Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 1 of 45 PageID# 20218

IN THE UNITED STATES DISTRICT COURTFOR THE EASTERN DISTRICT OF VIRGINIAALEXANDRIA DIVISIONIN RE: CAPITAL ONE CONSUMERDATA SECURITY BREACH LITIGATION)))MDL No. 1:19md2915 (AJT/JFA)JURY TRIAL DEMANDEDThis Document Relates to the Consumer Cases
CAPITAL ONE DEFENDANTS’ AMENDED ANSWER TO THE SECOND AMENDED
REPRESENTATIVE CONSUMER CLASS ACTION COMPLAINT
Defendants Capital One Financial Corporation, Capital One Bank (USA), National
Association, and Capital One, National Association (collectively, “Capital One”) jointly submit
their Amended Answer and Defenses to the Second Amended Representative Consumer Class
Action Complaint [Dkt. No. 971] (the “Complaint”).
ANSWER
The cover page of the Complaint, the first paragraph on page 1 of the Complaint, theparagraphs under the heading “Preamble” on pages 1 to 2 of the Complaint, and headings andsubheadings appearing throughout the Complaint do not contain allegations to which a responseis required. To the extent those portions of the Complaint contain any allegations to which a
response is required, Capital One denies the allegations. In response to the allegations in thenumbered paragraphs of the Complaint, Capital One responds as follows:1.

Capital One admits that on July 29, 2019, Capital One issued the “July 29 Form

8-K” cited and referenced in this paragraph, which announced a cybersecurity incident (the“Cybersecurity Incident”) potentially affecting approximately 100 million individuals in the
United States and approximately 6 million in Canada. Capital One denies the allegations in thisparagraph to the extent they are inconsistent with Capital One’s public disclosures, and Capital
One denies any remaining allegations in this paragraph.

1Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 2 of 45 PageID# 20219

2.

Capital One admits, consistent with its public disclosures, that the largest categoryof information accessed in the Cybersecurity Incident was information on consumers and small
businesses as of the time they applied for a Capital One credit card product from 2005 throughearly 2019. That information included personal information Capital One routinely collects at thetime it receives credit card applications, including names, addresses, zip codes/postal codes,
phone numbers, email addresses, dates of birth, and self-reported income. Capital One further
admits that the information accessed in the Cybersecurity Incident also includes certain customer
status data (such as credit scores, credit limits, balances, payment history, and contact
information), fragments of transaction data from a total of 23 days during 2016, 2017 and 2018,
approximately 140,000 Social Security numbers of Capital One credit card customers, andapproximately 80,000 linked bank account numbers of Capital One secured credit cardcustomers. Capital One denies the allegations in this paragraph to the extent they areinconsistent with Capital One’s public disclosures, and Capital One denies any remaining
allegations in this paragraph.
3.

Capital One denies the allegations in this paragraph.

4.

With respect to the first sentence of this paragraph, which purports to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. With respect to the second sentence of this paragraph, which purports to quote a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.

2

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 3 of 45 PageID# 20220

5.

With respect to the portion of this paragraph that purports to quote a cited source,

Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
6.

Capital One admits that at least one putative class member is of diverse

citizenship from one defendant and that the Complaint seeks in excess of $5 million, exclusive ofinterest and costs. The remaining allegations in this paragraph contain legal conclusions towhich no response is necessary. To extent a response is necessary to any remaining allegationsin this paragraph, Capital One denies the allegations.
7.

Capital One admits that the Court has personal jurisdiction over it in this matter,that Capital One’s principal place of business is located within this District, and that Capital One
is authorized to and does conduct business in Virginia. The remaining allegations in thisparagraph contain legal conclusions to which no response is necessary. To extent a response isnecessary to any remaining allegations in this paragraph, Capital One denies the allegations.
8.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph pertaining to parties other than Capital One anddenies those allegations on that basis. Capital One denies any remaining allegations in thisparagraph.
9.

Capital One admits that venue is proper within this District and that Capital One’s

principal place of business is located within this District. Capital One denies the remaining
allegations in this paragraph. Capital One is without knowledge or information sufficient toform a belief as to the truth of the allegations in this paragraph pertaining to parties other than3

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 4 of 45 PageID# 20221

Capital One and denies those allegations on that basis. Capital One denies any remaining
allegations in this paragraph.
10.

Capital One admits that Capital One Financial Corporation is a diversified

financial services holding company with banking and non-banking subsidiaries, that Capital One
Financial Corporation’s principal place of business is in McLean, Virginia, and that Capital One
Financial Corporation is incorporated under the laws of Delaware. Capital One denies any
remaining allegations in this paragraph.
11.

Capital One admits that Capital One, N.A. is a national bank with its principal

place of business in McLean, Virginia and that Capital One, N.A. is a wholly-owned subsidiaryof Capital One Financial Corporation. Capital One denies any remaining allegations in thisparagraph.
12.

Capital One admits that Capital One Bank (USA), N.A. is a national bank with its

principal place of business in McLean, Virginia and that Capital One Bank (USA), N.A. is awholly-owned subsidiary of Capital One Financial Corporation. Capital One denies any
remaining allegations in this paragraph.
13.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph pertaining to parties other than Capital One anddenies those allegations on that basis. Capital One denies any remaining allegations in thisparagraph.
14.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph pertaining to parties other than Capital One anddenies those allegations on that basis. Capital One denies any remaining allegations in thisparagraph.

4

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 5 of 45 PageID# 20222

15.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph pertaining to parties other than Capital One anddenies those allegations on that basis. Capital One denies any remaining allegations in thisparagraph.
16.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph pertaining to parties other than Capital One anddenies those allegations on that basis. Capital One denies any remaining allegations in thisparagraph.
17.

Capital One denies the allegations in this paragraph.

18.

Capital One admits that Plaintiff Hausauer applied for and used a personal Capital

One credit card, a business credit card, and a business checking and savings account, and that heprovided certain PII to Capital One in connection therewith. Capital One admits that it sent
Plaintiff Hausauer a letter dated August 7, 2019. That letter speaks for itself, and to the extent
the allegations misquote, misconstrue, or mischaracterize that letter, the allegations are denied.
Capital One is without knowledge or information sufficient to form a belief as to the truth of theremaining allegations in this paragraph pertaining to Plaintiff Hausauer and denies thoseallegations on that basis. Capital One denies any remaining allegations in this paragraph.
19.

Capital One admits that Plaintiff Tada applied for and used a Capital One credit

card, and that she provided certain PII to Capital One in connection therewith. Capital One iswithout knowledge or information sufficient to form a belief as to the truth of the remaining
allegations in this paragraph pertaining to Plaintiff Tada and denies those allegations on thatbasis. Capital One denies any remaining allegations in this paragraph.

5Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 6 of 45 PageID# 20223

20.

Capital One admits that Plaintiff Behar applied for and used a Capital One credit

card, and that she provided certain PII to Capital One in connection therewith. Capital One
admits that it sent Plaintiff Behar a letter dated August 7, 2019. That letter speaks for itself, andto the extent the allegations misquote, misconstrue, or mischaracterize that letter, the allegations
are denied. Capital One is without knowledge or information sufficient to form a belief as to thetruth of the remaining allegations in this paragraph pertaining to Plaintiff Behar and denies thoseallegations on that basis. Capital One denies any remaining allegations in this paragraph.
21.

Capital One admits that Plaintiff Zielicke applied for and used a Capital One

credit card, and that he provided certain PII to Capital One in connection therewith. Capital One
is without knowledge or information sufficient to form a belief as to the truth of the remaining
allegations in this paragraph pertaining to Plaintiff Zielicke and denies those allegations on thatbasis. Capital One denies any remaining allegations in this paragraph.
22.

Capital One admits that Plaintiff Gershen applied for and used a Capital One

credit card, and that she provided certain PII to Capital One in connection therewith. Capital
One further admits that it sent Plaintiff Gershen a September 27, 2019 letter entitled “Update
About the Capital One Data Security Incident.” Capital One is without knowledge orinformation sufficient to form a belief as to the truth of the remaining allegations in thisparagraph pertaining to Plaintiff Gershen and denies those allegations on that basis. Capital One
denies any remaining allegations in this paragraph.
23.

Capital One admits that Plaintiff Edmondson applied for and used a Capital One

credit card, and that she provided certain PII to Capital One in connection therewith. Capital
One is without knowledge or information sufficient to form a belief as to the truth of the6Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 7 of 45 PageID# 20224

remaining allegations in this paragraph pertaining to Plaintiff Edmondson and denies thoseallegations on that basis. Capital One denies any remaining allegations in this paragraph.
24.

Capital One admits that Plaintiff Spacek applied for and used a Capital One credit

card, and that he provided certain PII to Capital One in connection therewith. Capital One iswithout knowledge or information sufficient to form a belief as to the truth of the remaining
allegations in this paragraph pertaining to Plaintiff Spacek and denies those allegations on thatbasis. Capital One denies any remaining allegations in this paragraph.
25.

Capital One admits that Plaintiff Sharp applied for and used a Capital One credit

card, and that she provided certain PII to Capital One in connection therewith. Capital One
further admits that it sent Plaintiff Sharp a January 11, 2020 letter entitled “Update About the
Capital One Data Security Incident.” Capital One is without knowledge or information sufficient
to form a belief as to the truth of the remaining allegations in this paragraph pertaining to
Plaintiff Sharp and denies those allegations on that basis. Capital One denies any remaining
allegations in this paragraph.
26.

Capital One admits the allegations in the first sentence of this paragraph. With

respect to the remaining allegations in this paragraph, which purport to describe or characterize
Capital One’s 2018 Annual Report, Capital One states that the cited source speaks for itself, andto the extent the allegations misquote, misconstrue, or mischaracterize that source, theallegations are denied.
27.

Capital One admits that it may collect certain information from consumers andsmall business that apply for credit from Capital One, including an applicant’s name, date ofbirth, social security number, address, phone number, income, account-related data, loan details,
vehicle or property information, and transaction data. Capital One admits that it uses this7

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 8 of 45 PageID# 20225

information to provide, maintain, and service customer accounts, including in setting the terms
on which Capital One agreed to extend credit. Capital One denies any remaining allegations inthis paragraph28.

Capital One admits that it uses consumer information for certain businesspurposes, including certain marketing, and certain product development and improvement.
Capital One denies any remaining allegations in this paragraph.
29.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
30.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
31.

Capital One admits that throughout the 1990s and 2000s, its business processes

became increasingly digitized. With respect to the remaining allegations in this paragraph,
which purport to describe or characterize a cited source, Capital One states that the cited source
speaks for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize thatsource, the allegations are denied. Capital One denies any remaining allegations in thisparagraph.
32.

Capital One denies the allegations in this paragraph.

33.

Capital One admits the allegations in the first sentence of this paragraph. With

respect to the allegations in the second sentence of this paragraph, which purport to describe or8Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 9 of 45 PageID# 20226

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
34.

Capital One denies the allegations in this paragraph.

35.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph and denies those allegations on that basis.
36.

With respect to the first and second sentences of this paragraph, which purport todescribe or characterize cited sources, Capital One states that the cited sources speak forthemselves, and to the extent the allegations misquote, misconstrue, or mischaracterize thosesources, the allegations are denied. Capital One denies any remaining allegations in thisparagraph.
37.

Capital One admits that, in 2015, it announced that it intended to transition certain

computing functions from private data centers to the public cloud. Capital One further admits
that, in 2016, it announced that it would make AWS its predominant public cloud provider.
Capital One denies any remaining allegations in this paragraph.
38.

Capital One denies the allegations in the first sentence of this paragraph. With

respect to the second sentence of this paragraph, which purports to describe or characterize acited source, Capital One states that the cited source speaks for itself, and to the extent theallegations misquote, misconstrue, or mischaracterize that source, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
39.

Capital One denies the allegations in this paragraph.

40.

Capital One denies the allegations in this paragraph.

9Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 10 of 45 PageID# 20227

41.

With respect to this paragraph, which purports to describe or characterize a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied.
42.

Capital One admits that, in October 2015, its Chief Information Officer Rob

Alexander gave a keynote address at an Amazon-sponsored industry event called “AWS
re:Invent 2015.” With respect to the second and third sentences of this paragraph, which purport
to describe or characterize a cited source, Capital One states that the cited source speaks foritself, and to the extent the allegations misquote, misconstrue, or mischaracterize that source, theallegations are denied.
43.

Capital One denies the allegations in this paragraph.

44.

Capital One denies the allegations in the first, second, third, and fourth sentencesof this paragraph. With respect to the fifth sentence of this paragraph, which purports to describeor characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
45.

Capital One denies the allegations in this paragraph.

46.

With respect to the allegations in this paragraph that purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
47.

Capital One admits that a web application firewall is designed to block

unauthorized access while permitting authorized access. Capital One denies any remaining
allegations in this paragraph.

10

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 11 of 45 PageID# 20228

48.

Capital One denies the allegations in this paragraph.

49.

Capital One denies the allegations in this paragraph.

50.

Capital One denies the allegations in this paragraph.

51.

Capital One denies the allegations in this paragraph.

52.

Capital One denies the allegations in the first sentence of this paragraph. With

respect to the second sentence of this paragraph, which purports to describe or characterize citedsources, Capital One states that the cited sources speak for themselves, and to the extent theallegations misquote, misconstrue, or mischaracterize those sources, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
53.

With respect to this paragraph, which purports to describe or characterize a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
54.

With respect to this paragraph, which purports to describe or characterize citedsources, Capital One states that the cited sources speak for themselves, and to the extent theallegations misquote, misconstrue, or mischaracterize those sources, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
55.

With respect to this paragraph, which purports to describe or characterize a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
56.

With respect to the first sentence of this paragraph, which purports to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to the11Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 12 of 45 PageID# 20229

extent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
57.

With respect to this paragraph, which purports to describe or characterize citedsources, Capital One states that the cited sources speak for themselves, and to the extent theallegations misquote, misconstrue, or mischaracterize those sources, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
58.

Capital One denies the allegations in the first and second sentences of thisparagraph. With respect to the third sentence of this paragraph, which purports to describe or
characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
59.

Capital One denies the allegations in this paragraph.

60.

Capital One admits that, on July 29, 2019, Capital One filed a report on Form 8-K

with the Securities and Exchange Commission. With respect to the alleged content of said
report, which purports to describe or characterize a cited source, Capital One states that the citedsource speaks for itself, and to the extent the allegation misquotes, misconstrues, ormischaracterizes that source, the allegation is denied. Capital One denies any remaining
allegations in this paragraph.
61.

Capital One admits that Paige A. Thompson (a/k/a “erratic”) is the perpetrator

responsible for the Cybersecurity Incident, that the Federal Bureau of Investigation (“FBI”) filed
a criminal complaint against Thompson alleging that Thompson committed computer fraud andabuse in violation of 18 U.S.C. § 1030(a)(2) in perpetrating the Cybersecurity Incident, and that
Thompson was arrested by the FBI on July 29, 2019 and charged by federal prosecutors in the12Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 13 of 45 PageID# 20230

United States District Court for the Western District of Washington in connection therewith.
With respect to the remaining allegations in the first sentence of this paragraph, which purport todescribe or characterize a cited source, Capital One states that the cited source speaks for itself,
and to the extent the allegations misquote, misconstrue, or mischaracterize that source, theallegations are denied. With respect to the allegations in the second sentence of this paragraph,
Capital One is without knowledge or information sufficient to form a belief as to the truth ofsuch allegations and denies those allegations on this basis. Capital One denies any remaining
allegations in this paragraph.
62.

Capital One denies the allegations in the first sentence of this paragraph. With

respect to the allegations in the second sentence of this paragraph, which purport to describe or
characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
63.

Capital One admits that the intrusion occurred through a misconfigured web

application firewall that Capital One was using as part of its operations hosted in the cloud with
AWS. Capital One denies any remaining allegations in this paragraph.
64.

Capital One admits that, in undertaking to utilize Amazon’s cloud services,

Capital One worked with certain groups within Amazon. With respect to the allegations in thisparagraph that purport to describe or characterize a cited source, Capital One states that the citedsource speaks for itself, and to the extent the allegations misquote, misconstrue, ormischaracterize that source, the allegations are denied. Capital One denies any remaining
allegations in this paragraph.

13

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 14 of 45 PageID# 20231

65.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
66.

Capital One admits that, in connection with the Cybersecurity Incident, thecommands functioned to obtain security credentials on the AWS cloud environment and thatthese commands were used to extract data. With respect to the allegations in this paragraph that
purport to describe or characterize a cited source, Capital One states that the cited source speaks
for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize that source,
the allegations are denied. Capital One denies any remaining allegations in this paragraph.
67.

Capital One admits that the List Buckets Command was executed on April 21,

2019. With respect to the allegations in this paragraph that purport to describe or characterize acited source, Capital One states that the cited source speaks for itself, and to the extent theallegations misquote, misconstrue, or mischaracterize that source, the allegations are denied.
Capital One is without knowledge or information sufficient to form a belief as to the truth of theremaining allegations and denies the same on this basis.
68.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
69.

Capital One denies any remaining allegations in this paragraph.

14

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 15 of 45 PageID# 20232

70.

Capital One admits that the intrusion was sophisticated, at least in part because of

the hacker’s abilities and the manner in which she performed the intrusion. Capital One denies
any remaining allegations in this paragraph.
71.

Capital One admits that, after discovering the Cybersecurity Incident, it

immediately fixed the configuration vulnerability that the hacker exploited. Capital One denies
any remaining allegations in this paragraph.
72.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
73.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source or sources, Capital One states that the cited sources speak forthemselves, and to the extent the allegations misquote, misconstrue, or mischaracterize thosesources, the allegations are denied. Capital One denies any remaining allegations in thisparagraph.
74.

Capital One denies the allegations in this paragraph.

75.

With respect to the allegations in the second, third, and fourth sentences of thisparagraph, which purpose to describe or characterize a cited source, Capital One states that thecited source speaks for itself, and to the extent the allegations misquote, misconstrue, ormischaracterize those sources, the allegations are denied. Capital One denies any remaining
allegations in this paragraph.
76.

Capital One denies the allegations in this paragraph.

15

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 16 of 45 PageID# 20233

77.

With respect to the allegations in the first sentence of this paragraph, which

purport to describe or characterize a cited source, Capital One states that the cited source speaks
for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize that source,
the allegations are denied. Capital One denies any remaining allegations in this paragraph.
78.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
79.

With respect to the allegations in this paragraph, which purport to describe or

characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
80.

With respect to the allegations in this paragraph, which purport to describe or

characterize cited sources, Capital One states that the cited sources speak for themselves, and to
the extent the allegations misquote, misconstrue, or mischaracterize those sources, the allegations
are denied. Capital One denies any remaining allegations in this paragraph.
81.

Capital One denies the allegations in this paragraph.

82.

Capital One denies the allegations in this paragraph.

83.

Capital One denies the allegations in this paragraph.

84.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.

16

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 17 of 45 PageID# 20234

85.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
86.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
87.

Capital One denies the allegations in this paragraph.

88.

Capital One denies the allegations in this paragraph.

89.

Capital One admits that banks are targets for cyber attacks. Capital One denies

any remaining allegations in this paragraph.
90.

Capital One denies the allegations in the first sentence of this paragraph. With

respect to the second sentence of this paragraph, which purports to describe and quote from acited source, Capital One states that the cited source speaks for itself, and to the extent theallegations misquote, misconstrue, or mischaracterize that source, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
91.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
92.

With respect to the first sentence of this paragraph, which purports to quote froma cited source, Capital One states that the cited source speaks for itself, and to the extent the17Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 18 of 45 PageID# 20235

allegations misquote, misconstrue, or mischaracterize that source, the allegations are denied.
With respect to the second sentence of this paragraph, which purports to describe and quote froma cited source, Capital One states that the cited source speaks for itself, and to the extent theallegations misquote, misconstrue, or mischaracterize that source, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
93.

With respect to this paragraph, which purports to describe or characterize a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
94.

Capital One denies the allegations in this paragraph.

95.

Capital One denies the allegations in this paragraph.

96.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
97.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
98.

With respect to this paragraph, which purports to quote a cited source, Capital

One states that the cited source speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that source, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.

18

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 19 of 45 PageID# 20236

99.

Capital One denies the allegations in this paragraph.

100.

Capital One admits that there are state and federal laws and requirements andindustry standards governing the protection of PII. Capital One denies any remaining allegationsin this paragraph.
101.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations. With respect
to the second sentence of this paragraph, which purports to quote a cited statute, Capital One
states that the cited statute speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that statute, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
102.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations. With respect
to the second sentence of this paragraph, which purports to quote or characterize a cited source,
Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
103.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. With respect to the second sentence of this paragraph, which purports to quote orcharacterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.

19

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 20 of 45 PageID# 20237

104.

With respect to this paragraph, which purports to quote or characterize a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
105.

With respect to this paragraph, which purports to quote or characterize a citedsource, Capital One states that the cited source speaks for itself, and to the extent the allegations
misquote, misconstrue, or mischaracterize that source, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
106.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations. Capital One
is without knowledge or information sufficient to form a belief as to the truth of the factual
allegations in this paragraph and denies those allegations on that basis. Capital One denies any
remaining allegations in this paragraph.
107.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations. With respect
to the second sentence of this paragraph, which purports to quote or characterize cited sources,
Capital One states that the cited sources speak for themselves, and to the extent the allegations
misquote, misconstrue, or mischaracterize those sources, the allegations are denied. Capital One
denies any remaining allegations in this paragraph.
108.

Capital One denies the allegations in this paragraph.

109.

Capital One admits that it is a participant organization in the Payment Card

Industry Security Standards Council. With respect to the remaining allegations in this paragraph,
which purport to quote or characterize a cited source, Capital One states that the cited source20Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 21 of 45 PageID# 20238

speaks for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize thatsource, the allegations are denied. Capital One denies any remaining allegations in thisparagraph.
110.

Capital One denies the allegations in this paragraph.

111.

Capital One denies the allegations in this paragraph.

112.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
113.

With respect to this paragraph, which purports to quote a cited statute, Capital

One states that the cited statute speaks for itself, and to the extent the allegations misquote,misconstrue, or mischaracterize that statute, the allegations are denied. Capital One denies any
remaining allegations in this paragraph.
114.

Capital One admits that it collects certain personal information from certain

persons and entities. The remaining allegations in this paragraph contain legal conclusions that
require no response. To the extent a response is required, Capital One denies the allegations.
115.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
116.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
117.

The first six sentences of this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations. With respect
to the same sentences of this paragraph, which purport to quote and characterize cited
regulations, Capital One states that the cited regulations speak for themselves, and to the extent

21

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 22 of 45 PageID# 20239

the allegations misquote, misconstrue, or mischaracterize those regulations, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
118.

The first sentence of this paragraph contains legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations. With respect
to the same sentence of this paragraph, which purport to quote and characterize cited statutes andregulations, Capital One states that the cited sources speak for themselves, and to the extent theallegations misquote, misconstrue, or mischaracterize those sources, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
119.

Capital One denies the allegations in this paragraph.

120.

Capital One denies the allegations in this paragraph.

121.

Capital One denies the allegations in this paragraph.

122.

Capital One denies the allegations in this paragraph.

123.

Capital One denies the allegations in this paragraph.

124.

Capital One denies the allegations in this paragraph.

125.

Capital One denies the allegations in this paragraph.

126.

Capital One denies the allegations in this paragraph.

127.

Capital One denies the allegations in the first sentence of this paragraph. Capital

One is without knowledge or information sufficient to form a belief as to the truth of theallegations in the remaining sentences of this paragraph and denies those allegations on thatbasis.
128.

Capital One denies the allegations in this paragraph.

129.

With respect to the allegations in this paragraph, which purport to describe or

characterize cited sources, Capital One states that the cited sources speak for themselves, and to22

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 23 of 45 PageID# 20240

the extent the allegations misquote, misconstrue, or mischaracterize those sources, the allegations
are denied. Capital One denies any remaining allegations in this paragraph.
130.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. With respect to the second sentence of this paragraph, which purports to describe or
characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
131.

Capital One denies the allegation in the first sentence of this paragraph that

“Capital One and Amazon trade on the value of consumers’ PII.” Capital One is without
knowledge or information sufficient to form a belief as to the truth of the allegation in the first
sentence that “consumers recognize the value of their PII and offer it in exchange for goods andservices” and of the allegations in the last three sentences and denies those allegations on thatbasis. The remaining allegations in this paragraph contain legal conclusions to which no
response is necessary. To extent a response is necessary to any remaining allegations in thisparagraph, Capital One denies the allegations.
132.

With respect to the allegations in this paragraph, which purport to describe or

characterize cited sources, Capital One states that the cited sources speak for themselves, and to
the extent the allegations misquote, misconstrue, or mischaracterize those sources, the allegations
are denied. Capital One denies any remaining allegations in this paragraph.
133.

With respect to the allegations in this paragraph, which purport to describe or

characterize cited sources, Capital One states that the cited sources speak for themselves, and to23

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 24 of 45 PageID# 20241

the extent the allegations misquote, misconstrue, or mischaracterize those sources, the allegations
are denied. Capital One denies any remaining allegations in this paragraph.
134.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first three sentences of this paragraph and denies thoseallegations on that basis. With respect to the remaining allegations in this paragraph, which
purport to describe or characterize a cited source, Capital One states that the cited source speaks
for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize that source,
the allegations are denied. Capital One denies any remaining allegations in this paragraph.
135.

The allegations in the first two sentences of this paragraph contain legal

conclusions to which no response is necessary. To the extent any response is necessary to theallegations in the first two sentences of this paragraph, Capital One is without knowledge orinformation sufficient to form a belief as to the truth of the allegations and denies thoseallegations on that basis. With respect to the remaining allegations in this paragraph, which
purport to describe or characterize a cited source, Capital One states that the cited source speaks
for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize that source,
the allegations are denied. Capital One denies any remaining allegations in this paragraph.
136.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first and last sentences of this paragraph and denies thoseallegations on that basis. With respect to the remaining allegations in this paragraph, which
purport to describe or characterize a cited source, Capital One states that the cited source speaks
for itself, and to the extent the allegations misquote, misconstrue, or mischaracterize that source,
the allegations are denied. Capital One denies any remaining allegations in this paragraph.

24

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 25 of 45 PageID# 20242

137.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. With respect to the remaining allegations in this paragraph, which purport to describeor characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied.
138.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. With respect to the remaining allegations in this paragraph, which purport to describeor characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
139.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. With respect to the remaining allegations in this paragraph, which purport to describeor characterize a cited source, Capital One states that the cited source speaks for itself, and to theextent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
140.

Capital One denies the allegations in this paragraph.

141.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. With respect to the remaining allegations in this paragraph, which purport to describeor characterize a cited source, Capital One states that the cited source speaks for itself, and to the25Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 26 of 45 PageID# 20243

extent the allegations misquote, misconstrue, or mischaracterize that source, the allegations are
denied. Capital One denies any remaining allegations in this paragraph.
142.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in the first sentence of this paragraph and denies those allegations onthat basis. Capital One denies the remaining allegations in this paragraph.
143.

Capital One denies the allegations in this paragraph.

144.

Capital One admits that, as to certain claims in this action, Plaintiffs purport tobring this action as a putative class action on behalf of the “Nationwide Class” described.
Capital One denies any remaining allegations in this paragraph.
145.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
146.

Capital One admits that, as to certain claims in this action, Plaintiffs purport tobring this action as a putative class action on behalf of the “State Subclasses” described. Capital
One denies any remaining allegations in this paragraph.
147.

Capital One admits that Plaintiffs purport to limit the putative “Nationwide Class”

and the putative “State Subclasses” as alleged. Capital One denies any remaining allegations inthis paragraph.
148.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
149.

Capital One denies the allegations in this paragraph.

150.

Capital One denies the allegations in this paragraph.

151.

Capital One denies the allegations in this paragraph.

152.

Capital One denies the allegations in this paragraph.

26

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 27 of 45 PageID# 20244

153.

Capital One denies the allegations in this paragraph.

154.

Capital One denies the allegations in this paragraph.

155.

Capital One denies the allegations in this paragraph.

156.

Capital One denies the allegations in this paragraph.

157.

Capital One denies the allegations in this paragraph.

158.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
159.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
160.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
161.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
162.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
163.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
164.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
165.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
166.

Capital One denies the allegations in this paragraph.

167.

Capital One denies the allegations in this paragraph.

27

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 28 of 45 PageID# 20245

168.

Capital One denies the allegations in this paragraph.

169.

Capital One denies the allegations in this paragraph.

170.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
171.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
172.

Capital One denies the allegations in this paragraph.

173.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
174.

Capital One denies the allegations in this paragraph.

175.

Capital One denies the allegations in this paragraph.

176.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
177.

Capital One denies the allegations in this paragraph.

178.

Capital One denies the allegations in this paragraph.

179.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
180.

Capital One denies the allegations in this paragraph.

181.

Capital One denies the allegations in this paragraph.

182.

Capital One denies the allegations in this paragraph.

183.

Capital One denies the allegations in this paragraph.

184.

Capital One denies the allegations in this paragraph.

185.

Capital One denies the allegations in this paragraph.

28

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 29 of 45 PageID# 20246

186.

Capital One denies the allegations in this paragraph.

187.

Capital One denies the allegations in this paragraph.

188.

Capital One denies the allegations in this paragraph.

189.

Capital One denies the allegations in this paragraph.

190.

Capital One denies the allegations in this paragraph.

191.

Capital One denies the allegations in this paragraph.

192.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
193.

Capital One denies the allegations in this paragraph.

194.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
195.

Capital One denies the allegations in this paragraph.

196.

Capital One denies the allegations in this paragraph.

197.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
198.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
199.

Capital One denies the allegations in this paragraph.

200.

Capital One denies the allegations in this paragraph.

201.

Capital One denies the allegations in this paragraph.

202.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.

29

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 30 of 45 PageID# 20247

203.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
204.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
205.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
206.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
207.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
208.

Capital One denies the allegations in this paragraph.

209.

Capital One denies the allegations in this paragraph.

210.

Capital One denies the allegations in this paragraph.

211.

Capital One denies the allegations in this paragraph.

212.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
213.

Capital One admits that its Privacy and Opt-Out Notice is incorporated byreference into the cardholder agreement that each Plaintiff entered into with Capital One.
Capital One is without knowledge or information sufficient to form a belief as to the truth of theallegations pertaining to “class members” and denies those allegations on that basis. Capital One
denies any remaining allegations in this paragraph.
214.

With respect to this paragraph, which purports to describe or characterize thereferenced Notice, Capital One states that the Notice speaks for itself, and to the extent the30

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 31 of 45 PageID# 20248

allegations misquote, misconstrue, or mischaracterize the Notice, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
215.

With respect to this paragraph, which purports to describe or characterize thereferenced Notice, Capital One states that the Notice speaks for itself, and to the extent theallegations misquote, misconstrue, or mischaracterize the Notice, the allegations are denied.
Capital One denies any remaining allegations in this paragraph.
216.

Capital One admits that each Plaintiff entered into a cardholder agreement with

Capital One. Capital One denies any remaining allegations in this paragraph.
217.

Capital One is without knowledge or information sufficient to form a belief as tothe truth of the allegations in this paragraph and denies those allegations on that basis.
218.

Capital One denies the allegations in this paragraph.

219.

Capital One denies the allegations in this paragraph.

220.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
221.

Capital One denies the allegations in this paragraph.

222.

Capital One denies the allegations in this paragraph.

223.

Capital One denies the allegations in this paragraph.

224.

Capital One denies the allegations in this paragraph.

225.

Capital One denies the allegations in this paragraph.

226.

Capital One denies the allegations in this paragraph.

227.

Capital One denies the allegations in this paragraph.

228.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.

31

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 32 of 45 PageID# 20249

229.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
230.

Capital One denies the allegations in this paragraph.

231.

Capital One denies the allegations in this paragraph.

232.

Capital One denies the allegations in this paragraph.

233.

Capital One denies the allegations in this paragraph.

234.

Capital One denies the allegations in this paragraph.

235.

Capital One denies the allegations in this paragraph.

236.

Capital One denies the allegations in this paragraph.

237.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
238.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
239.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
240.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
241.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
242.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
243.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.

32

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 33 of 45 PageID# 20250

244.

Capital One denies the allegations in this paragraph.

245.

Capital One denies the allegations in this paragraph.

246.

Capital One denies the allegations in this paragraph.

247.

Capital One denies the allegations in this paragraph.

248.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
249.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
250.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
251.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.
252.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.
253.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.

33

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 34 of 45 PageID# 20251

254.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.
255.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.
256.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.
257.

The allegations in this paragraph pertain solely to claims that have been dismissedby the Court’s September 18, 2020 Order [Dkt. 879] and, therefore, no response is required. To
the extent a response to any allegations in this paragraph is required, Capital One denies theallegations.
258.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
259.

Capital One denies the allegations in this paragraph.

260.

Capital One denies the allegations in this paragraph.

261.

Capital One denies the allegations in this paragraph.

262.

Capital One denies the allegations in this paragraph.

263.

Capital One denies the allegations in this paragraph.

34

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 35 of 45 PageID# 20252

264.

Capital One denies the allegations in this paragraph.

265.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
266.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
267.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
268.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
269.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
270.

Capital One denies the allegations in this paragraph.

271.

Capital One denies the allegations in this paragraph.

272.

Capital One denies the allegations in this paragraph.

273.

Capital One denies the allegations in this paragraph.

274.

Capital One denies the allegations in this paragraph.

275.

Capital One denies the allegations in this paragraph.

276.

Capital One denies the allegations in this paragraph.

277.

Capital One denies the allegations in this paragraph.

278.

Capital One denies the allegations in this paragraph.

279.

Capital One denies the allegations in this paragraph.

280.

Capital One denies the allegations in this paragraph.

281.

Capital One denies the allegations in this paragraph.

35

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 36 of 45 PageID# 20253

282.

Capital One denies the allegations in this paragraph.

283.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
284.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
285.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
286.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
287.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
288.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
289.

Capital One denies the allegations in this paragraph.

290.

Capital One denies the allegations in this paragraph.

291.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
292.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
293.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
294.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.

36

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 37 of 45 PageID# 20254

295.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
296.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
297.

Capital One denies the allegations in this paragraph.

298.

Capital One denies the allegations in this paragraph.

299.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
300.

Capital One incorporates its responses to paragraphs 1 through 157 as if fully set

forth herein.
301.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
302.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
303.

Capital One denies the allegations in this paragraph.

304.

Capital One denies the allegations in this paragraph.

305.

Capital One denies the allegations in this paragraph.

306.

Capital One denies the allegations in this paragraph.

307.

Capital One denies the allegations in this paragraph.

308.

The allegations in this paragraph contain legal conclusions that require no

response. To the extent a response is required, Capital One denies the allegations.
RESPONSE TO REQUEST FOR RELIEF
The paragraphs under the heading “Request for Relief” on pages 86 through 89 of theComplaint, including the numbered and unnumbered paragraphs, do not contain allegations to37

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 38 of 45 PageID# 20255

which a response is required. To the extent these paragraphs of the Complaint contain any
allegations to which a response is required, Capital One denies the allegations. Capital One denies
that Plaintiffs are entitled to any relief whatsoever from Capital One, including but not limited to
the relief requested under the heading labeled “Request for Relief” on pages 86 through 89 of theComplaint.
Capital One denies any and all of the allegations in the Complaint that are not expressly
herein admitted, or that are neither admitted nor denied for lack of information or knowledge
sufficient to form a belief as to the truth or falsity of the allegations.
ADDITIONAL DEFENSES
Without assuming the burden of proof where it otherwise rests with Plaintiffs, Capital One
pleads the following defenses:
FIRST DEFENSEThe Complaint, in whole or in part, fails to state a claim upon which relief can be granted.
SECOND DEFENSE
Plaintiffs lack standing to assert their claims under Article III of the United States
Constitution.
THIRD DEFENSE
Plaintiffs lack prudential standing to assert their claims.
FOURTH DEFENSE
Plaintiffs’ claims fail because they have not suffered any actual, accrued injury or damage.
FIFTH DEFENSE
Plaintiffs’ claims are barred, in whole or in part, by their failure to exercise due care anddiligence to avoid loss or minimize any damages allegedly sustained.

38

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 39 of 45 PageID# 20256

SIXTH DEFENSE
The alleged damages suffered by Plaintiffs, if any, were caused by the acts of others forwhose conduct Capital One is not, nor has ever been, responsible.
SEVENTH DEFENSE
Plaintiffs’ claims are barred because any alleged harm is the result of the intervening andsuperseding criminal conduct of a third party, not Capital One.
EIGHTH DEFENSE
Plaintiffs’ claims are barred by the doctrine of contributory negligence.
NINTH DEFENSE
Plaintiffs’ recovery, if any, should be diminished by the proportion of Plaintiffs’ own
negligence or other fault under the doctrine of comparative fault.
TENTH DEFENSE
Plaintiffs’ claims are barred, in whole or in part, by lack of actual or proximate causation.
ELEVENTH DEFENSE
Plaintiffs’ claims are barred because Plaintiffs’ alleged damages, if any, were notreasonably foreseeable and because Plaintiffs’ alleged damages are supported only with
speculation and conjecture.
TWELFTH DEFENSE
Under applicable law, Capital One does not owe a common law duty of care to Plaintiffs.
THIRTEENTH DEFENSE
Plaintiffs’ negligence claims are barred because any common law duty of care recognizedby the Court cannot be applied retroactively to conduct that occurred before the duty existed or
was recognized.

39

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 40 of 45 PageID# 20257

FOURTEENTH DEFENSE
Plaintiffs’ negligence claim is barred by the Due Process Clause of the United States
Constitution because Capital One lacked notice of an applicable common law duty of care.
FIFTEENTH DEFENSE
Plaintiffs’ claims are barred, in whole or in part, by the economic loss rule and/or the sourceof duty rule.
SIXTEENTH DEFENSE
Plaintiffs’ claims are barred, in whole or in part, by the equitable doctrines of waiver,estoppel, or unclean hands.
SEVENTEENTH DEFENSE
Plaintiffs’ claims fail, in whole or in part, to the extent that necessary and indispensable
parties to this action have not been joined under Federal Rule of Civil Procedure 19, prohibiting
this action from proceeding in equity and good conscience among the parties presently before the
Court. Capital One specifically reserves the right to implead such parties.
EIGHTEENTH DEFENSE
Capital One at all times acted in good faith and in compliance with applicable laws andregulations.
NINETEENTH DEFENSE
To the extent Plaintiffs seek exemplary or punitive damages, such awards are prohibitedhere under the Fifth and Fourteenth Amendments to the United States Constitution.
TWENTIETH DEFENSE
To the extent Plaintiffs seek exemplary or punitive damages, the Complaint is devoid offacts sufficient to constitute a cause of action allowing for such an award.

40

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 41 of 45 PageID# 20258

TWENTY-FIRST DEFENSE
Plaintiffs are barred from recovering in excess of any statutory caps on punitive damages
that may apply in this action, including, but not limited to, under Fla. Stat. § 768.73, Tex. Civ.
Prac. & Rem. § 41.008, and Va. Code § 8.01-38.1.
TWENTY-SECOND DEFENSE
Plaintiffs fail to identify a factual or legal basis for their claim for attorneys’ fees.
TWENTY-THIRD DEFENSE
Plaintiffs’ claims may not properly be maintained as a class action under Rule 23 of theFederal Rules of Civil Procedure.
TWENTY-FOURTH DEFENSE
Plaintiffs’ claims under non-Virginia consumer protection or deceptive trade practice laws
are barred by the Dormant Commerce Clause and the Due Process Clause of the United States
Constitution.
TWENTY-FIFTH DEFENSE
Some or all of Plaintiffs’ claims under non-Virginia state consumer protection or deceptive
trade practice laws are barred because those laws do not apply to conduct occurring in Virginia.
TWENTY-SIXTH DEFENSE
Plaintiffs’ claims fail, in whole or in part, for failure to satisfy conditions precedent to suingunder the laws on which Plaintiffs base some or all of their claims, including but not limited toPlaintiffs’ failure to provide requisite written demands.
TWENTY-SEVENTH DEFENSE
Plaintiffs’ claims fail, in part, because Plaintiffs cannot maintain claims in a representative
capacity under their state-law statutory causes of action.

41

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 42 of 45 PageID# 20259

TWENTY-EIGHTH DEFENSE
Plaintiffs’ claims fail to the extent the statutes or regulations upon which Plaintiffs rely do
not provide individuals with a private right of action, including but not limited to Section 5 of theFederal Trade Commission Act and any “similar state statutes,” which provide no private right ofaction or basis for any negligence per se claim.
TWENTY-NINTH DEFENSE
Plaintiffs’ Complaint fails to plead claims of fraud with particularity and fails to plead that
Capital One acted with scienter.
THIRTIETH DEFENSE
Some or all of Plaintiffs’ claims are barred, in whole or in part, by the doctrine of set off tothe extent Plaintiffs are indebted or liable to Capital One.
THIRTY-FIRST DEFENSE
Plaintiffs’ claims are barred, in whole or in part, by the applicable statute of limitations.
RESERVATION
Capital One expressly and specifically reserves the right to amend this answer to add,
remove, or modify defenses based on legal theories, facts, and circumstances that may or will be
divulged through discovery and/or further legal analysis of Plaintiffs’ positions in this litigation.
JURY DEMAND
Capital One demands a trial by jury on all issues so triable pursuant to Rule 38 of theFederal Rules of Civil Procedure.
***

THEREFORE, having fully answered Plaintiffs’ Complaint, Capital One requests that theComplaint be dismissed with prejudice; that judgment be entered in Capital One’s favor; that costs

42

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 43 of 45 PageID# 20260

be taxed against Plaintiffs; and that Capital One be awarded such additional relief as the Court
deems just and proper.

Dated: May 7, 2021

Respectfully submitted,/s/ David L. BalserDavid L. Balser (pro hac vice)
S. Stewart Haskins II (pro hac vice)
Susan M. Clare (pro hac vice)
John C. Toro (pro hac vice)
Kevin J. O’Brien (VSB No. 78886)
Robert D. Griest (pro hac vice)
KING & SPALDING LLP
1180 Peachtree Street, N.E.
Atlanta, GA 30309
Tel.: (404) 572-4600
Fax: (404) 572-5140
dbalser@kslaw.com
shaskins@kslaw.com
sclare@kslaw.com
jtoro@kslaw.com
kobrien@kslaw.com
rgriest@kslaw.com
Robert A. Angle (VSB No. 37691)
Tim St. George (VSB No. 77349)
Jon S. Hubbard (VSB No. 71089)
Harrison Scott Kelly (VSB No. 80546)
TROUTMAN PEPPER HAMILTON SANDERS LLP
1001 Haxall Point
Richmond, VA 23219
Tel.: (804) 697-1200
Fax: (804) 697-1339
robert.angle@troutman.com
jon.hubbard@troutman.com
timothy.st.george@troutman.com
scott.kelly@troutman.com

43

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 44 of 45 PageID# 20261

Mary C. Zinsner (VSB No. 31397)
S. Mohsin Reza (VSB No. 75347)
TROUTMAN PEPPER HAMILTON SANDERS LLP
401 9th Street, NW, Suite 1000
Washington, DC 20004
Tel.: (202) 274-1932
Fax: (202) 274-2994
mary.zinsner@troutman.com
mohsin.reza@troutman.com
Counsel for Capital One

44

Case 1:19-md-02915-AJT-JFA Document 1296 Filed 05/07/21 Page 45 of 45 PageID# 20262

CERTIFICATE OF SERVICE
I hereby certify that on May 7, 2021, I caused the foregoing document to be filed with the
Clerk of Court using the CM/ECF system, which will send notice of electronic filing to all counselof record.

/s/ David L. BalserDavid L. Balser

45