Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 1 of 63 PageID# 15049

UNITED STATES DISTRICT COURTEASTERN DISTRICT OF VIRGINA
ALEXANDRIA DIVISIONIN RE: CAPITAL ONE CONSUMER DATASECURITY BREACH LITIGATION

)
)
)
)

MDL No. 1:19md2915 (AFT-JFA)

This Document Relates to the Consumer Cases
AMAZON DEFENDANTS’ ANSWER TO THE SECOND AMENDED
REPRESENTATIVE CONSUMER CLASS ACTION COMPLAINT
Defendants Amazon.com, Inc. and Amazon Web Services, Inc. (together, “Amazon”)
jointly submit their Answer and Defenses to the Second Amended Representative Consumer
Class Action Complaint (Dkt. No. 971) (the “Complaint”).
The cover page of the Complaint, the first paragraph on page 1 of the Complaint, and theheadings and subheadings appearing throughout the Complaint do not contain allegations towhich a response is required. To the extent those portions of the Complaint contain any
allegations to which a response is required, Amazon denies the allegations. In response to theallegations in the numbered paragraphs of the Complaint, Amazon responds as follows:
PREAMBLE
The unnumbered paragraphs in the preamble of the Complaint contain argument andlegal conclusions to which no response is required. To the extent a response is required, Amazon
denies the allegations of the preamble.
INTRODUCTION
1.

Amazon admits that Capital One announced a data breach on July 29, 2019.

Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations in paragraph 1 of the Complaint, and on that basis denies them.

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 2 of 63 PageID# 15050

2.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations in paragraph 2 of the Complaint, and on that basis denies them.
3.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon admits that
Paige A. Thompson was a former Amazon employee. Amazon denies the remaining allegationsof paragraph 3 of the Complaint.
4.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon denies theremaining allegations of paragraph 4 of the Complaint.
5.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon denies theremaining allegations of paragraph 5 of the Complaint
JURISDICTION AND VENUE
6.

Paragraph 6 of the Complaint contains argument and legal conclusions to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
denies the remaining allegations of paragraph 6 of the Complaint.
7.

Paragraph 7 of the Complaint contains argument and legal conclusions to which

no response is required. Amazon lacks sufficient knowledge or information to form a belief as tothe truth of the allegations regarding Capital One, and on that basis denies them. Amazon denies
the remaining allegations of paragraph 7 of the Complaint.
8.

Paragraph 8 of the Complaint contains argument and legal conclusions to which

no response is required. To the extent a response is required, Amazon admits that it is authorized
to and conducts business in Virginia. Amazon denies the remaining allegations of paragraph 8 of
the Complaint.
2

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 3 of 63 PageID# 15051

9.

Paragraph 9 of the Complaint contains argument and legal conclusions to which

no response is required. To the extent a response is required, Amazon admits that it maintains
physical facilities in Virginia and provided services to Capital One in Virginia. Amazon lacks
sufficient knowledge or information to form a belief as to the truth of the allegations regarding
Capital One, and on that basis denies them. Amazon denies the remaining allegations ofparagraph 9 of the Complaint.
10.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 10 of the Complaint, and on that basis
denies them.
11.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 11 of the Complaint, and on that basis
denies them.
12.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 12 of the Complaint, and on that basis
denies them.
13.

Amazon admits that Amazon.com, Inc. is a corporation with its headquarters andprincipal place of business in Seattle, Washington. Amazon admits that it is incorporated under
the laws of the State of Delaware.
14.

Amazon admits that Amazon Web Services, Inc. is a Delaware corporation with

its principal place of business in Seattle, Washington. Amazon admits that Amazon Web
Services, Inc. is subsidiary of Amazon.com, Inc.
NAMED PLAINTIFFS
15.

Amazon denies that it has exclusive knowledge of what information, if any, wascompromised for each individual Plaintiff. Amazon lacks sufficient knowledge or information to3

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 4 of 63 PageID# 15052

form a belief as to the truth of the remaining allegations in paragraph 15 of the Complaint, andon that basis denies them.
16.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations in paragraph 16 of the Complaint, and on that basis denies them.
17.

Amazon denies each and every allegation of paragraph 17 of the Complaint.
CALIFORNIA18.

The allegation that Plaintiff Hausauer remains at a substantial and imminent risk

of future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 18 of the Complaint, and on that basis denies them.
19.

The allegation that Plaintiff Tada remains at a substantial and imminent risk of

future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 19 of the Complaint, and on that basis denies them.
FLORIDA20.

The allegation that Plaintiff Behar remains at a substantial and imminent risk of

future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 20 of the Complaint, and on that basis denies them.
21.

The allegation that Plaintiff Zielicke remains at a substantial and imminent risk of

future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 21 of the Complaint, and on that basis denies them.

4Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 5 of 63 PageID# 15053

NEW YORK22.

The allegation that Plaintiff Gershen remains at a substantial and imminent risk of

future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 22 of the Complaint, and on that basis denies them.
TEXAS
23.

The allegation that Plaintiff Edmondson remains at a substantial and imminent

risk of future harm contains argument and legal conclusions to which no response is required.
To the extent a response is required, Amazon lacks sufficient knowledge or information to forma belief as to the truth of the allegations in paragraph 23 of the Complaint, and on that basis
denies them.
VIRGINIA24.

The allegation that Plaintiff Spacek remains at a substantial and imminent risk of

future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 24 of the Complaint, and on that basis denies them.
WASHINGTON
25.

The allegation that Plaintiff Sharp remains at a substantial and imminent risk of

future harm contains argument and legal conclusions to which no response is required. To theextent a response is required, Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations in paragraph 25 of the Complaint, and on that basis denies them.

5Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 6 of 63 PageID# 15054

FACTUAL ALLEGATIONS
26.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 26 of the Complaint, and on that basis
denies them.
27.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 27 of the Complaint, and on that basis
denies them.
28.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 28 of the Complaint, and on that basis
denies them.
29.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 29 of the Complaint, and on that basis
denies them.
30.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 30 of the Complaint, and on that basis
denies them.
31.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 31 of the Complaint, and on that basis
denies them.
32.

Amazon admits that that machine learning is a subset of artificial intelligence,

through which computers learn to discern patterns in data and may accomplish tasks and can
detect patterns in data that are difficult for humans to perceive. Amazon lacks sufficientknowledge or information to form a belief as to the truth of the allegations regarding the6Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 7 of 63 PageID# 15055

financial services industry and on that basis denies them. Amazon denies the remaining
allegations of paragraph 32 of the Complaint.
33.

Amazon admits that machine learning requires data and an increased amount ofdata can increase the effectiveness of a machine learning algorithm. Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations ofparagraph 33 of the Complaint and on that basis denies them.
34.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 34 of the Complaint, and on that basis
denies them.
35.

Amazon admits that AWS maintains a cloud infrastructure which can be leased tobusiness customers on a scalable basis. Amazon admits that customers only pay for thecomputing power and storage needed and may save money when compared to maintaining theirown dedicated servers and infrastructure. Amazon lacks sufficient knowledge or information toform a belief as to the truth of the allegations regarding Microsoft’s Azure, IBM’s Cloud or
Google Cloud in paragraph 35 of the Complaint, and on that basis denies them. Amazon denies
the remaining allegations of paragraph 35 of the Complaint.
36.

Amazon denies that there are increased data security risks inherent in the use of

public cloud computing as to AWS. Amazon lacks sufficient knowledge or information to forma belief as to the truth of the allegations regarding regulatory hurdles or banks in paragraph 36 of
the Complaint, and on that basis denies them. Amazon denies the remaining allegations ofparagraph 36 of the Complaint.

7

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 8 of 63 PageID# 15056

37.

Amazon denies that there are inherent security risks in using AWS as compared to

private data centers. Amazon admits the remaining allegations of paragraph 37 of theComplaint.
38.

Amazon admits that the AWS cloud environment is a technology-forward

solution for Capital One’s business needs. Amazon denies the remaining allegations ofparagraph 38 of the Complaint.
39.

Amazon denies each and every allegation of paragraph 39 of the Complaint.

40.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon denies theremaining allegations of paragraph 40 of the Complaint.
41.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding statements made by Capital One Chief Executive Officer Rich
Fairbanks in paragraph 41 of the Complaint, and on that basis denies them.
42.

Amazon admits that it hosts a yearly re:Invent conference. Amazon admits that in

October 2015, Capital One’s Chief Information Officer Rob Alexander gave a presentation
which discussed Capital One. Amazon admits that during the presentation Rob Alexander
stated, “[S]ecurity is critical for us. The financial services industry attracts some of the worst
cyber criminals so we work closely with the Amazon team to develop a security model which we
believe enables us to operate more securely in the public cloud than we can even in our own data
centers.” Amazon lacks sufficient knowledge or information to form a belief as to the truth ofwhether Capital One had previously announced it would be shifting its data to the cloud, and onthat basis, denies that allegation.
43.

Amazon denies each and every allegation of paragraph 43 of the Complaint.

8

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 9 of 63 PageID# 15057

44.

Amazon denies that it has suffered from a widely known flaw. Amazon denies

that AWS servers were not secured against SSRF attacks. Amazon denies that paragraph 44
accurately describes an SSRF attack. Amazon lacks sufficient knowledge or information to forma belief as to the truth of the allegations regarding statements made at cybersecurity conferences
and on that basis denies them. Amazon denies the remaining allegations of paragraph 44 of theComplaint.
45.

Amazon admits that AWS’ servers can facilitate machine learning by its

customers. Amazon admits that AWS’ servers can be used by its customers to store large
amount of data that can be collected and organized. Amazon admits that its customers may
configure their AWS environment with access “policies” to allow for web applications to only
pull the data needed and nothing more. Amazon admits that Identity and Access Management(“IAM”) roles may be configured by the AWS customer to manage access polices. Amazon
denies the remaining allegations of paragraph 45 of the Complaint.
46.

Amazon admits that an IAM role is a tool to give specific permissions in an AWS

account. Amazon admits that IAM roles can be used to delegate access to users, applications, orservices to resources in an AWS account on a dynamic basis. Amazon lacks sufficientknowledge or information to form a belief as to the truth of the allegations regarding theremaining allegations of paragraph 46, and on that basis denies them.
47.

Amazon denies that a firewall is the only defense that protects data from outside

penetration. Amazon admits that its customers may configure their firewall to block
unauthorized access while permitting authorized access and communication. Amazon denies theremaining allegations of paragraph 47 of the Complaint.

9

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 10 of 63 PageID# 15058

48.

Amazon denies that paragraph 48 fully and completely describes the functions of

all firewalls, and on that basis, denies each and every allegation of paragraph 48 of theComplaint.
49.

Amazon admits that a firewall, among other purposes, may be configured toprevent resources on a computer network from being exposed directly to the Internet. Amazon
admits that a Web Application Firewall (“WAF”) may be used to filter, monitor, and block web
traffic to and from a web application. Amazon lacks sufficient knowledge or information toform a belief as to the truth of the allegations regarding the remaining allegations of paragraph
49, and on that basis denies them.
50.

Amazon denies each and every allegation of paragraph 50 of the Complaint.

51.

Amazon denies each and every allegation of paragraph 51 of the Complaint.

52.

Amazon denies there is a well-known flaw in AWS-based systems that makethem vulnerable to SSRF attacks. Amazon lacks sufficient knowledge or information to form abelief as to the truth of the remaining allegations regarding Google and Microsoft in paragraph
52 of the Complaint, and on that basis denies them.
53.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding statements made by Cloudflare in paragraph 53 of the Complaint,
and on that basis denies them.
54.

Amazon denies each and every allegation of paragraph 54 of the Complaint.

55.

Amazon denies the allegations in paragraph 55 to the extent they allege Amazon

made representations about Cloud Custodian. Amazon lacks sufficient knowledge orinformation to form a belief as to the truth of the remaining allegations in paragraph 55 of theComplaint, and on that basis denies them.

10Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 11 of 63 PageID# 15059

56.

Amazon denies the allegations in paragraph 56 to the extent they allege Amazon

made representations about Cloud Custodian. The last sentence of paragraph 56 is speculationand does not require a response. Because AWS customers determine the permissions granted to
IAM roles, Amazon lacks sufficient knowledge or information to form a belief as to the truth of
the allegations regarding the remaining allegations of paragraph 56, and on that basis denies
them.
57.

Amazon admits that it hosts a yearly re:Invent conference. Amazon admits that inNovember 2018, Kapil Thangavelu of Capital One gave a presentation regarding Cloud
Custodian. Amazon admits that during the presentation Kapil Thangavelu stated, “In the cloud,all these resources are just available via URL so those are part of your network boundary. And
those resources that have embedded IAM policies need special care and attention because they
can be enabled to be accessible outside of your account. I think everyone’s familiar with some of
the things around S3 but that extends out to a lot of the other resources I called out a couple
here.” Amazon denies the remaining allegations of paragraph 57 of the Complaint.
58.

Amazon admits that AWS customers can configure IAM roles to manage accessto data stored in S3. Amazon lacks sufficient knowledge or information to form a belief as to thetruth of the allegations regarding statements made by Capital One in paragraph 58 of theComplaint, and on that basis denies them. Amazon denies the remaining allegations ofparagraph 58 of the Complaint.
59.

Amazon denies the allegations of paragraph 59 as directed to Amazon. Amazon

lacks sufficient knowledge or information to form a belief as to what Capital One was aware of,and on that basis denies the remaining allegations of paragraph 59 of the Complaint.

11

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 12 of 63 PageID# 15060

60.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding a filing made by Capital One in paragraph 60 of the Complaint, andon that basis denies them.
61.

Amazon admits that Paige A. Thompson had previously worked as a “systems

engineer” for Amazon. Amazon lacks sufficient knowledge or information to form a belief as tothe truth of the remaining allegations in paragraph 61 of the Complaint, and on that basis denies
them.
62.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding what Capital One was aware of in paragraph 62 of the Complaint,
and on that basis denies them.
63.

Amazon admits it made a statement that the intrusion occurred through a

misconfiguration by Capital One. Amazon lacks sufficient knowledge or information to form abelief as to the truth of the remaining allegations in paragraph 63 of the Complaint, and on thatbasis denies them.
64.

Amazon admits that AWS provided products and services to Capital One fromcross-functional teams. Amazon admits that AWS provided products and services to Capital
One to assist Capital One’s migration to the cloud. Amazon denies the remaining allegations ofparagraph 64 of the Complaint.
65.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding what Capital One was aware of in paragraph 65 of the Complaint,
and on that basis denies them.

12Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 13 of 63 PageID# 15061

66.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding what Capital One was aware of in paragraph 66 of the Complaint,
and on that basis denies them.
67.

Amazon admits that there was a List Buckets Command in Capital One’s cloudenvironment on April 21, 2019. Amazon lacks sufficient knowledge regarding the remaining
allegations of paragraph 67 of the Complaint and on that basis denies them.
68.

Amazon admits that it released the following statement in a letter to The

Honorable Ron Wyden on August 13, 2019: “As Capital One outlined in their publicannouncement, the attack occurred due to a misconfiguration error at the application layer of afirewall installed by Capital One, exacerbated by permissions set by Capital One that were likely
broader than intended. After gaining access through the misconfigured firewall and having
broader permission to access resources, we believe a SSRF attack was used (which is one ofseveral ways an attacker could have potentially gotten access to data once they got in through the
misconfigured firewall).” Amazon denies the remaining allegations of paragraph 68 of theComplaint.
69.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding what Capital One was aware of in paragraph 69 of the Complaint,
and on that basis denies them.
70.

Amazon denies that Capital One used the AWS WAF in the account the hacker

compromised and further denies that the AWS WAF had a vulnerability the hacker exploited.
Amazon denies the remaining allegations of paragraph 70 of the Complaint.

13

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 14 of 63 PageID# 15062

71.

Amazon denies that it worked with Capital One “to fix the WAF configuration”

and denies the allegation that there was a “known vulnerability.” Amazon denies the remaining
allegations of paragraph 71 of the Complaint.
72.

Because these allegations in paragraph 72 concern only Capital One’s knowledge,

Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding what Capital One was aware of in paragraph 72 of the Complaint, and onthat basis denies them.
73.

Because these allegations in paragraph 73 concern only Capital One’s knowledge

and the findings of its own investigation, Amazon lacks sufficient knowledge or information toform a belief as to the truth of the allegations regarding Capital One, and on that basis denies
them. To the extent a further response is required, Amazon denies the remaining allegations ofparagraph 73 of the Complaint.
74.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding what Capital One was aware of in paragraph 74 of the Complaint,
and on that basis denies them. Amazon denies the remaining allegations of paragraph 74 of theComplaint.
75.

Amazon admits that on May 20, 2019, an employee received a handwritten note

stating, “Open Socks Proxy **.***.**.136 Can Hit IMS – lots of security credentials.” Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One’s statements or investigation, and on that basis denies them. Amazon
denies the remaining allegations of paragraph 75 of the Complaint.
76.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Thompson’s conduct, and on that basis denies them. Amazon admits

14

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 15 of 63 PageID# 15063

that it was not aware of the Data Breach until notified by Capital One on July 20, 2019. Amazon
denies the remaining allegations of paragraph 76 of the Complaint.
77.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations in paragraph 77 of the Complaint, and on that basis denies them.
78.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations in paragraph 78 of the Complaint, and on that basis denies them.
79.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations in paragraph 79 of the Complaint, and on that basis denies them.
80.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations in paragraph 80 of the Complaint, and on that basis denies them.
81.

Amazon denies each and every allegation of paragraph 81 of the Complaint.

82.

Amazon denies each and every allegation of paragraph 82 of the Complaint.

83.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegation regarding the age of the data accessed in the breach, and on that basis denies it.
Amazon denies the remaining allegations of paragraph 83 of the Complaint.
84.

Amazon admits that Capital One has publicly stated that information accessedfrom the data breach included information on applicants for Capital One credit card products
from 2005 through early 2019, and included “personal information Capital One routinely collects
at the time it receives credit card applications, including names, addresses, zip codes/postal
codes, phone numbers, email addresses, dates of birth, and self-reported income.”
85.

Amazon admits that Capital One has publicly stated that information accessedfrom the data breach included credit scores, credit limits, balances, payment histories, contact15

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 16 of 63 PageID# 15064

information, and “fragments of transaction data from a total of 23 days during 2016, 2017 and2018.”
86.

Amazon admits that Capital One has publicly stated that information accessedfrom the data breach included “about 140,000 Social Security numbers of [its] credit cardcustomers” and “about 80,000 linked bank account numbers of our secured credit cardcustomers.”.
87.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 87 of the Complaint, and on that basis
denies them.
88.

Paragraph 88 of the Complaint contains argument and legal conclusions to which

no response is required. To the extent a response is required, Amazon denies each and every
allegation of paragraph 88 of the Complaint.
89.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon lacks sufficientknowledge or information to form a belief as to the truth of the allegations regarding
cyberattacks, and on that basis denies them. Amazon denies the remaining allegations ofparagraph 89 of the Complaint.
90.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 90 of the Complaint, and on that basis
denies them.
91.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 91 of the Complaint, and on that basis
denies them.

16Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 17 of 63 PageID# 15065

92.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 92 of the Complaint, and on that basis
denies them.
93.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 93 of the Complaint, and on that basis
denies them.
94.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding what Capital One was aware of in paragraph 94 of the Complaint,
and on that basis denies them. Paragraph 94 of the Complaint contains argument and legal
conclusions to which no response is required. Amazon denies the remaining allegations ofparagraph 94 of the Complaint.
95.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 95 of the Complaint, and on that basis
denies them.
96.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 96 of the Complaint, and on that basis
denies them.
97.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 97 of the Complaint, and on that basis
denies them.
98.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 98 of the Complaint, and on that basis
denies them.

17Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 18 of 63 PageID# 15066

99.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 99 of the Complaint, and on that basis
denies them.
100.

Paragraph 100 of the Complaint contains argument and legal conclusions towhich no response is required. Amazon lacks sufficient knowledge or information to form abelief as to the truth of the remaining allegations regarding Capital One in paragraph 100 of theComplaint.
101.

Paragraph 101 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits that Cal.
Civil Code § 1798.81.5(b), which took effect on January 1, 2020, states, “A business that owns,
licenses, or maintains personal information about a California resident shall implement andmaintain reasonable security procedures and practices appropriate to the nature of theinformation, to protect the personal information from unauthorized access, destruction, use,
modification, or disclosure.” Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the remaining allegations of paragraph 101 of the Complaint, and on that basis
denies them.
102.

Paragraph 102 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, the referenced document at
https://www.ftc.gov/tips-advice/business-center/guidance/financial-institutions-customerinformation-complying is the best evidence of its contents. To the extent the allegations ofparagraph 102 are based on the contents of written documents, Amazon admits that to the extent
such allegations accurately reflect the contents of the documents, such statements exist, and18

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 19 of 63 PageID# 15067

otherwise denies them. Amazon denies that Plaintiffs’ characterization and paraphrasing of these
documents is accurate and denies Plaintiffs’ framing of these issues.
103.

Amazon admits that the Federal Trade Commission has issued guides for businesshighlighting the importance of reasonable data security practices. To the extent the allegationsof paragraph 103 are based on the contents of written documents, the referenced document is thebest evidence of its contents. Amazon admits that to the extent such allegations accuratelyreflect the contents of the documents, such statements exist, and otherwise denies them. Amazon
denies that Plaintiffs’ characterization and paraphrasing of these documents is accurate anddenies Plaintiffs’ framing of these issues.
104.

Amazon admits that the FTC issued the document referenced in paragraph 104 of

the Complaint in 2016. To the extent the allegations of paragraph 104 are based on the contents
of written documents, the referenced document is the best evidence of its contents. Amazon
admits that to the extent such allegations accurately reflect the contents of the documents, suchstatements exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
105.

To the extent the allegations of paragraph 105 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
106.

Paragraph 106 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent that a response is required, Amazon admits that the
FTC has brought enforcement actions alleging that certain businesses failed to adequately and19Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 20 of 63 PageID# 15068

reasonably protect customer data. To the extent the allegations of paragraph 106 are based on thecontents of written documents, the referenced document is the best evidence of its contents.
Amazon admits that to the extent such allegations accurately reflect the contents of the
documents, such statements exist, and otherwise denies them. Amazon denies that Plaintiffs’
characterization and paraphrasing of these documents is accurate and denies Plaintiffs’ framingof these issues.
107.

Paragraph 107 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent the allegations of paragraph 107 are based on thecontents of written documents, the referenced document is the best evidence of its contents.
Amazon admits that to the extent such allegations accurately reflect the contents of the
documents, such statements exist, and otherwise denies them. Amazon denies that Plaintiffs’
characterization and paraphrasing of these documents is accurate and denies Plaintiffs’ framingof these issues.
108.

Paragraph 108 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies theallegations of paragraph 108.
109.

Amazon admits version 3.2.1 of Payment Card Industry (PCI) Data Security

Standard: Requirements and Security Assessment Procedures (“PCI-DSS”) was released in May
2018. Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding the PCI Security Standards Council in paragraph 109 of the Complaint, andon that basis denies them.
110.

Paragraph 110 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficient

20

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 21 of 63 PageID# 15069

knowledge or information to form a belief as to the truth of the allegations regarding Capital One
in paragraph 110 of the Complaint, and on that basis denies them.
111.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 111 of the Complaint, and on that basis
denies them.
112.

Paragraph 112 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, because the allegations ofparagraph 112 are directed to Capital One, Amazon lacks sufficient knowledge or information toform a belief as to the truth of the allegations, and on that basis denies them.
113.

Paragraph 113 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, because the allegations ofparagraph 113 are directed to Capital One, Amazon lacks sufficient knowledge or information toform a belief as to the truth of the allegations, and on that basis denies them.
114.

Paragraph 114 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, because the allegations ofparagraph 114 are directed to Capital One, Amazon lacks sufficient knowledge or information toform a belief as to the truth of the allegations, and on that basis denies them.
115.

Paragraph 115 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations inparagraph 115 of the Complaint, and on that basis denies them.
116.

Paragraph 116 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficient21

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 22 of 63 PageID# 15070

knowledge or information to form a belief as to the truth of the allegations regarding Capital One
in paragraph 116 of the Complaint, and on that basis denies them.
117.

Paragraph 117 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the allegations regarding Capital One
in paragraph 117 of the Complaint, and on that basis denies them.
118.

Paragraph 118 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations regarding
Capital One in paragraph 118 of the Complaint, and on that basis denies them.
119.

Paragraph 119 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations regarding
Capital One in paragraph 119 of the Complaint, and on that basis denies them.
120.

Paragraph 120 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations regarding
Capital One in paragraph 120 of the Complaint, and on that basis denies them.
121.

Paragraph 121 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations regarding
Capital One in paragraph 121 of the Complaint, and on that basis denies them.

22

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 23 of 63 PageID# 15071

122.

Paragraph 122 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations regarding
Capital One in paragraph 122 of the Complaint, and on that basis denies them.
123.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon denies theremaining allegations of paragraph 123 of the Complaint
124.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One, and on that basis denies them. Amazon denies theremaining allegations of paragraph 124 of the Complaint.
125.

Paragraph 125 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies each andevery allegation of paragraph 125 of the Complaint.
126.

Paragraph 126 of the Complaint contains argument and legal conclusions towhich no response is required. Amazon lacks sufficient knowledge or information to form abelief as to the truth of the allegations regarding identity theft and fraud, and on that basis denies
them. Amazon denies the remaining allegations of paragraph 126 of the Complaint.
127.

Paragraph 127 of the Complaint contains argument and legal conclusions towhich no response is required. Amazon lacks sufficient knowledge or information to form abelief as to the truth of the allegations in paragraph 127 of the Complaint, and on that basis
denies them.

23

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 24 of 63 PageID# 15072

128.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 128 of the Complaint, and on that basis
denies them.
129.

To the extent the allegations of paragraph 129 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 129 of the Complaint, and on that basis denies them.
130.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations of paragraph 130 of the Complaint, and on that basis denies them.
131.

Amazon denies that it trades on the value of consumers’ PII. Amazon lacks

sufficient knowledge or information to form a belief as to the truth of the allegations regarding
Plaintiffs’ intentions or the value of PII, and on that basis denies them. Amazon denies theremaining allegations of paragraph 131 of the Complaint.
132.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations of paragraph 132 of the Complaint, and on that basis denies them.
133.

To the extent the allegations of paragraph 133 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.

24Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 25 of 63 PageID# 15073

Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 133 of the Complaint, and on that basis denies them.
134.

To the extent the allegations of paragraph 134 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 134 of the Complaint, and on that basis denies them.
135.

Paragraph 135 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the remaining allegations ofparagraph 135 of the Complaint, and on that basis denies them. To the extent the allegations ofparagraph 135 are based on the contents of written documents, the referenced document is thebest evidence of its contents. Amazon admits that to the extent such allegations accuratelyreflect the contents of the documents, such statements exist, and otherwise denies them. Amazon
denies that Plaintiffs’ characterization and paraphrasing of these documents is accurate anddenies Plaintiffs’ framing of these issues.
136.

To the extent the allegations of paragraph 136 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.

25Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 26 of 63 PageID# 15074

Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 136 of the Complaint, and on that basis denies them.
137.

To the extent the allegations of paragraph 137 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 137 of the Complaint, and on that basis denies them.
138.

To the extent the allegations of paragraph 138 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 138 of the Complaint, and on that basis denies them.
139.

To the extent the allegations of paragraph 139 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 139 of the Complaint, and on that basis denies them.

26

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 27 of 63 PageID# 15075

140.

The allegations of paragraph 140 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies them.
141.

To the extent the allegations of paragraph 141 are based on the contents of written

documents, the referenced document is the best evidence of its contents. Amazon admits that tothe extent such allegations accurately reflect the contents of the documents, such statements
exist, and otherwise denies them. Amazon denies that Plaintiffs’ characterization andparaphrasing of these documents is accurate and denies Plaintiffs’ framing of these issues.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theremaining allegations of paragraph 141 of the Complaint, and on that basis denies them.
142.

The allegations of paragraph 142 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the remaining
allegations of paragraph 142 of the Complaint, and on that basis denies them.
143.

The allegations of paragraph 143 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the remaining
allegations of paragraph 143 of the Complaint, and on that basis denies them.
CLASS ACTION ALLEGATIONS
144.

The allegations of paragraph 144 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies that this action may be properly maintained as a class action and that it meets therequirements of Federal Rule of Civil Procedure 23. Amazon admits that, as to certain claims in27

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 28 of 63 PageID# 15076

this action, Plaintiffs purport to bring this action as a putative class action on behalf of the“Nationwide Class” described.
145.

The allegations of paragraph 145 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
admits that the Complaint purports to assert claims against all Defendants for negligence (Count1), negligence per se (Count 2), unjust enrichment (Count 3), and declaratory judgment (Count4), and against the Capital One Defendants only for breach of confidence (Count 5), breach ofcontract (Count 6), and breach of implied contract (Count 7).
146.

The allegations of paragraph 146 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
admits that the Complaint purports to seek certification of state-by-state claims in the alternative
to the nationwide claims, as well as statutory claims under state data breach statutes andconsumer protection statutes (Counts 8 through 15), on behalf of separate statewide subclasses
for the States of California, Florida, New York, Texas, Virginia, and Washington (the “State
Subclasses”) defined as: “All persons in [name of state] whose PII was compromised in the Data
Breach.” Amazon denies that this action may be properly maintained as a class action and that itmeets the requirements of Federal Rule of Civil Procedure 23.
147.

The allegations of paragraph 147 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
admits that the Complaint purports to exclude from the purported Nationwide Class and eachState Subclass: Defendants; any entity in which any Defendant has a controlling interest;
Defendants’ officers, directors, legal representatives, successors, subsidiaries, and assigns; any
judicial officer presiding over this matter, members of their immediate family, and members of28

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 29 of 63 PageID# 15077

their judicial staff. Amazon denies that this action may be properly maintained as a class action
and that it meets the requirements of Federal Rule of Civil Procedure 23.
148.

The allegations of paragraph 148 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 148 of the Complaint.
149.

The allegations of paragraph 149 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 149 of the Complaint.
150.

The allegations of paragraph 150 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 150 of the Complaint.
151.

The allegations of paragraph 151 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 151 of the Complaint.
152.

The allegations of paragraph 152 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 152 of the Complaint.
153.

The allegations of paragraph 153 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 153 of the Complaint.
154.

The allegations of paragraph 154 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 154 of the Complaint.

29

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 30 of 63 PageID# 15078

155.

The allegations of paragraph 155 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 155 of the Complaint.
156.

The allegations of paragraph 156 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 156 of the Complaint.
157.

The allegations of paragraph 157 of the Complaint contain argument and legal

conclusions, to which no response is required. To the extent a response is required, Amazon
denies the allegations of paragraph 157 of the Complaint.
CLAIMS ON BEHALF OF THE NATIONWIDE CLASSCOUNT 1NEGLIGENCE
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
158.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
159.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 159 of the Complaint and on that basis
denies them. Amazon admits that Capital One stores data using Amazon’s cloud computing
services. Amazon denies the remaining allegations of paragraph 159 of the Complaint.
160.

Paragraph 160 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. In addition,
paragraph 160 contains allegations under Washington negligence law that the Court dismissed in
its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt. No. 879).
Amazon denies the remaining allegations of paragraph 160 of the Complaint.

30

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 31 of 63 PageID# 15079

161.

Paragraph 161 of the Complaint contains argument legal conclusion to which no

response is required. To the extent a response is required, Amazon denies them. In addition,
paragraph 161 contains allegations under Washington negligence law that the Court dismissed in
its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt. No. 879).
Amazon denies the remaining allegations of paragraph 161 of the Complaint.
162.

Paragraph 162 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. In addition,
paragraph 162 contains allegations under Washington negligence law that the Court dismissed in
its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt. No. 879).
163.

Paragraph 163 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. In addition,
paragraph 163 contains allegations under Washington negligence law that the Court dismissed in
its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt. No. 879).
Amazon denies the remaining allegations of paragraph 163 of the Complaint.
164.

Paragraph 164 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. In addition,
Paragraph 164 contains allegations under Washington negligence law that the Court dismissed in
its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt. No. 879).
To the extent the allegations of paragraph 164 quote the FTC Act, Amazon admits that to theextent such allegations accurately reflect the contents of the Act, such statements exist, andotherwise denies them. Amazon denies that Plaintiffs’ characterization and paraphrasing ofthese documents is accurate and denies Plaintiffs’ framing of these issues.

31

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 32 of 63 PageID# 15080

165.

Paragraph 165 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 165 of the Complaint, and on that basis denies them.
166.

Paragraph 166 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
167.

Paragraph 167 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them. In
addition, paragraph 167 contains allegations under Washington negligence law that the Court
dismissed in its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt.
No. 879). Amazon denies the remaining allegations of Paragraph 167 of the Complaint.
168.

Paragraph 168 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them. In
addition, paragraph 168 contains allegations under Washington negligence law that the Court
dismissed in its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt.
No. 879).
169.

Paragraph 169 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them. In
addition, paragraph 169 contains allegations under Washington negligence law that the Court
dismissed in its Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss (Dkt.
No. 879).

32

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 33 of 63 PageID# 15081

COUNT 2NEGLIGENCE PER SE
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
170.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
171.

Paragraph 171 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. To the extent
the allegations of paragraph 171 quote the FTC Act, Amazon admits that to the extent suchallegations accurately reflect the contents of the Act, such statements exist, and otherwise denies
them. Amazon denies that Plaintiffs’ characterization and paraphrasing of these documents is
accurate and denies Plaintiffs’ framing of these issues.
172.

Paragraph 172 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them. In
addition, paragraph 172 contains allegations under the laws of California, Florida, Texas,
Virginia, and Washington that the Court dismissed in its Order Granting in Part and Denying inPart Defendants’ Motion to Dismiss (Dkt. No. 879). Amazon denies the remaining allegations ofparagraph 172 of the Complaint.
173.

Paragraph 173 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 173 of the Complaint, and on that basis denies them.
174.

Paragraph 174 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them. In
addition, paragraph 174 contains allegations under the laws of California, Florida, Texas,
33

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 34 of 63 PageID# 15082

Virginia, and Washington that the Court dismissed in its Order Granting in Part and Denying inPart Defendants’ Motion to Dismiss (Dkt. No. 879).
175.

Paragraph 175 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 175 of the Complaint, and on that basis denies them.
176.

Paragraph 176 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies that this action may be properly maintained as a class action and that it meets therequirements of Federal Rule of Civil Procedure 23.
177.

Paragraph 177 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them. In
addition, paragraph 177 contains allegations under the laws of California, Florida, Texas,
Virginia, and Washington that the Court dismissed in its Order Granting in Part and Denying inPart Defendants’ Motion to Dismiss (Dkt. No. 879).
178.

Paragraph 178 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies that this action may be properly maintained as a class action and that it meets therequirements of Federal Rule of Civil Procedure 23.
COUNT 3
UNJUST ENRICHMENT
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
179.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
34

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 35 of 63 PageID# 15083

180.

Paragraph 180 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them.
181.

Paragraph 181 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them to the extent
they are directed at Amazon. Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations regarding Capital One in paragraph 181 of the Complaint and onthat basis denies them.
182.

Paragraph 182 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them.
183.

Paragraph 183 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them.
184.

Paragraph 184 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them to the extent
they are directed at Amazon. Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations regarding Capital One in paragraph 184 of the Complaint and onthat basis denies them.
185.

Paragraph 185 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them to the extent
they are directed at Amazon. Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations regarding Capital One in paragraph 185 of the Complaint and onthat basis denies them.
186.

Paragraph 185 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them to the extent

35Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 36 of 63 PageID# 15084

they are directed at Amazon. Amazon lacks sufficient knowledge or information to form a belief
as to the truth of the allegations regarding Capital One in paragraph 186 of the Complaint and onthat basis denies them.
187.

Paragraph 187 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
188.

Paragraph 188 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 188 of the Complaint.
189.

Paragraph 189 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 189 of the Complaint.
190.

Paragraph 190 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
191.

Paragraph 191 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
192.

Paragraph 192 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
193.

Paragraph 193 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies that this action may be properly maintained as a class action and that it meets therequirements of Federal Rule of Civil Procedure 23.

36Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 37 of 63 PageID# 15085

COUNT 4
DECLARATORY JUDGMENT
Against all Defendants, On Behalf of Plaintiffs and the Nationwide Class, or Alternatively, on
Behalf of Plaintiffs and the State Subclasses
194.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
195.

Amazon maintains that the Declaratory Judgment Act speaks for itself and denies

Paragraph 195 to the extent it misrepresents the Declaratory Judgment Act. Paragraph 195 of theComplaint contains argument and legal conclusion to which no response is required. To theextent a response is required, Amazon denies them.
196.

Paragraph 196 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
197.

Paragraph 197 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
198.

Paragraph 198 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
199.

Paragraph 199 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them.
200.

Paragraph 200 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
201.

Paragraph 201 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.

37

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 38 of 63 PageID# 15086

COUNT 5
BREACH OF CONFIDENCE
Against the Capital One Defendants, On Behalf of Plaintiffs and the Nationwide Class, or
Alternatively, on Behalf of Plaintiffs and the State Subclasses
202.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
203.

Paragraph 203 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 203 of the Complaint, and on that basis denies them.
204.

Paragraph 204 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 204 of the Complaint, and on that basis denies them.
205.

Paragraph 205 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 205 of the Complaint, and on that basis denies them.
206.

Paragraph 206 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 206 of the Complaint, and on that basis denies them.
207.

Paragraph 207 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge

38

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 39 of 63 PageID# 15087

or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 207 of the Complaint, and on that basis denies them.
208.

Paragraph 208 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 208 of the Complaint, and on that basis denies them.
209.

Paragraph 209 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 209 of the Complaint, and on that basis denies them.
210.

Paragraph 210 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 210 of the Complaint, and on that basis denies them.
211.

Paragraph 211 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 211 of the Complaint, and on that basis denies them.
COUNT 6
BREACH OF CONTRACT
Against the Capital One Defendants, On Behalf of Plaintiffs and the Nationwide Class, or
Alternatively, on Behalf of Plaintiffs and the State Subclasses
212.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.

39

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 40 of 63 PageID# 15088

213.

Paragraph 213 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 213 of the Complaint, and on that basis denies them.
214.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 214 of the Complaint, and on that basis
denies them.
215.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 215 of the Complaint, and on that basis
denies them.
216.

Paragraph 216 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 216 of the Complaint, and on that basis denies them.
217.

Paragraph 217 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 217 of the Complaint, and on that basis denies them.
218.

Paragraph 218 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 218 of the Complaint, and on that basis denies them.

40

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 41 of 63 PageID# 15089

219.

Paragraph 219 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon lacks sufficient knowledge
or information to form a belief as to the truth of the allegations regarding Capital One inparagraph 219 of the Complaint, and on that basis denies them.
COUNT 7
BREACH OF IMPLIED CONTRACT
Against the Capital One Defendants, On Behalf of Plaintiffs and the Nationwide Class, or
Alternatively, on Behalf of Plaintiffs and the State Subclasses
220.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
221.

Paragraph 221 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 221 of the Complaint, and on that basis denies them.
222.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 222 of the Complaint, and on that basis
denies them.
223.

Paragraph 223 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 223 of the Complaint, and on that basis denies them.
224.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Capital One in paragraph 224 of the Complaint, and on that basis
denies them.

41

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 42 of 63 PageID# 15090

225.

Paragraph 225 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 225 of the Complaint, and on that basis denies them.
226.

Paragraph 226 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 226 of the Complaint, and on that basis denies them.
227.

Paragraph 227 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon denies them. Amazon
lacks sufficient knowledge or information to form a belief as to the truth of the allegations
regarding Capital One in paragraph 227 of the Complaint, and on that basis denies them.
COUNT 8CALIFORNIA UNFAIR COMPETITION LAW
Cal. Bus. & Prof. Code §§ 17200, et seq.
Against all Defendants
228.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
229.

Paragraph 229 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits that
Amazon.com, Inc. and Amazon Web Services, Inc. are both corporations.
230.

Paragraph 230 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
231.

Paragraph 231 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
42

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 43 of 63 PageID# 15091

Amazon is not a financial institution and therefore denies all claims arising under laws directed
at financial institutions, including Cal. Fin. Code §§ 4050 et seq. Amazon denies the remaining
allegations of paragraph 231 of the Complaint.
232.

Paragraph 232 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon is not a financial institution and therefore denies all claims arising under laws directed
at financial institutions, including California’s Financial Information Privacy Act and the GLBA.
233.

Paragraph 233 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon is not a financial institution and therefore denies all claims arising under laws directed
at financial institutions, including California’s Financial Information Privacy Act and the GLBA.
Amazon denies the remaining allegations of paragraph 233 of the Complaint.
234.

Paragraph 234 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
235.

Paragraph 235 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding Capital One in paragraph 235 of the Complaint and on that basis denies
them. Amazon denies the remaining allegations of paragraph 235 of the Complaint.
236.

Paragraph 236 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
237.

Paragraph 236 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.

43

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 44 of 63 PageID# 15092

COUNT 9CALIFORNIA CONSUMER LEGAL REMEDIES ACTCal. Bus. & Prof. Code §§ 1750, et seq.
Against all Defendants
238.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
239.

Paragraph 239 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon maintains that theConsumers Legal Remedies Act speaks for itself and denies paragraph 239 to the extent that it
misrepresents the CLRA.
240.

Paragraph 240 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits that
Amazon.com, Inc. and Amazon Web Services, Inc. are both corporations and denies theremaining allegations of paragraph 240 of the Complaint.
241.

Paragraph 241 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon maintains that theConsumers Legal Remedies Act speaks for itself and denies paragraph 241 to the extent that it
misrepresents the CLRA.
242.

Paragraph 242 of the Complaint contains argument and legal conclusion to which

no response is required. To the extent a response is required, Amazon maintains that theConsumers Legal Remedies Act speaks for itself and denies paragraph 242 to the extent that it
misrepresents the CLRA.
243.

Paragraph 243 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them to theextend they are directed to Amazon.
44

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 45 of 63 PageID# 15093

244.

Paragraph 244 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 244 of the Complaint to the extent they
are directed to Amazon.
245.

Paragraph 245 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
246.

Paragraph 246 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 246 of the Complaint.
247.

Paragraph 247 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding Capital One in paragraph 247 of the Complaint and on that basis denies
them. Amazon denies the remaining allegations of paragraph 247 of the Complaint.
248.

Paragraph 248 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
249.

Paragraph 249 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
CLAIMS ON BEHALF OF THE FLORIDA SUBCLASSCOUNT 10FLORIDA DECEPTIVE AND UNFAIR TRADE PRACTICES ACT,Fla. Stat. §§ 501.201, et seq.
Against All Defendants
250.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.

45

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 46 of 63 PageID# 15094

251.

Paragraph 251 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
252.

Paragraph 252 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
253.

Paragraph 253 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 253 of the Complaint.
254.

Paragraph 254 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
255.

Paragraph 255 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 255 of the Complaint.
256.

Paragraph 256 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding Capital One in paragraph 256 of the Complaint and on that basis denies
them. Amazon denies the remaining allegations of paragraph 256 of the Complaint.
257.

Paragraph 257 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.

46

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 47 of 63 PageID# 15095

CLAIMS ON BEHALF OF THE NEW YORK SUBCLASSCOUNT 11
NEW YORK GENERAL BUSINESS LAW,
N.Y. Gen. Bus. Law §§ 349, et seq.
Against All Defendants
258.

Amazon incorporates by reference its answers to paragraphs 1 through 257 of theComplaint as though fully stated herein.
259.

Paragraph 259 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 259 of the Complaint.
260.

Paragraph 260 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
261.

Paragraph 261 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
262.

Paragraph 262 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding Capital One in paragraph 262 of the Complaint and on that basis denies
them. Amazon denies the remaining allegations of paragraph 262 of the Complaint.
263.

Paragraph 263 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
264.

Paragraph 264 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
265.

Paragraph 265 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.

47

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 48 of 63 PageID# 15096

CLAIMS ON BEHALF OF THE TEXAS SUBCLASSCOUNT 12
DECEPTIVE TRADE PRACTICES—CONSUMER PROTECTION ACT,
Texas Bus. & Com. Code §§ 17.41, et seq.
Against All Defendants
266.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
267.

Paragraph 267 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits that
Amazon.com, Inc. and Amazon Web Services, Inc. are both corporations..
268.

Paragraph 268 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
269.

Paragraph 269 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
270.

Paragraph 270 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
271.

Paragraph 271 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 271 of the Complaint.
272.

Paragraph 272 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
273.

Paragraph 273 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.

48

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 49 of 63 PageID# 15097

274.

Paragraph 274 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 274 of the Complaint.
275.

Paragraph 275 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 275 of the Complaint.
276.

Paragraph 275 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
277.

Amazon lacks sufficient knowledge or information to form a belief as to the truthof the allegations regarding Consumers in paragraph 277 of the Complaint and on that basis
denies them. Amazon denies the remaining allegations of paragraph 277 of the Complaint.
278.

Paragraph 278 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 278 of the Complaint.
279.

Paragraph 279 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 279 of the Complaint.
280.

Paragraph 280 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding Capital One in paragraph 280 of the Complaint and on that basis denies
them. Amazon denies the remaining allegations of paragraph 280 of the Complaint.

49

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 50 of 63 PageID# 15098

281.

Paragraph 281 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
282.

Paragraph 282 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
283.

Paragraph 283 of the Complaint contains argument and legal conclusions towhich no response is required.
CLAIMS ON BEHALF OF THE VIRGINIA SUBCLASSCOUNT 13
VIRGINIA PERSONAL INFORMATION BREACH NOTIFICATION ACT,
Va. Code. Ann. §§ 18.2-186.6, et seq.
Against All Defendants
284.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
285.

Paragraph 285 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon maintains that theVirginia Personal Information Breach Notification Act speaks for itself and denies paragraph 285
of the Complaint to the extent that it misrepresents the Virginia Personal Information Breach
Notification Act. Amazon denies that Plaintiffs’ characterization and paraphrasing of these
documents is accurate and denies Plaintiffs’ framing of these issues.
286.

Paragraph 286 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them to theextent they are directed at Amazon.
287.

Paragraph 287 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficient50

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 51 of 63 PageID# 15099

knowledge or information to form a belief as to the truth of the allegations in paragraph 287 of
the Complaint and on that basis denies them.
288.

Paragraph 288 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 288 of the Complaint to the extent they
are directed at Amazon.
289.

Paragraph 289 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 289 of the Complaint.
290.

Paragraph 290 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
291.

Paragraph 291 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits that theComplaint purports to seek relief under Va. Code Ann. § 18.2-186.6(I) and denies that Plaintiffs
are entitled to any such relief.
CLAIMS ON BEHALF OF THE WASHINGTON SUBCLASSCOUNT 14WASHINGTON DATA BREACH NOTICE ACT,Wash. Rev. Code §§ 19.255.010, et seq.
Against All Defendants
292.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
293.

Paragraph 293 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them to theextent they are directed at Amazon.

51

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 52 of 63 PageID# 15100

294.

Paragraph 294 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon lacks sufficientknowledge or information to form a belief as to the truth of the allegations in paragraph 294 of
the Complaint and on that basis denies them.
295.

Paragraph 295 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon maintains that the
Washington Data Breach Notice Act speaks for itself and denies paragraph 295 of the Complaint
to the extent that it misrepresents the Washington Data Breach Notice Act. Amazon denies that
Plaintiffs’ characterization and paraphrasing of these documents is accurate and denies Plaintiffs’
framing of these issues.
296.

Paragraph 296 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 296 of the Complaint.
297.

Paragraph 297 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
298.

Paragraph 298 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
299.

Paragraph 299 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits that theComplaint purports to seek relief under Wash. Rev. Code §§ 19.255.010(13)(a) and19.255.010(13)(b) and denies that Plaintiffs are entitled to any such relief.

52

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 53 of 63 PageID# 15101

COUNT 15WASHINGTON CONSUMER PROTECTION ACT
Wash. Rev. Code Ann. §§ 19.86.020, et seq.
300.

Amazon incorporates by reference its answers to paragraphs 1 through 157 of theComplaint as though fully stated herein.
301.

Paragraph 301 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon that Amazon.com,
Inc. and Amazon Web Services, Inc. are corporations.
302.

Paragraph 302 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 302 of the Complaint.
303.

Paragraph 303 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 303 of the Complaint.
304.

Paragraph 304 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
305.

Paragraph 305 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon denies the remaining allegations of paragraph 305 of the Complaint.
306.

Amazon maintains that the Washington Consumer Protection Act speaks for itself

and denies Paragraph 306 of the Complaint to the extent that it misrepresents the Washington
Consumer Protection Act. Paragraph 306 of the Complaint contains argument and legal
conclusions to which no response is required. To the extent a response is required, Amazon
denies them.

53

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 54 of 63 PageID# 15102

307.

Paragraph 307 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon denies them.
Amazon lacks sufficient knowledge or information to form a belief as to the truth of theallegations regarding Capital One in paragraph 307 of the Complaint and on that basis denies
them. Amazon denies the remaining allegations of paragraph 307 of the Complaint.
308.

Paragraph 308 of the Complaint contains argument and legal conclusions towhich no response is required. To the extent a response is required, Amazon admits theComplaint purports to seek monetary and non-monetary relief and deny that Plaintiffs areentitled to any relief.
ANSWER TO PLAINTIFFS’ PRAYER FOR RELIEF
Amazon denies that Plaintiffs or class members are entitled to the relief they request or
any relief whatsoever individually or on behalf of the purported class. Amazon specificallydenies each of the requests for relief enumerated in the Complaint.
JURY DEMAND
Amazon demands trial by jury on each purported claim for relief, cause of action, andaffirmative defense at issue.
GENERAL DENIAL
Unless expressly admitted above, Amazon denies each and every allegation set forth inPlaintiffs’ Complaint.
AFFIRMATIVE DEFENSES
Amazon further pleads the following separate and additional defenses to the Complaint.
By pleading these defenses, Amazon does not in any way agree or concede that it has the burdenof proof or persuasion on any of these claims or defenses or that is liable for any claims against
it.

54

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 55 of 63 PageID# 15103

FIRST DEFENSE(Failure to State a Claim)
Each purported cause of action in the Complaint fails to state a claim upon which relief
can be granted against Amazon.
SECOND DEFENSE(Lack of Causation)
Plaintiffs’ claims are barred, in whole or in part, to the extent that Amazon’s conduct was
not the actual or proximate cause of any alleged damage suffered by Plaintiffs.
THIRD DEFENSE(Intervening, Superseding or Primary Cause)
Plaintiffs’ and putative class’s damages, if any, were caused by superseding orintervening causes, including the intentional criminal conduct of Paige Thompson, and thus any
damages were not actually or proximately caused by Amazon.
FOURTH DEFENSE(No Injury or Damages)
Plaintiffs’ claims are barred, in whole or in part, because Plaintiffs have not suffered any
injury or damages as a result of Amazon’s alleged conduct.
FIFTH DEFENSE(Lack of Standing)Plaintiffs’ claims are barred, in whole or in part, because Plaintiffs lack standing to bringsome or all of their claims.
SIXTH DEFENSE(Class Cannot Be Certified)
The purported class cannot be certified under Federal Rule of Civil Procedure 23 because
the purported class, class representative, and/or class counsel fail to meet the typicality,commonality, adequacy, superiority, and/or predominance requirements for class actions.

55

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 56 of 63 PageID# 15104

SEVENTH DEFENSE(Failure to Mitigate Damages)
For each purported cause of action, Plaintiffs and putative class members have failed tomitigate any damages or claimed harm complained of in the Complaint, if any.
EIGHTH DEFENSE(Consent/Acquiescence)
Plaintiffs’ and the putative class’ express or implied consent to Capital One’s storing of
personal data on Amazon’s cloud computing platform bars them from bringing claims.
NINTH DEFENSE(Waiver/Release)
Each cause of action contained in the Complaint is barred because Plaintiffs and theputative class have waived the causes of action now asserted.
TENTH DEFENSE(Estoppel)
On information and belief, Amazon alleges that Plaintiffs are estopped from asserting
claims or seeking relief from Amazon as a result of Plaintiffs’ conduct and activities with respect
to the subject of this litigation.
ELEVENTH DEFENSE(Lack of Knowledge)
Each purported cause of action in the Complaint is barred by Amazon’s lack ofknowledge regarding the configurations of the relevant components and contents of Capital
One’s cloud environment.
TWELFTH DEFENSE(No Volitional Act)
Each purported cause of action contained in the Complaint is barred by the lack of any
volitional act by Amazon resulting in any harm to Plaintiffs and the putative class.

56

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 57 of 63 PageID# 15105

THIRTEENTH DEFENSE(Lack of Culpable Intent or Willfulness)
Each purported cause of action contained in the Complaint requiring the element of intent
is barred because of the Plaintiffs’ failure to show that Amazon engaged in any willful unlawful
conduct or otherwise took any unlawful action with culpable intent.
FOURTEENTH DEFENSE(Contractual Defenses)
Plaintiffs' claims are barred, in whole or in part, by the contractual terms they entered intowith Capital One, as well as the terms of the contract between Capital One and Amazon.
FIFTEENTH DEFENSE(Choice of Law)
Plaintiffs’ claims are barred to the extent any cause of action lies outside of Virginia law
and the doctrine of lex doci delicti. Virginia law applies because Virginia is the place where thelast event related to the alleged tortious harm occurred. Plaintiffs foreign state law claims are
barred because those laws do not apply to conduct occurring in Virginia.
SIXTEENTH DEFENSE(No Injunctive or Declaratory Relief)
For each purported cause of action in the Complaint, Plaintiffs fail to properly state aclaim for injunctive or declaratory relief.
SEVENTEETH DEFENSE(No Punitive Damages)
To the extent Plaintiffs and the putative class members recover penalties in this action,
they state no basis in the Complaint that would allow them to recover punitive damages.
EIGHTEENTH DEFENSE(Excessive Fines)
To the extent Plaintiffs and the putative class members recover penalties in this action,
they cannot recover a cumulative amount of damages (including statutory damages) that exceeds

57Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 58 of 63 PageID# 15106

the limitations on excessive fines under due process.
NINETEENTH DEFENSE(Attorneys’ Fees Improper)
The Complaint fails to state a cause of action or set forth facts sufficient to support a
claim for attorneys’ fees.
TWENTIETH DEFENSE(Economic Loss Rule)
Plaintiffs’ claims are barred, in whole or in part, by the economic loss rule and/or thesource of duty rule.
TWENTY-FIRST DEFENSE(Failure to Join Necessary Parties)
Plaintiffs’ claims fail, in whole or in part, to the extent necessary and indispensable
parties to this action have not been joined under Federal Rule of Civil Procedure 19, prohibiting
this action from proceeding in equity and good conscience among the parties presently before the
Court. Defendants specifically reserve the right to implead such parties.
TWENTY-SECOND DEFENSE(Unconstitutionality)
Plaintiffs’ claims under foreign state consumer protection or deceptive trade practice laws
are barred by the Dormant Commerce Clause and the Due Process Clause of the United States
Constitution.
TWENTY-THIRD DEFENSE(Failure to Satisfy Statutory Conditions)
Plaintiffs’ claims fail, in whole or in part, for failure to satisfy conditions precedent tosuing under the laws on which Plaintiffs base some or all of their claims, including but notlimited to Plaintiffs’ failure to provide requisite written demands.

58

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 59 of 63 PageID# 15107

TWENTY-FOURTH DEFENSE(No Recovery Exceeding Statutory Caps)
Plaintiffs are barred from recovering in excess of any statutory caps on punitive damages
that may apply in this action, including, but not limited to, Fla. Stat. § 768.73, Tex. Civ. Prac. &Rem. § 41.008, and Va. Code § 8.01-38.1.
TWENTY-FIFTH DEFENSE(Good Faith Compliance)
Amazon at all times acted in good faith and in compliance with applicable laws andregulations.
TWENTY-SIXTH DEFENSE(Speculative Damages)
Plaintiffs’ claims are barred because Plaintiffs’ alleged damages, if any, were notreasonably foreseeable and because Plaintiffs’ alleged damages are supported only with
speculation and conjecture.
TWENTY-SEVENTH DEFENSE(No Duty of Care)
Under applicable law, Amazon does not owe a common law duty of care to Plaintiffs.
TWENTY-EIGHTH DEFENSE(No Retroactive Duty of Care)
Plaintiffs’ negligence claims are barred because any common law duty of care recognizedby the Court cannot be applied retroactively to conduct that occurred before the duty existed or
was recognized.
TWENTY-NINTH DEFENSE(Lack of Notice of Any Duty of Care)
Plaintiffs’ negligence claim is barred by the Due Process Clause of the United States
Constitution because Amazon lacked notice of a common law duty of care.

59

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 60 of 63 PageID# 15108

THIRTIETH DEFENSE(Lack of Privity)
Plaintiffs’ claims fail, in whole or in part, due to a lack of privity with Amazon.
THIRTY-FIRST DEFENSE(No Representative Capacity for State Law Claims)
Plaintiffs’ claims fail in part because Plaintiffs cannot maintain claims in a representative
capacity under their state-law statutory causes of action.
THIRTY-SECOND DEFENSE(No Private Right of Action)
Plaintiffs’ claims fail to the extent the statutes or regulations upon which Plaintiffs rely
do not provide individuals with a private right of action, including but not limited to Section 5 of
the Federal Trade Commission Act and any “similar state statutes,” which provide no privateright of action or basis for any negligence per se claim.
THIRTY-THIRD DEFENSE(Failure to Plead Fraud with Particularity)
Plaintiffs’ Complaint fails to plead claims that sound in fraud with particularity.
RESERVATION OF ADDITIONAL DEFENSES
Amazon does not presently know all facts concerning the conduct and claims of Plaintiffs
and the putative class sufficient to state all affirmative defenses at this time. Amazon will seek
leave of this Court to amend this Answer should it later discover facts demonstrating theexistence of additional affirmative defenses. Amazon reserves any and all additional affirmative
defenses available to it.
DEMAND FOR JURY TRIAL
Amazon demands trial by jury on each purported claim for relief, cause of action, andaffirmative defense at issue.

60

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 61 of 63 PageID# 15109

AMAZON’S PRAYER FOR RELIEF
WHEREFORE, Amazon prays for judgment with respect to Plaintiffs’ Complaint andAmazon’s defenses as follows:a. A judgment in Amazon’s favor denying Plaintiffs all relief requested in the
Complaint and dismissing the Complaint with prejudice;b. For an award of costs to Amazon; andc. Such other relief as the Court shall deem just and proper.

61

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 62 of 63 PageID# 15110

Respectfully submitted,

Dated: October 28, 2020

/s/ Robert R. Vieth
Robert R. Vieth, Esq. (VSB No. 24304)
HIRSCHLER FLEISCHER, PC
8270 Greensboro Drive, Suite 700
Tysons Corner, VA 22102
Telephone:(703) 584-8366
Facsimile:(703) 584-8901
Email:
rvieth@hf-law.com
Local counsel for Defendants Amazon.com, Inc.
and Amazon Web Services, Inc.
Laurence F. Pulgram, Esq. (admitted pro hac vice)
Jedediah Wakefield, Esq. (admitted pro hac vice)
Tyler G. Newby, Esq. (admitted pro hac vice)
Vincent Barredo, Esq. (admitted pro hac vice)
Andrew M. Lewis, Esq. (admitted pro hac vice)
Janie Y. Miller, Esq. (admitted pro hac vice)
Meghan E. Fenzel, Esq. (admitted pro hac vice)
Sarah V. Lightstone, Esq. (admitted pro hac vice)
FENWICK & WEST LLP
555 California Street, 12th Floor
San Francisco, CA 94104
Telephone: (415) 875-2300
Facsimile: (415) 281-1350
Email: lpulgram@fenwick.com
jwakefield@fenwick.com
tnewby@fenwick.com
vbarredo@fenwick.com
alewis@fenwick.com
jmiller@fenwick.com
mfenzel@fenwick.com
slightstone@fenwick.com
Counsel for Defendants Amazon.com, Inc. andAmazon Web Services, Inc.

62

Case 1:19-md-02915-AJT-JFA Document 977 Filed 10/28/20 Page 63 of 63 PageID# 15111

CERTIFICATE OF SERVICE
I hereby certify that on this 28th day of October, 2020, the foregoing AMAZON
DEFENDANTS’ ANSWER TO THE SECOND AMENDED REPRESENTATIVECONSUMER CLASS ACTION COMPLAINT was filed electronically with the Clerk of thisCourt using the CM/ECF system which will send a notice of electronic filing to all registeredcounsel of record.
/s/ Robert R. Vieth
Robert R. Vieth, Esq. (VSB No. 24304)
HIRSCHLER FLEISCHER, PC
8270 Greensboro Drive, Suite 700
Tysons, Virginia 22102
T: (703) 584-8366
F: (703) 584-8901
Email: rvieth@hirschlerlaw.com
Local Counsel for Defendants Amazon.com, Inc.
and Amazon Web Services, Inc.

63