1 

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF FLORIDA

CLASS ACTION COMPLAINT

Plaintiff Kimberly Leszczynski (“Plaintiff”), on behalf of herself and all others similarly 

situated, alleges the following Class Action Complaint (the “Action”) against Community Loan 

Servicing, Limited Liability Company (“Community Loan Servicing” or “Defendant”) upon 

personal knowledge as to herself and her own actions, and upon information and belief, including 

the investigation of counsel as follows: 

I. SUMMARY

1. Plaintiff brings this Action on behalf of herself and all other similarly situated 

victims of a recent cyberattack and data breach involving the personal identifiable information of 

current and former patrons and applicants of Defendant Community Loan Servicing, a Florida 

LLC that maintains lines of business in the mortgage servicing industry (hereinafter, the “Data 

Breach”).

KIMBERLY LESZCZYNSKI, individually and on 

behalf of himself and all others similarly situated, 

Plaintiff, 

 v.

COMMUNITY LOAN SERVICING, LIMITED

LIABILITY COMPANY, 

Defendant.

Case No.

CLASS ACTION 

 

 

 DEMAND FOR JURY TRIAL

_________________________________________

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 1 of 35
2

2. Between October 27, 2021, and December 7, 2021 an unknown and unauthorized 

criminal actor gained access to Defendant’s network and exfiltrated information including Plaintiff 

and Class Members’ names, social security numbers, and other information related provided to 

Defendant in connection with loan applications, loan modifications, or other items regarding loan 

servicing (“PII”).

3. In Notice of Data Breach letters (hereinafter the “Notice”) Defendant sent to 

Plaintiff and Class Members on October 17, 2022, Defendant acknowledges:

A security incident involving unauthorized access to our file servers was identified 

in early December 2021. Steps were taken immediately to contain the incident, 

notify law enforcement, and a forensic investigation firm was engaged. The 

investigation determined that an unauthorized person obtained access to files on 

our file storage servers from October 27, 2021 to December 7, 2021. The accessed 

files were then reviewed by our investigation team to identify the content. On 

October 6, 2022, the review process determined that some of your information, 

including your name and Social Security number, was included in the files. For 

some, the accessed files may also have included information provided in connection 

with a loan application, loan modification, or other items regarding loan servicing.

4. Defendant thereafter advises victims “...to be vigilant for incidents of fraud or 

identity theft by reviewing your account statements and free credit reports for any unauthorized 

activity over the next 12 to 24 months.” 

5. To be clear – there are numerous issues with Defendant’s Data Breach, but the 

deficiencies in the Data Breach notification letter exacerbate the circumstances for victims of the 

Data Breach: (1.) Defendant fails to state whether they were able to contain or end the databreach

threat, leaving victims to fear whether the PII that Defendant continues to maintain is secure; (2.) 

Defendant’s systems were compromised in October of 2021 but they did not notify any victims 

until October 17, 2022; (3.) Defendant fails to state how the breach itself occurred. All of this 

information is vital to victims of a data breach, let alone a data breach of this magnitude due to the 

sensitivity and wide array of information compromised in this specific breach. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 2 of 35
3

6. As a result of the Data Breach, Plaintiff and Class Members suffered injury and 

ascertainable losses in the form of the present and imminent threat of fraud and identity theft, loss 

of the benefit of their bargain, out-of-pocket expenses, loss of value of their time reasonably 

incurred to remedy or mitigate the effects of the attack, and the loss of, and diminution in, value 

of their personal information.

7. In addition, Plaintiff’s and Class Members’ sensitive PII —which was entrusted to 

Defendant — was compromised and unlawfully accessed due to the Data Breach. This 

information, while compromised and taken by unauthorized third parties, remains also in the 

possession of Defendant, and without additional safeguards and independent review and oversight, 

remains vulnerable to future cyberattacks and theft. 

8. The Data Breach was a direct result of Defendant’s failure to implement adequate 

and reasonable cyber-security procedures and protocols necessary to protect victims’ PII.

9. Plaintiff brings this class action lawsuit on behalf of those similarly situated to 

address Defendant’s inadequate safeguarding of Class Members’ PII that Defendant collected and 

maintained, and for failing to provide timely and adequate notice to Plaintiff and other Class 

Members that their information had been subject to the unauthorized access by an unknown third 

party.

10. Defendant maintained the PII in a reckless manner. In particular, the PII was 

maintained on Defendant’s computer network in a condition vulnerable to cyberattacks. 

11. The mechanism of the cyberattack and potential for improper disclosure of 

Plaintiff’s and Class Members’ Private Information was a known risk to Defendant and entities 

like it, and Defendant was thus on notice that failing to take steps necessary to secure the PII

against those risks left that property in a dangerous condition and vulnerable to theft. Defendant 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 3 of 35
4

was further on notice of the severe consequences that would result to Plaintiff and Class Members 

from its failure to safeguard their PII.

12. Defendant disregarded the rights of Plaintiff and Class Members (defined below) 

by, inter alia, intentionally, willfully, recklessly, or negligently failing to take adequate and 

reasonable measures to ensure its data systems were protected against unauthorized intrusions; 

failing to disclose that it did not have adequately robust computer systems and security practices 

to safeguard customer PII; failing to take standard and reasonably available steps to prevent the 

Data Breach; failing to properly train its staff and employees on proper security measures; and 

failing to provide Plaintiff and Class Members prompt notice of the Data Breach.

13. In addition, Defendant and its employees failed to properly monitor the computer 

network and systems that housed the PII. Had Defendant properly monitored its computer network 

and systems, it would have discovered the intrusion sooner, as opposed to letting cyberthieves 

roam freely in Defendant’s IT network for over a month.

14. Plaintiff's and Class Members’ identities are now at risk because of Defendant’s 

negligent conduct since the PII that Defendant collected and maintained is now in the hands of 

data thieves. This present risk will continue for their respective lifetimes.

15. Armed with the PII accessed in the Data Breach, data thieves can commit a variety 

of crimes including, e.g., opening new financial accounts in Class Members’ names, taking out 

loans in Class Members’ names, using Class Members’ names to obtain medical services, using 

Class Members’ information to obtain government benefits, filing fraudulent tax returns using 

Class Members’ information, obtaining driver’s licenses in Class Members’ names but with 

another person’s photograph, and giving false information to police during an arrest.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 4 of 35
5

16. As a result of the Data Breach, Plaintiff and Class Members have been exposed to 

a present and imminent risk of fraud and identity theft. Plaintiff and Class Members must now and 

in the future closely monitor their financial accounts to guard against identity theft.

17. Plaintiff and Class Members will incur out of pocket costs for, e.g., purchasing 

credit monitoring services, credit freezes, credit reports, or other protective measures to deter and 

detect identity theft.

18. Plaintiff seeks to remedy these harms on behalf of herself and all similarly situated 

individuals whose PII was accessed during the Data Breach.

19. Plaintiff seeks remedies including, but not limited to, actual damages, 

compensatory damages, nominal damages, and reimbursement of out-of-pocket costs.

20. Plaintiff also seeks injunctive and equitable relief to prevent future injury on behalf 

of himself and the putative Class.

II. JURISDICTION AND VENUE

21. Jurisdiction is proper under 28 U.S.C. § 1331 as Plaintiff alleges violations of a 

federal statute. This Court also has subject matter and diversity jurisdiction over this action under 

28 U.S.C. § 1332(d) because this is a class action wherein the amount of controversy exceeds the 

sum or value of $5 million, exclusive of interests and costs, there are more than 100 members of 

the proposed class, and at least one Class Member is a citizen of a state different from Defendant 

to establish minimal diversity. 

22. This Court has personal jurisdiction over Defendant because Defendant is 

headquartered and does substantial business from and within in this District, the Southern District 

of Florida. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 5 of 35
6 

23. Venue is proper in this District under 28 U.S.C. § 1391(b) because Defendant 

and/or its parents or affiliates are headquartered in this District and a substantial part of the events 

or omissions giving rise to Plaintiff’s claims occurred in this District. 

III. PARTIES

Plaintiff Kimberly Leszczynski

24. Plaintiff Kimberly Leszczynski is an individual citizen of the state of Florida, and 

resides in Orlando, Florida. Plaintiff received a Notice of Data Breach letter from Defendant dated 

October 17, 2022. Plaintiff has had her mortgage serviced through Defendant for many years. 

Defendant Community Loan Servicing, Limited Liability Company. 

25. Defendant Community Loan Servicing, Limited Liability Company is a Florida 

LLC with its principal place of business located at 4425 Ponce De Leon Blvd., 4th Floor, Coral 

Gables, Florida. 

IV. FACTUAL ALLEGATIONS

Defendant’s Business

26. According to Defendant’s website, Defendant services loans in all U.S. states, DC, 

Puerto Rico, and Guam since 1999.1

27. Defendant collects personally identifiable information from their customers and 

potential customers in the course of doing business. This personally identifiable information 

includes the PII which was compromised in the Data Breach alleged herein. 

28. Prior to having their loans serviced though Defendant, Plaintiff and Class Members 

were required to and did in fact turn over their PII. 

1 https://communityloanservicing.com/ Last accessed November 3, 2022. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 6 of 35
7

29. Upon information and belief, Defendant promises to maintain the confidentiality of 

Plaintiff’s and Class Members’ Private Information to ensure compliance with federal and state 

laws and regulations, and not to use or disclose Plaintiff’s and Class Members’ Private Information 

for non-essential purposes.

30. As a condition of receiving loan servicing through Defendant, Defendant requires 

that Plaintiff and Class Members entrust it with highly sensitive personal information.

31. By obtaining, collecting, using, and deriving a benefit from Plaintiff’s and Class 

Members’ Private Information, Defendant assumed legal and equitable duties and knew or should 

have known that it was responsible for protecting Plaintiff’s and Class Members’ Private 

Information from unauthorized disclosure.

32. Plaintiff and Class Members have taken reasonable steps to maintain the 

confidentiality of their Private Information. Plaintiff and Class Members would not have entrusted 

Defendant with their Private Information had they known that Defendant would fail to implement 

industry standard protections for that sensitive information.

33. Plaintiff and the Class Members relied on Defendant to keep their PII confidential 

and securely maintained, to use this information for business purposes only, and to make only 

authorized disclosures of this information.

The Attack and Data Breach

34. On October 17, 2022, Defendant informed Plaintiff and the Class Members via the 

Notice that: 

Community Loan Servicing LLC (“CLS”) understands the importance of 

protecting the information we maintain. We are writing to inform you of an incident 

that involved some of your information.... CLS currently or previously serviced 

your mortgage loan. A security incident involving unauthorized access to our file 

servers was identified in early December 2021....[A]n unauthorized person 

obtained access to files on our file storage servers from October 27, 2021 to 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 7 of 35
8

December 7, 2021. The accessed files were then reviewed by our investigation team 

to identify the content. On October 6, 2022, the review process determined that 

some of your information, including your name and Social Security number, was 

included in the files. For some, the accessed files may also have included 

information provided in connection with a loan application, loan modification, or 

other items regarding loan servicing.

35. Upon information and belief, the personally identifiable information that was 

compromised includes full names, Social Security numbers, payroll data, financial information, 

dates of birth, email addresses, telephone numbers, physical addresses, and other data provided to 

Defendant.

36. Defendant thereafter advises victims “[t]o be vigilant for incidents of fraud or 

identify theft by reviewing your account statements and free credit reports for any unauthorized 

activity over the next 12 to 24 months.”

37. To be clear – there are numerous issues with Defendant’s Data Breach, but the 

deficiencies in the Data Breach notification letter exacerbate the circumstances for victims of the 

Data Breach: (1.) Defendant fails to state whether they were able to contain or end the databreach 

threat, leaving victims to fear whether the PII that Defendant continues to maintain is secure; (2.) 

Defendant’s systems were compromised in October of 2021 but they did not notify any victims 

until October 17, 2022; (3.) Defendant fails to state how the breach itself occurred. All of this 

information is vital to victims of a data breach, let alone a data breach of this magnitude due to the 

sensitivity and wide array of information compromised in this specific breach.

38. The Data Breach Notice letter also states that Defendant is offering victims of the 

Data Breach one year of credit and identity monitoring services. With its offer of credit and identity 

monitoring services, Defendant is acknowledging that Plaintiff and Class Members are subject to 

an imminent threat of identity theft and financial fraud.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 8 of 35
9

39. Defendant’s Notice also acknowledges the present, imminent, and actual threat to 

Plaintiff and Class Members and cautions them to “be vigilant for incidents of fraud or identify 

theft by reviewing your account statements.”

40. Due to Defendant’s inadequate security measures, Plaintiff and the Class Members 

now face a present, immediate, and ongoing risk of fraud and identity theft and must deal with that 

threat forever.

41. Upon information and belief, the PII was not encrypted prior to the data breach.

42. Upon information and belief, the cyberattack was targeted at Defendant as an entity

that collects and maintains valuable personal and financial data from its many clients, including 

Plaintiff and Class Members.

43. Upon information and belief, the cyberattack was expressly designed to gain access 

to private and confidential data, including (among other things) the PII of Plaintiff and Class 

Members.

44. Defendant had obligations to keep Plaintiff’s and Class Members’ PII confidential 

and to protect it from unauthorized access and disclosure.

45. Plaintiff and Class Members provided their PII to Defendant with the reasonable 

expectation and on the mutual understanding that Defendant would comply with its obligations to 

keep such information confidential and secure from unauthorized access.

The Data Breach Was Foreseeable and the Defendant Was Aware of Its Risk

46. It is well known that PII, including Social Security numbers and financial account 

information in particular is an invaluable commodity and a frequent target of hackers.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 9 of 35
10

47. In 2021, there were a record 1,862 data breaches last year, surpassing both 2020's 

total of 1,108 and the previous record of 1,506 set in 2017.

2

48. Individuals place a high value not only on their PII, but also on the privacy of that 

data. For the individual, identity theft causes “significant negative financial impact on victims” as 

well as severe distress and other strong emotions and physical reactions.

49. Individuals are particularly concerned with protecting the privacy of their Social 

Security numbers, which are the “secret sauce” that is “as good as your DNA to hackers.” There 

are long-term consequences to data breach victims whose social security numbers are taken and 

used by hackers. Even if they know their Social Security numbers have been accessed, Plaintiff 

and Class Members cannot obtain new numbers unless they become a victim of Social Security 

number misuse. Even then, the Social Security Administration has warned that “a new number 

probably won’t solve all [] problems ... and won’t guarantee ... a fresh start.”

50. In light of recent high profile data breaches at other industry leading companies, 

including, Microsoft (250 million records, December 2019), Wattpad (268 million records, June 

2020), Facebook (267 million users, April 2020), Estee Lauder (440 million records, January 

2020), Whisper (900 million records, March 2020), and Advanced Info Service (8.3 billion 

records, May 2020), and, in light of the recent data breaches Wells Fargo has suffered, Defendant 

knew or should have known that its electronic records would be targeted by cybercriminals.

51. Indeed, cyberattacks have become so notorious that the FBI and U.S. Secret Service 

have issued a warning to potential targets so they are aware of and take appropriate measures to 

prepare for and are able to thwart such an attack. 

2 Bree Fowler, Data breaches break record in 2021, CNET (Jan. 24, 2022), https://www.cnet.com 

/tech/services-and-software/record-number-of-data-breaches-reported-in-2021-new-report-says/.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 10 of 35
11

52. Despite the prevalence of public announcements of data breach and data security 

compromises, and despite their own acknowledgment of its duties to keep PII private and secure, 

Defendant failed to take appropriate steps to protect the PII of Plaintiffs and the proposed Class 

from being compromised.

Defendant Had a Duty to Plaintiff and Class Members to Secure Private Information

53. At all relevant times, Defendant had a duty to Plaintiff and Class Members to 

properly secure their PII, encrypt and maintain such information using industry standard methods, 

train its employees, utilize available technology to defend its systems from invasion, act reasonably 

to prevent foreseeable harm to Plaintiff and Class Members, and to promptly notify Plaintiff and 

Class Members when Defendant became aware that their PII may have been compromised. 

54. Defendant’s duty to use reasonable security measures arose as a result of the special 

relationship that existed between Defendant, on the one hand, and Plaintiff and the Class Members, 

on the other hand. The special relationship arose because Plaintiff and the Members of the Class 

relied on Defendant to secure their PII when they entrusted Defendant with the information 

required for their loan servicing. 

55. Defendant had the resources necessary to prevent the Data Breach but neglected to 

adequately invest in security measures, despite its obligation to protect such information. 

Accordingly, Defendant breached its common law, statutory, and other duties owed to Plaintiff 

and Class Members.

56. Security standards commonly accepted among businesses that store PII using the 

internet include, without limitation:

a. Maintaining a secure firewall configuration;

b. Maintaining appropriate design, systems, and controls to limit user access to 

certain information as necessary;

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 11 of 35
12

c. Monitoring for suspicious or irregular traffic to servers;

d. Monitoring for suspicious credentials used to access servers;

e. Monitoring for suspicious or irregular activity by known users;

f. Monitoring for suspicious or unknown users;

g. Monitoring for suspicious or irregular server requests;

h. Monitoring for server requests for PII;

i. Monitoring for server requests from VPNs; and

j. Monitoring for server requests from Tor exit nodes.

57. The Federal Trade Commission (“FTC”) defines identity theft as “a fraud 

committed or attempted using the identifying information of another person without authority.”3

The FTC describes “identifying information” as “any name or number that may be used, alone or 

in conjunction with any other information, to identify a specific person,” including, among other 

things, “[n]ame, Social Security number, date of birth, official State or government issued driver’s 

license or identification number, alien registration number, government passport number, 

employer or taxpayer identification number.”4

58. The ramifications of Defendant’s failure to keep its employees’ PII secure are long 

lasting and severe. Once PII is stolen, particularly Social Security numbers, fraudulent use of that 

information and damage to victims is likely to continue for years.

The Value of Personally Identifiable Information

59. The PII of consumers remains of high value to criminals, as evidenced by the prices 

they will pay through the dark web. Numerous sources cite dark web pricing for stolen identity 

3 17 C.F.R. § 248.201 (2013). 

4 Id.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 12 of 35
13 

credentials. For example, personal information can be sold at a price ranging from $40 to $200, 

and bank details have a price range of $50 to $200.5 According to the Dark Web Price Index for 

2021, payment card details for an account balance up to $1,000 have an average market value of 

$150, credit card details with an account balance up to $5,000 have an average market value of 

$240, stolen online banking logins with a minimum of $100 on the account have an average market 

value of $40, and stolen online banking logins with a minimum of $2,000 on the account have an 

average market value of $120.6

60. As a growing number of federal courts have begun to recognize the loss of value of 

PII as a viable damages theory, the sale of PII from data breaches, as in the Data Breach alleged 

herein, is particularly harmful to data breach victims – especially when it takes place on the dark 

web.

61. The dark net is an unindexed layer of the internet that requires special software or 

authentication to access.7 Criminals in particular favor the dark web as it offers a degree of 

anonymity to visitors and website publishers. Unlike the traditional or ‘surface’ web, dark web 

users need to know the web address of the website they wish to visit in advance. For example, on 

the surface web, the CIA’s web address is cia.gov, but on the dark web the CIA’s web address is 

ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion.8

 This prevents dark web 

marketplaces from being easily identifiable to authorities or those not in the know. 

5 Your personal data is for sale on the dark web. Here’s how much it costs, Digital Trends, Oct. 

16, 2019, available at: https://www.digitaltrends.com/computing/personal-data-sold-on-thedark-web-how-much-it-costs/ (last accessed December 10, 2021). 

6 Dark Web Price Index 2021, Zachary Ignoffo, March 8, 2021, available at: 

https://www.privacyaffairs.com/dark-web-price-index-2021/ (last accessed December 10, 2021).

7 What Is the Dark Web?, Experian, available at https://www.experian.com/blogs/askexperian/what-is-the-dark-web/

8 Id.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 13 of 35
14 

62. A sophisticated black market exists on the dark web where criminals can buy or 

sell malware, firearms, drugs, and frequently, personal and medical information like the PII at 

issue here.9 The digital character of PII stolen in data breaches lends itself to dark web transactions 

because it is immediately transmissible over the internet and the buyer and seller can retain their 

anonymity. The sale of a firearm or drugs on the other hand requires a physical delivery address. 

Nefarious actors can readily purchase usernames and passwords for online streaming services,

stolen financial information and account login credentials, and Social Security numbers, dates of 

birth and medical information.10 As Microsoft warns “[t]he anonymity of the dark web lends itself 

well to those who would seek to do financial harm to others.” 11

63. Plaintiff and Class Members’ PII is a valuable commodity, a market exists for 

Plaintiff and Class Members’ PII (which is why the Data Breach was perpetrated in the first place), 

and Plaintiff and Class Members’ PII is being likely being sold by hackers on the dark web (as that 

is the modus operandi of data thieves) – as a result, Plaintiff and Class Members have lost the 

value of their PII, which is sufficient to plausibly allege injury arising from a data breach. 

64. An active and robust legitimate marketplace for PII also exists. In 2019, the data 

brokering industry was worth roughly $200 billion.12 In fact, the data marketplace is so 

sophisticated that consumers can actually sell their non-public information directly to a data broker 

who in turn aggregates the information and provides it to marketers or app developers.1314

9 What is the Dark Web? – Microsoft 365, available at https://www.microsoft.com/enus/microsoft-365-life-hacks/privacy-and-safety/what-is-the-dark-web 10 Id.; What Is the Dark Web?, Experian, available at https://www.experian.com/blogs/askexperian/what-is-the-dark-web/

11 What is the Dark Web? – Microsoft 365, available at https://www.microsoft.com/enus/microsoft-365-life-hacks/privacy-and-safety/what-is-the-dark-web 12 https://www.latimes.com/business/story/2019-11-05/column-data-brokers 13 https://datacoup.com/ 14 https://digi.me/what-is-digime/ 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 14 of 35
15 

Consumers who agree to provide their web browsing history to the Nielsen Corporation can 

receive up to $50.00 a year.15 

65. The PII stolen in this specific Data Breach was particularly harmful. Social Security 

numbers, for example, are among the worst kind of personal information to have stolen because 

they may be put to a variety of fraudulent uses and are difficult for an individual to change. 

66. The Social Security Administration stresses that the loss of an individual’s Social 

Security number, as is the case here, can lead to identity theft and extensive financial fraud:

A dishonest person who has your Social Security number can use it to get other 

personal information about you. Identity thieves can use your number and your 

good credit to apply for more credit in your name. Then, they use the credit cards 

and don’t pay the bills, it damages your credit. You may not find out that someone 

is using your number until you’re turned down for credit, or you begin to get calls 

from unknown creditors demanding payment for items you never bought. Someone 

illegally using your Social Security number and assuming your identity can cause 

a lot of problems.16

67. Furthermore, trying to change or cancel a stolen Social Security number is no minor 

task. An individual cannot obtain a new Social Security number without significant paperwork and 

evidence of actual misuse. In other words, preventive action to defend against the possibility of 

misuse of a Social Security number is not permitted; an individual must show evidence of actual, 

ongoing fraud activity to obtain a new number. 

68. Even then, a new Social Security number may not be effective, as “[t]he credit 

bureaus and banks are able to link the new number very quickly to the old number, so all of that 

15 Nielsen Computer & Mobile Panel, Frequently Asked Questions, available at 

https://computermobilepanel.nielsen.com/ui/US/en/faqen.html (last accessed Mar. 29, 2021).

16 Social Security Administration, Identity Theft and Your Social Security Number, available at: 

https://www.ssa.gov/pubs/EN-05-10064.pdf (last accessed December 10, 2021). 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 15 of 35
16 

old bad information is quickly inherited into the new Social Security number.”17

69. This data, as one would expect, demands a much higher price on the black market. 

Martin Walter, senior director at cybersecurity firm RedSeal, explained, “[c]ompared to credit card 

information, personally identifiable information and Social Security numbers are worth more than 

10x on the black market.”18

70. PII can be used to distinguish, identify, or trace an individual’s identity, such as 

their name and Social Security number. This can be accomplished alone, or in combination with 

other personal or identifying information that is connected or linked to an individual, such as their 

birthdate, birthplace, and mother’s maiden name.19

71. Given the nature of Defendant’s Data Breach, as well as the delay in notification to 

Class Members, it is foreseeable that the compromised PII has been or will be used by hackers and 

cybercriminals in a variety of devastating ways. Indeed, the cybercriminals who possess Plaintiff’s 

and Class Members’ PII can easily obtain Plaintiff’s and Class Members’ tax returns or open 

fraudulent credit card accounts in Class Members’ names. 

72. Based on the foregoing, the information compromised in the Data Breach is 

significantly more valuable than the loss of, for example, credit card information in a retailer data 

breach, because credit card victims can cancel or close credit and debit card accounts.20 The 

17 Brian Naylor, Victims of Social Security Number Theft Find It’s Hard to Bounce Back, 

NPR (Feb. 9, 2015), http://www.npr.org/2015/02/09/384875839/data-stolen-by-anthem-shackers-has-millions-worrying-about-identity-theft (last accessed December 10, 2021).

18 Tim Greene, Anthem Hack: Personal Data Stolen Sells for 10x Price of Stolen Credit 

Card Numbers, Computer World (Feb. 6, 2015), 

http://www.itworld.com/article/2880960/anthem-hack-personal-data-stolen-sells-for-10x-priceof-stolen-credit-card-numbers.html (last accessed December 10, 2021). 

19 See OFFICE OF MGMT. & BUDGET, OMB MEMORANDUM M-07-16 n. 1.

20 See Jesse Damiani, Your Social Security Number Costs $4 On The Dark Web, New Report 

Finds, Forbes, Mar 25, 2020, available at: 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 16 of 35
17 

information compromised in this Data Breach is impossible to “close” and difficult, if not 

impossible, to change (such as Social Security numbers and dates of birth).

73. To date, Defendant has offered its victims only one yeas of identity monitoring 

services. The offered services are inadequate to protect Plaintiff and Class Members from the 

threats they face for years to come, particularly in light of the PII at issue here. 

74. The injuries to Plaintiff and Class Members were directly and proximately caused 

by Defendant’s failure to implement or maintain adequate data security measures for its current 

and former employees. 

Plaintiff’s Experience

75. Plaintiff was required to provide and did provide his PII to Defendant as a condition 

of Defendant servicing her loan. 

76. To date, Defendant has done next to nothing to adequately protect Plaintiff and 

Class Members, or to compensate them for their injuries sustained in this Data Breach particularly 

given the fact that Plaintiff’s PII has already been “downloaded” in the Data Breach and likely 

been made available on the dark web to anyone wishing to purchase it. 

77. The fraud and identity monitoring services offered by Defendant are only for one 

year, and it places the burden squarely on Plaintiff and Class Members by requiring them to expend 

time signing up for the service and addressing timely issues when the service number for 

enrollment does not work properly. 

78. Nor has Defendant compensated Plaintiff and Class Members for the time they will 

spend monitoring their accounts, placing credit freezes, changing online passwords and other 

https://www.forbes.com/sites/jessedamiani/2020/03/25/your-social-security-number-costs-4-

on-the-dark-web-new-report-finds/?sh=6a44b6d513f1 (last accessed December 10, 2021). 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 17 of 35
18

actions that Defendant instructs recipients of the Notice to take.

79. Plaintiff and Class Members have been further damaged by the compromise of their 

PII in the Data Breach which was “downloaded” and is in the hands of cybercriminals who illegally 

accessed Defendant’s network for the specific purpose of targeting the PII. 

80. Plaintiff typically takes measures to protect her PII and is very careful about sharing 

her PII. Plaintiff has never knowingly transmitted unencrypted PII over the internet or other 

unsecured source.

81. Plaintiff stores any documents containing her PII in a safe and secure location, and 

she diligently chooses unique usernames and passwords for her online accounts.

82. As a result of the Data Breach, Plaintiff has suffered a loss of time and has spent 

and continues to spend a considerable amount of time on issues related to this Data Breach. In 

response to the Data Breach, Plaintiff has spent significant time monitoring her accounts and credit 

score, changing her online account passwords and verifying the legitimacy of the Notice and 

researching the Data Breach. This is time that was lost and unproductive and took away from other 

activities and duties.

83. Plaintiff also suffered actual injury in the form of damages to and diminution in the 

value of her PII — a form of intangible property that he entrusted to Defendant for the purpose of 

obtaining services from Defendant, which was compromised in and as a result of the Data Breach.

84. Plaintiff suffered lost time, annoyance, interference, and inconvenience as a result 

of the Data Breach and has anxiety and increased concerns for the loss of her privacy.

85. Plaintiff suffered emotional distress and increased stress and anxiety as a result of 

the Data Breach because of the actions she has been forced to undertake, the loss of control over 

her most intimate information, and the fact that he must remain vigilant for the remainder of his 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 18 of 35
19

life.

86. Plaintiff has suffered imminent and impending injury arising from the substantially 

increased risk of fraud, identity theft, and misuse resulting from his PII, especially her Social 

Security Number, being placed in the hands of criminals.

87. Defendant obtained and continues to maintain Plaintiff’s PII and has a continuing 

legal duty and obligation to protect that PII from unauthorized access and disclosure. Defendant 

required the PII from Plaintiff as a condition of servicing her loan. Plaintiff, however, would not 

have entrusted his PII to Defendant had she known that it would fail to maintain adequate data 

security. Plaintiff’s PII was compromised and disclosed as a result of the Data Breach.

88. As a result of the Data Breach, Plaintiff anticipates spending considerable time and 

money on an ongoing basis to try to mitigate and address harms caused by the Data Breach. As a 

result of the Data Breach, Plaintiff is at a present risk and will continue to be at increased risk of 

identity theft and fraud for years to come. 

V. CLASS ACTION ALLEGATIONS

89. Plaintiff brings this suit on behalf of himself and a class of similarly situated 

individuals under Federal Rule of Civil Procedure 23, which is preliminarily defined as: 

All persons Defendant has identified as being among those individuals impacted 

by the Data Breach, including all who were sent a notice of the Data Breach (the 

“Class”).

90. Excluded from the Classes are the following individuals and/or entities: Defendant 

and Defendant’s parents, subsidiaries, affiliates, officers and directors, and any entity in which 

Defendant has a controlling interest; all individuals who make a timely election to be excluded 

from this proceeding using the correct protocol for opting out; and all judges assigned to hear any 

aspect of this litigation, as well as their immediate family members.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 19 of 35
20

91. Numerosity. The Class Members are so numerous that joinder of all members is 

impracticable. Though the exact number and identities of Class Members are unknown at this time, 

it is likely that hundreds, if not thousands, of individuals had their PII compromised in this Data 

Breach, given the Defendant services loan across the nation since 1999. The identities of Class 

Members are ascertainable through Defendant’s records, Class Members’ records, publication 

notice, self-identification, and other means.

92. Commonality. There are questions of law and fact common to the Class, which 

predominate over any questions affecting only individual Class Members. These common 

questions of law and fact include, without limitation:

i. Whether Defendant unlawfully used, maintained, lost, or disclosed 

Plaintiff’s and Class Members’ PII;

ii. Whether Defendant failed to implement and maintain reasonable security 

procedures and practices appropriate to the nature and scope of the 

information compromised in the Data Breach;

iii. Whether Defendant’s data security systems prior to and during the Data 

Breach complied with applicable data security laws and regulations;

iv. Whether Defendant’s data security systems prior to and during the Data 

Breach were consistent with industry standards;

v. Whether Defendant owed a duty to Class Members to safeguard their PII;

vi. Whether Defendant breached its duty to Class Members to safeguard their 

PII;

vii. Whether computer hackers obtained Class Members’ PII in the Data 

Breach;

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 20 of 35
21

viii. Whether Defendant knew or should have known that its data security 

systems and monitoring processes were deficient;

ix. Whether Plaintiff and Class Members suffered legally cognizable damages 

as a result of Defendant’s misconduct;

x. Whether Defendant’s conduct was negligent; and;

xi. Whether Plaintiff and Class Members are entitled to damages, civil 

penalties, punitive damages, and/or injunctive relief.

93. Typicality. Plaintiff’s claims are typical of those of other Class Members because 

Plaintiff’s PII, like that of every other Class member, was compromised in the Data Breach.

94. Adequacy of Representation. Plaintiff will fairly and adequately represent and 

protect the interests of the Members of the Class. Plaintiff’s Counsel is competent and experienced 

in litigating Class actions, including data privacy litigation of this kind.

95. Predominance. Defendant has engaged in a common course of conduct toward 

Plaintiff and Class Members, in that all the Plaintiff’s and Class Members’ data was stored on the 

same computer systems and unlawfully accessed in the same way. The common issues arising 

from Defendant’s conduct affecting Class Members set out above predominate over any 

individualized issues. Adjudication of these common issues in a single action has important and 

desirable advantages of judicial economy.

96. Superiority. A Class action is superior to other available methods for the fair and 

efficient adjudication of the controversy. Class treatment of common questions of law and fact is 

superior to multiple individual actions or piecemeal litigation. Absent a Class action, most Class 

Members would likely find that the cost of litigating their individual claims is prohibitively high 

and would therefore have no effective remedy. The prosecution of separate actions by individual 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 21 of 35
22

Class Members would create a risk of inconsistent or varying adjudications with respect to 

individual Class Members, which would establish incompatible standards of conduct for 

Defendant. In contrast, the conduct of this action as a Class action presents far fewer management 

difficulties, conserves judicial resources and the parties’ resources, and protects the rights of each 

Class member.

97. Defendant has acted on grounds that apply generally to the Class as a whole, so 

that Class certification, injunctive relief, and corresponding declaratory relief are appropriate on a 

Class-wide basis.

98. Likewise, particular issues under Federal Rule 23(c)(4) are appropriate for 

certification because such claims present only particular, common issues, the resolution of which 

would advance the disposition of this matter and the parties’ interests therein. Such particular 

issues include, but are not limited to:

xii. Whether Defendant owed a legal duty to Plaintiff and the Class to exercise 

due care in collecting, storing, and safeguarding their PII;

xiii. Whether Defendant’s security measures to protect their data systems were 

reasonable in light of best practices recommended by data security experts;

xiv. Whether Defendant’s failure to institute adequate protective security 

measures amounted to negligence; and

xv. Whether Defendant failed to take commercially reasonable steps to 

safeguard PII, 

99. Finally, all members of the proposed Class are readily ascertainable. Defendant has 

access to Class Members’ names and addresses affected by the Data Breach. Class Members have 

already been preliminarily identified and sent notice of the Data Breach by Defendant.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 22 of 35
23 

VI. CAUSES OF ACTION

COUNT I

NEGLIGENCE

100. Plaintiff re-alleges and incorporates by reference herein paragraphs 1-99 below. 

101. Defendant knowingly collected, came into possession of, and maintained Plaintiff’s 

and Class Members’ PII for pecuniary gain, and had a duty to exercise reasonable care in 

safeguarding, securing, and protecting such information from being compromised, lost, stolen, 

misused, and/or disclosed to unauthorized parties. 

102. Defendant had a duty under common law to have procedures in place to detect and 

prevent the loss or unauthorized dissemination of Plaintiff’s and Class Members’ PII. 

103. Defendant had full knowledge of the sensitivity of the PII and the types of harm 

that Plaintiff and Class Members could and would suffer if the PII were wrongfully disclosed. The 

harm that Plaintiff and Class Members experienced was within the zone of foreseeable harm 

known to Defendant.

104. Defendants’ duty to use reasonable security measures arose as a result of the special 

relationship that existed between each Defendant and Plaintiff and the Class. That special 

relationship arose because Plaintiff and the Class entrusted Defendants with their confidential PII, 

a mandatory step in receiving loan servicing from Defendant. While this special relationship exists 

independent from any contract, it is recognized by Defendant’s privacy practices, as well as 

applicable laws and regulations. Specifically, Defendant actively solicited and gathered PII as part 

of their businesses and were solely responsible for and in the position to ensure that their systems 

were sufficient to protect against the foreseeable risk of harm to Plaintiff and Class Members from 

a resulting data breach.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 23 of 35
24

105. Defendant was subject to an “independent duty,” untethered to any contract 

between Defendant and Plaintiff and the Class, to maintain adequate data security.

106. A breach of security, unauthorized access, and resulting injury to Plaintiff and the 

Class was reasonably foreseeable, particularly in light of Defendant’s inadequate security practices 

and the frequency of data breaches in general.

107. Defendant also had a common law duty to prevent foreseeable harm to others. 

Plaintiff and the Class were the foreseeable and probable victims of Defendant’s inadequate 

security practices and procedures. Defendant knew or should have known of the inherent risks in 

collecting and storing the PII of Plaintiff and the Class, the critical importance of adequately 

safeguarding that PII, and the necessity of encrypting PII stored on Defendant’s systems. It was 

foreseeable that Plaintiff and Class members would be harmed by the failure to protect their 

personal information because hackers are known to routinely attempt to steal such information and 

use it for nefarious purposes.

108. Defendant’s conduct created a foreseeable risk of harm to Plaintiff and the Class. 

Defendant’s wrongful conduct included, but was not limited to, their failure to take the steps and 

opportunities to prevent the Data Breach as set forth herein. Defendant’s misconduct also included 

their decision not to comply with industry standards for the safekeeping of Plaintiff’s and the 

Class’s PII, including basic encryption techniques available to Defendant.

109. Plaintiff and the Class had and have no ability to protect their PII that was in, and 

remains in, Defendant’s possession.

110. Defendant was in a position to effectively protect against the harm suffered by 

Plaintiffs and the Class as a result of the Data Breach.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 24 of 35
25

111. By assuming the responsibility to collect and store this data, and in fact doing so, 

and sharing it and using it for commercial gain, Defendant had a duty of care to use reasonable 

means to secure and safeguard their computer property—and Class Members’ PII held within it—

to prevent disclosure of the information, and to safeguard the information from theft. Defendant’s 

duty included a responsibility to implement processes by which they could detect a breach of its 

security systems in a reasonably expeditious period of time and to give prompt notice to those 

affected in the case of a data breach.

112. Defendant, through its actions and/or omissions, unlawfully breached its duty to 

Plaintiff and Class members by failing to exercise reasonable care in protecting and safeguarding 

Plaintiff’s and Class Members’ PII within Defendant’s possession. 

113. Defendant, through its actions and/or omissions, unlawfully breached its duty to 

Plaintiff and Class members by failing to have appropriate procedures in place to detect and 

prevent dissemination of Plaintiff’s and Class Members’ PII. 

114. Defendant, through its actions and/or omissions, unlawfully breached its duty to 

timely disclose to Plaintiff and Class Members that the PII within Defendant’s possession might 

have been compromised and precisely the type of information compromised. 

115. Defendant’s breach of duties owed to Plaintiff and Class Members caused 

Plaintiff’s and Class Members’ PII to be compromised. 

116. Pursuant to Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 

(“FTCA"), Defendant had a separate and independent duty to provide fair and adequate computer 

systems and data security practices to safeguard Plaintiff’s and Class members’ PII.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 25 of 35
26

117. The FTCA is intended, in part, to protect individuals whose PII is maintained by 

another and who are unable to safeguard their information as they cannot exercise control or 

direction over the data security practices. 

118. Plaintiff and the members of the Class are within the class of persons that the FTCA 

was intended to protect as their PII was collected and maintained by Defendant and they were 

unable to exercise control over Defendant’s data security practices.

119. The harm that occurred as a result of the Data Breach is the type of harm the FTCA 

was intended to guard against. 

120. The FTC has pursued enforcement actions against businesses, which, as a result of 

their failure to employ reasonable data security measures and avoid unfair and deceptive practices, 

caused the same harm as that suffered by Plaintiffs and the members of the Class.

121. Defendant breached its duties to Plaintiffs and the members of the Class under the 

Federal Trade Commission Act by failing to provide fair, reasonable, or adequate computer 

systems and data security practices to safeguard Plaintiffs’ and Class members’ Private 

Information.

122. Had Plaintiffs and the members of the Class known that Defendant would not 

adequately protect their Private Information, Plaintiffs and the members of the Class would not 

have entrusted Defendant with their Private Information.

123. Defendant’s failure to comply with applicable laws and regulations constitutes 

negligence per se.

124. But for Defendant’s wrongful and negligent breach of its duties owed to Plaintiffs 

and the members of the Class, they would not have been injured.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 26 of 35
27

125. The injury and harm suffered by Plaintiffs and the members of the Class was the 

reasonably foreseeable result of Defendant’s breach of its duties. Defendant knew or should have 

known that it was failing to meet their duties, and that Defendant’s breach would cause Plaintiff 

and the members of the Class to experience the foreseeable harms associated with the exposure of 

their Private Information.

126. As a direct and proximate result of Defendant’s negligence and negligence per se, 

Plaintiff and the Class have suffered and will suffer injury, including but not limited to: (i) actual 

identity theft; (ii) the loss of the opportunity to control how their PII is used; (iii) the compromise, 

publication, and/or theft of their PII; (iv) out-of-pocket expenses associated with the prevention, 

detection, and recovery from identity theft, tax fraud, and/or unauthorized use of their PII for 

Plaintiff’s and Class Members’ respective lifetimes; (v) lost opportunity costs associated with 

effort expended and the loss of productivity addressing and attempting to mitigate the present and 

future consequences of the Data Breach, including but not limited to efforts spent researching how 

to prevent, detect, contest, and recover from tax fraud and other identity theft; (vi) costs associated 

with placing freezes on credit reports; (vii) the continued risk to their PII, which remains in 

Defendant’s possession and is subject to further unauthorized disclosures so long as Defendant 

fails to undertake appropriate and adequate measures to protect the current and former employees’ 

PII in their continued possession; and (viii) present and future costs in the form of time, effort, and 

money that will be expended to prevent, detect, contest, and repair the impact of the compromise 

of PII as a result of the Data Breach for the remainder of the lives of Plaintiff and the Class 

Members.

127. As a direct and proximate result of Defendants’ negligence and negligence per se, 

Plaintiffs and the Class have suffered and will continue to suffer other forms of injury and/or harm, 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 27 of 35
28 

including, but not limited to, anxiety, emotional distress, loss of privacy, and other economic and 

non-economic losses.

128. Additionally, as a direct and proximate result of Defendant’s negligence and 

negligence per se, Plaintiff and the Class have suffered and will suffer the continued risks of 

exposure of their PII, which remains in Defendant’s possession and is subject to further 

unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate 

measures to protect the PII in its continued possession. 

129. As a direct and proximate result of Defendant’s negligence and negligence per se, 

Plaintiff and the Class are now at an increased risk of identity theft or fraud. 

130. As a direct and proximate result of Defendant’s negligence and negligence per se, 

Plaintiffs are entitled to and demand actual, consequential, and nominal damages and injunctive 

relief to be determined at trial.

COUNT II

BREACH OF IMPLIED CONTRACT

131. Plaintiff re-alleges and incorporates by reference herein paragraphs 1-99 below. 

132. Plaintiff and the Class entrusted their PII to Defendant as a condition of their loan 

servicing. In so doing, Plaintiff and the Class entered into implied contracts with Defendant by 

which Defendant agreed to safeguard and protect such information, to keep such information 

secure and confidential, and to timely and accurately notify Plaintiff and the Class if their data had 

been breached and compromised or stolen 

133. At the time Defendant acquired the PII of Plaintiffs and the Class, there was a 

meeting of the minds and a mutual understanding that Defendant would safeguard the PII and not 

take unjustified risks when storing the PII. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 28 of 35
29

134. Implicit in the agreements between Plaintiff and Class Members and Defendant to 

provide PII, was the latter’s obligation to: (a) use such PII for business purposes only, (b) take 

reasonable steps to safeguard that PII, (c) prevent unauthorized disclosures of the PII, (d) provide 

Plaintiff and Class Members with prompt and sufficient notice of any and all unauthorized access 

and/or theft of their PII, (e) reasonably safeguard and protect the PII of Plaintiff and Class 

Members from unauthorized disclosure or uses, and (f) retain the PII only under conditions that 

kept such information secure and confidential.

135. Plaintiff and the Class would not have entrusted their PII to Defendant had they 

known that Defendant would make the PII internet-accessible, not encrypt sensitive data elements 

such as Social Security numbers, and not delete the PII that Defendant no longer had a reasonable 

need to maintain it.

136. Plaintiff and the Class fully performed their obligations under the implied contracts 

with Defendant.

137. Defendant breached the implied contracts they made with Plaintiff and the Class by 

failing to safeguard and protect their personal information, by failing to delete the information of 

Plaintiff and the Class once the relationship ended, and by failing to provide timely and accurate 

notice to them that personal information was compromised as a result of the Data Breach.

138. As a direct and proximate result of Defendant’s above-described breach of implied

contract, Plaintiff and the Class have suffered (and will continue to suffer) ongoing, imminent, and 

impending threat of identity theft crimes, fraud, and abuse, resulting in monetary loss and 

economic harm; actual identity theft crimes, fraud, and abuse, resulting in monetary loss and 

economic harm; loss of the confidentiality of the stolen confidential data; the illegal sale of the 

compromised data on the dark web; expenses and/or time spent on credit monitoring and identity 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 29 of 35
30 

theft insurance; time spent scrutinizing bank statements, credit card statements, and credit reports; 

expenses and/or time spent initiating fraud alerts, decreased credit scores and ratings; lost work 

time; and other economic and non-economic harm.

139. As a direct and proximate result of Defendant’s above-described breach of implied 

contract, Plaintiff and the Class are entitled to recover actual, consequential, and nominal damages

to be determined at trial. 

COUNT III

INVASION OF PRIVACY – INTRUSION UPON SECLUSION

140. Plaintiff re-alleges and incorporates by reference herein paragraphs 1-99 below. 

141. Plaintiff and Class Members have a legally protected privacy interest in their PII, 

which is and was collected, stored and maintained by Defendant, and they are entitled to the 

reasonable and adequate protection of their PII against foreseeable unauthorized access, as 

occurred with the Data Breach.

142. Plaintiff and Class Members reasonably expected that Defendant would protect and 

secure their PII from unauthorized parties and that their PII would not be accessed, exfiltrated, and 

disclosed to any unauthorized parties or for any improper purpose. 

143. Defendant intentionally intruded into Plaintiff’s and Class Members’ seclusion by 

disclosing without permission their PII to a third party. Defendant’s acts and omissions giving rise 

to the Data Breach were intentional in that the decisions to implement lax security and failure to 

timely notice Plaintiff and the Class were undertaking willfully and intentionally.

144. By failing to keep Plaintiffs’ and Class Members’ PII secure, and disclosing PII to 

unauthorized parties for unauthorized use, Defendants unlawfully invaded Plaintiffs’ and Class 

Members’ privacy right to seclusion by, inter alia: 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 30 of 35
31

a. intruding into their private affairs in a manner that would be highly offensive to a 

reasonable person;

b. invading their privacy by improperly using their PII obtained for a specific purpose 

for another purpose, or disclosing it to unauthorized persons;

c. failing to adequately secure their PII from disclosure to unauthorized persons; and

d. enabling the disclosure of their PII without consent.

145. This invasion of privacy resulted from Defendant’s intentional failure to properly 

secure and maintain Plaintiff’s and ClassMembers’ PII, leading to the foreseeable unauthorized 

access, exfiltration, and disclosure of this unguarded and private data.

146. Plaintiff’s and Class Members’ PII is the type of sensitive, personal information 

that one normally expects will be protected from exposure by the very entity charged with 

safeguarding it. Further, the public has no legitimate concern in Plaintiff’s and Class Members’ 

PII, and such information is otherwise protected from exposure to the public by various statutes, 

regulations and other laws.

147. The disclosure of Plaintiff’s and Class Members’ PII to unauthorized parties is 

substantial and unreasonable enough to be legally cognizable and is highly offensive to a 

reasonable person.

148. Defendant’s willful and reckless conduct that permitted unauthorized access, 

exfiltration and disclosure of Plaintiff’s and Class Members’ sensitive PII is such that it would 

cause serious mental injury, shame or humiliation to people of ordinary sensibilities.

149. The unauthorized access, exfiltration, and disclosure of Plaintiff’s and Class 

Members’ PII was without their consent, and in violation of various statutes, regulations and other 

laws.

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 31 of 35
32 

150. As a direct and proximate result of Defendant’s intrusion upon seclusion, Plaintiff 

and Class Members suffered injury and sustained actual losses and damages as alleged herein. 

Plaintiff and Class Members alternatively seek an award of nominal damages.

COUNT IV

UNJUST ENRICHMENT

151. Plaintiff re-alleges and incorporates by reference herein paragraphs 1-99 below. 

152. This Count is brought in the alternative to Count II, Breach of Implied Contract. 

153. Plaintiff and Class Members conferred a monetary benefit on Defendant, by 

providing Defendant with their valuable PII. In so conferring this benefit, Plaintiff and Class 

Members understood that part of the benefit Defendant derived from the PII would be applied to 

data security efforts to safeguard the PII.

154. Defendant enriched itself by saving the costs they reasonably should have expended 

on data security measures to secure Plaintiff’s and Class Members’ PII.

155. Instead of providing a reasonable level of security that would have prevented the 

Data Breach, Defendant instead calculated to avoid their data security obligations at the expense 

of Plaintiff and Class Members by utilizing cheaper, ineffective security measures. Plaintiff and 

Class Members, on the other hand, suffered as a direct and proximate result of Defendant’s failure 

to provide the requisite security. 

156. Under the principles of equity and good conscience, Defendant should not be 

permitted to retain the monetary value of the benefit belonging to Plaintiff and Class Members, 

because Defendant failed to implement appropriate data management and security measures that 

are mandated by industry standards. 

157. Defendant acquired the monetary benefit and PII through inequitable means in that 

they failed to disclose the inadequate security practices previously alleged. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 32 of 35
33

158. If Plaintiff and Class Members knew that Defendant had not secured their PII, they 

would not have agreed to provide their PII to Defendant.

159. Plaintiff and Class Members have no adequate remedy at law.

160. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class 

Members have suffered and will suffer injury, including but not limited to: (i) actual identity theft; 

(ii) the loss of the opportunity how their PII is used; (iii) the compromise, publication, and/or theft 

of their PII; (iv) out-of-pocket expenses associated with the prevention, detection, and recovery 

from identity theft, and/or unauthorized use of their PII; (v) lost opportunity costs associated with 

effort expended and the loss of productivity addressing and attempting to mitigate the actual and 

future consequences of the Data Breach, including but not limited to efforts spent researching how 

to prevent, detect, contest, and recover from identity theft; (vi) the continued risk to their PII, which 

remain in Defendant’s possession and is subject to further unauthorized disclosures so long as 

Defendant fails to undertake appropriate and adequate measures to protect PII in their continued 

possession and (vii) future costs in terms of time, effort, and money that will be expended to 

prevent, detect, contest, and repair the impact of the PII compromised as a result of the Data Breach 

for the remainder of the lives of Plaintiff and Class Members.

161. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class 

Members have suffered and will continue to suffer other forms of injury and/or harm.

162. Defendant should be compelled to disgorge into a common fund or constructive 

trust, for the benefit of Plaintiff and Class Members, proceeds that they unjustly received from 

them. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 33 of 35
34 

VII. PRAYER FOR RELIEF

WHEREFORE, Plaintiff, individually and on behalf of the Class defined herein, prays for 

judgment as against Defendant as follows: 

a.) For an Order certifying this action as a Class action and appointing Plaintiff and 

his counsel to represent the Class;

b.) For equitable relief enjoining Defendant from engaging in the wrongful conduct 

complained of herein pertaining to the misuse and/or disclosure of Plaintiff’s

and Class Members’ PII, and from refusing to issue prompt, complete and 

accurate disclosures to Plaintiff and Class Members; 

c.) For equitable relief compelling Defendant to utilize appropriate methods and 

policies with respect to data collection, storage, and safety, and to disclose with 

specificity the type of PII compromised during the Breach; 

d.) For equitable relief requiring restitution and disgorgement of the revenues 

wrongfully retained as a result of Defendant’s wrongful conduct; 

e.) Ordering Defendant to pay for lifetime credit monitoring services for Plaintiff 

and the Class;

f.) For an award of actual damages, compensatory damages, statutory damages and 

statutory penalties, in an amount to be determined, as allowable by law; 

g.) For an award of punitive damages, as allowable by law; 

h.) For an award of attorneys’ fees and costs, and any other expense, including 

expert witness fees;

i.) Pre- and post-judgment interest on any amounts awarded and, 

j.) All such other and further relief as this court may deem just and proper. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 34 of 35
35 

JURY TRIAL DEMAND

Plaintiff hereby demands a trial by jury. 

DOCUMENT PRESERVATION DEMAND

Plaintiff demands that Defendant take affirmative steps to preserve all records, lists, 

electronic databases, or other itemization of telephone numbers associated with the 

communications or transmittal of the calls as alleged herein.

Dated: November 7, 2022 

Respectfully submitted, 

SHAMIS & GENTILE P.A.

/s/ Andrew Shamis

Andrew J. Shamis, Esq. 

Florida Bar No. 101754 

ashamis@shamisgentile.com

/s/ Garrett Berg

Garrett O. Berg, Esq. 

Florida Bar No. 1000427 

gberg@shamisgentile.com 

14 NE 1st Ave., Suite 705 

Miami, Florida 33132 

Tel: (305) 479-2299 

EDELSBERG LAW, P.A.

/s/ Scott Edelsberg

Scott Edelsberg, Esq. 

Florida Bar No. 0100537 

scott@edelsberglaw.com 

20900 NE 30th Ave., Suite 417 

Aventura, FL 33180 

Office: (786) 289-9471 

Direct: (305) 975-3320 

Fax: (786) 623-0915 

Counsel for Plaintiff and the Class. 

Case 1:22-cv-23644-CMA Document 1 Entered on FLSD Docket 11/07/2022 Page 35 of 35