff identified above (“Plaintiffs” for purposes of this Count),

individually and on behalf of the Washington Subclass, repeats and alleges Paragraphs 1–157, as if
fully alleged herein.
301.

Defendants are “person[s]” as defined by Wash. Rev. Code Ann. § 19.86.010(1).

302.

Defendants advertised, offered, or sold goods or services in Washington andengaged in trade or commerce directly or indirectly affecting the people of Washington, as definedby Wash. Rev. Code Ann. § 19.86.010 (2).
303.

Defendants engaged in unfair or deceptive acts or practices in the conduct of tradeor commerce, in violation of Wash. Rev. Code Ann. § 19.86.020, including:

553501.1

83Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 85 of 92 PageID# 14925

a.

Failing to implement and maintain reasonable security and privacy
measures to protect Plaintiffs’ and Washington Subclass members’ PII,
which was a direct and proximate cause of the Data Breach;b.

Failing to identify foreseeable security and privacy risks, remediate
identified security and privacy risks, and adequately improve security andprivacy measures despite knowing the risk of cybersecurity incidents, which
was a direct and proximate cause of the Data Breach;c.

Failing to comply with common law and statutory duties pertaining to thesecurity and privacy of Plaintiffs’ and Washington Subclass members’ PII,
including duties imposed by the FTC Act, 15 U.S.C. § 45, which was a
direct and proximate cause of the Data Breach;d.

Misrepresenting that they would protect the privacy and confidentiality of
Plaintiffs’ and Washington Subclass members’ PII, including byimplementing and maintaining reasonable security measures;e.

Misrepresenting that they would comply with common law and statutory
duties pertaining to the security and privacy of Plaintiffs’ and Washington
Subclass members’ PII, including duties imposed by the FTC Act, 15
U.S.C. § 45;f.

Omitting, suppressing, and concealing the material fact that it did notreasonably or adequately secure Plaintiffs’ and Washington Subclassmembers’ PII; andg.

Omitting, suppressing, and concealing the material fact that they did notcomply with common law and statutory duties pertaining to the security and553501.1

84

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 86 of 92 PageID# 14926

privacy of Plaintiffs’ and Washington Subclass members’ PII, including
duties imposed by the FTC Act, 15 U.S.C. § 45.
304.

Defendants’ representations and omissions were material because they were likely

to deceive reasonable consumers about the adequacy of Defendants’ data security and ability toprotect the confidentiality of consumers’ PII.
305.

Defendants acted intentionally, knowingly, and maliciously to violate Washington’sConsumer Protection Act, and recklessly disregarded Plaintiffs’ and Washington Subclassmembers’ rights. Defendants are of such a sophisticated and large nature that other data breaches
and public information regarding security vulnerabilities put them on notice that their security andprivacy protections were inadequate.
306.

Defendants’ conduct is injurious to the public interest because it violates Wash. Rev.

Code Ann. § 19.86.020, violates a statute that contains a specific legislation declaration of public
interest impact, and/or injured persons and had and has the capacity to injure persons. Further, theirconduct affected the public interest, including the many Washingtonians affected by the Data
Breach.
307.

As a direct and proximate result of Defendants’ unfair methods of competition andunfair or deceptive acts or practices, Plaintiffs and Washington Subclass members have suffered
and will continue to suffer injury, ascertainable losses of money or property, and monetary and nonmonetary damages, including loss of the benefit of their bargain with and overcharges by Capital
One, as they would not have paid Capital One for services or would have paid less for such services
but for the violations alleged herein; losses from fraud and identity theft; costs for credit monitoringand identity protection services; time and expenses related to monitoring their financial accounts

553501.1

85

Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 87 of 92 PageID# 14927

for fraudulent activity; loss of value of their PII; and an increased, imminent risk of fraud andidentity theft.
308.

Plaintiffs and Washington Subclass members seek all monetary and non-monetary

relief allowed by law, including actual damages, treble damages, injunctive relief, civil penalties,
and attorneys’ fees and costs.
REQUEST FOR RELIEF
WHEREFORE, Plaintiffs, individually and on behalf of all class members proposed inthis Complaint, respectfully request that the Court enter judgment in their favor and against
Defendants as follows:a.

For an Order certifying the Classes, as defined herein, and appointing Plaintiffs andPlaintiffs’ Lead Counsel to represent the Classes as alleged herein;b.

For injunctive and other equitable relief as is necessary to protect the interests of
Plaintiffs and class members, including but not limited to an order:i.

Prohibiting Defendants from engaging in the wrongful and unlawful acts
described herein;ii.

Requiring Defendants to protect, including through encryption, all datacollected through the course of their business in accordance with all applicableregulations, industry standards, and federal, state or local laws;

iii.

Requiring Defendants to delete, destroy and purge the PII of Plaintiffs andclass members unless Capital One can provide to the Court reasonable
justification for the retention and use of such information when weighedagainst the privacy interests of Plaintiffs and class members;

553501.1

86Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 88 of 92 PageID# 14928

iv.

Requiring Defendants to implement and maintain a comprehensive
Information Security Program designed to protect the confidentiality andintegrity of Plaintiffs’ and class members’ PII;v.

Prohibiting Defendants from maintaining Plaintiffs’ and class members’ PII
on the AWS cloud;vi.

Requiring

Defendants

toengageindependent

third-party

security

auditors/penetration testers as well as internal security personnel to conduct
testing, including simulated attacks, penetration tests, and audits on
Defendants’ systems on a periodic basis, and ordering Defendants to promptly
correct any problems or issues detected by such third-party security auditors;
vii.

Requiring Defendants to engage independent third-party security auditors andinternal personnel to run automated security monitoring;viii.

Requiring Defendants to audit, test, and train their security personnel
regarding any new or modified procedures;ix.

Requiring Defendants to segment data by, among other things, creating
firewalls and access controls so that if one area of Defendants’ network iscompromised, hackers cannot gain access to other portions of Defendants’systems;x.

Requiring Defendants to conduct regular database scanning and securing
checks;xi.

Requiring Defendants to establish an information security training programthat includes at least annual information security training for all employees,with additional training to be provided as appropriate based upon employees’

553501.1

87Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 89 of 92 PageID# 14929

respective responsibilities with handling PII , as well as protecting the PII of
Plaintiffs and class members;
xii.

Requiring Defendants to routinely and continually conduct internal training
and education, at least annually, to inform internal security personnel how to
identify and contain a breach when it occurs and what to do in response to abreach;xiii.

Requiring Defendants to implement a system of testing to assess theirrespective employees’ knowledge of the education programs discussed in thepreceding subparagraphs, as well as randomly and periodically testing
employees’ compliance with Defendants’ policies, programs and systems forprotecting PII;

xiv.

Requiring Defendants to implement, maintain, regularly review and revise asnecessary, a threat management program designed to appropriately monitor
the Defendants’ information networks for threats, both internal and external,
and assess whether monitoring tools are appropriately configured, tested, andupdated;xv.

Requiring Defendants to meaningfully educate all class members about thethreats they face as a result of the loss of their PII to third parties, as well as
the steps affected individuals must take to protect themselves;

xvi.

Requiring Defendants to implement logging and monitoring programs
sufficient to track traffic to and from Defendants’ servers; andxvii.

Appointing a qualified and independent third party assessor to conduct for aperiod of 10 years a SOC 2 Type 2 attestation to evaluate on an annual basis553501.1

88Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 90 of 92 PageID# 14930

Defendants’ compliance with the terms of the Court’s final judgment, toprovide such report to the Court and to counsel for the class, and to report any
deficiencies in compliance with the Court’s final judgment.
c.

For an award of compensatory, consequential, and general damages, including
nominal damages, as allowed by law in an amount to be determined;d.

For an award of statutory damages, trebeled, and punitive or exemplary damages, asallowed by law in an amount to be determined;e.

For an award of restitution or disgorgement, in an amount to be determined;f.

For an award of attorneys’ fees costs and litigation expenses, as allowable by law;g.

For prejudgment interest on all amounts awarded; andh.

Such other and further relief as this court may deem just and proper.
JURY DEMAND

Plaintiffs, on behalf of themselves and the Class of all others similarly situated, hereby
demand a trial by jury on all issues so triable pursuant to Rule 38 of the Federal Rules of Civil
Procedure.
Dated: October 23, 2020

Respectfully Submitted,/s/ Steven T. Webster
Steven T. Webster (VSB No. 31975)
WEBSTER BOOK LLP
300 N. Washington Street, Suite 404
Alexandria, Virginia 22314
Tel: (888) 987-9991
swebster@websterbook.com
Plaintiffs’ Local Counsel

553501.1

89Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 91 of 92 PageID# 14931

Norman E. Siegel
STUEVE SIEGEL HANSON LLP
460 Nichols Road, Suite 200
Kansas City, MO 64112
Tel: (816) 714-7100
siegel@stuevesiegel.com
Karen Hanson Riebel
LOCKRIDGE GRINDAL NAUEN, P.L.L.P
100 Washington Avenue South, Suite 200
Minneapolis, MN 55401
Tel: (612) 339-6900
khriebel@locklaw.com
John A. Yanchunis
MORGAN & MORGAN COMPLEX
LITIGATION GROUP
201 N. Franklin Street, 7th Floor
Tampa, FL 33602
Tel: (813) 223-5505
jyanchunis@ForThePeople.com
Plaintiffs’ Co-Lead Counsel

553501.1

90Case 1:19-md-02915-AJT-JFA Document 971 Filed 10/23/20 Page 92 of 92 PageID# 14932

CERTIFICATE OF SERVICE
I hereby certify that on October 23, 2020, I electronically filed the foregoing documentwith the Clerk of the Court using the CM/ECF system, which will send notice of electronic filingto all counsel of record.

/s/ Steven T. Webster
Steven T. Webster (VSB No. 31975)
WEBSTER BOOK LLP

553501.1