1

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF TEXAS 

FORT WORTH DIVISION 

MERANDA PERLINGIERO, individually and 

on behalf of all others similarly situated, 

Plaintiff, 

v. 

ASTORIA COMPANY LLC, 

Defendant. 

 

Case No. 4:22-cv-97 

CLASS ACTION COMPLAINT 

JURY DEMAND 

COMPLEX

Plaintiff Meranda Perlingiero (“Plaintiff”), individually and on behalf of all others 

similarly situated (“Class Members”), brings this Class Action Complaint against Astoria 

Company LLC (“Astoria” or “Defendant”), and alleges upon personal knowledge as to her own 

actions and the investigation of her counsel, and upon information and belief as to all other matters, 

as follows: 

INTRODUCTION 

1. Plaintiff brings this Class Action Complaint against Defendant for its failure to 

adequately secure and safeguard electronically stored, personally identifiable information (“PII”) 

that Defendant collected and maintained, including, without limitation, first and last names, 

mailing addresses, email addresses, phone numbers, dates of birth, Social Security numbers and/or 

driver’s license number and state, and in some instances employment information. 

2. Astoria is a company that operates what is known as a “lead exchange,” which 

seeks to connect “consumers with the products and services they seek in near-real-time across 

multiple industries.” This includes “processing customer information in connection with 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 1 of 39 PageID 1
2

expressed interest in obtaining an auto loan, mortgage or other financial service.”1

3. As a result of its business, Astoria maintains contact details and other personal 

information about individuals even if the individuals have not had direct relationships with Astoria. 

4. Individuals entrust Defendant, or the companies that do business with Defendant, 

with an extensive amount of their sensitive PII. Defendant makes public statements that they 

understand the importance of protecting such information. For example, in its website Privacy 

Policy, Astoria represents that it “respects the privacy of its users,” and further represents that it 

takes “security of your Personally-Identifying Information seriously” and uses “reasonable 

electronic, personnel, and physical measures to protect it from loss, theft, alteration, or misuse.”2

5. Despite these proclamations, however, on or before February 8, 2021, Defendant 

learned that an unauthorized actor breached its system and accessed and acquired electronic files 

containing the PII of Defendant’s customers, including Plaintiff’s and Class Members’ data (the 

“Data Breach”). The data included, at least, Plaintiff’s and Class Members’ first and last name, 

mailing address, email address, phone number, date of birth, Social Security number and/or 

driver’s license number and state, and in some instances employment information. 

6. By obtaining, collecting, using, and deriving a benefit from Plaintiff’s and Class 

Members’ PII, Defendant assumed legal and equitable duties to those individuals. 

7. The exposed PII of Plaintiff and Class Members was, upon information and belief, 

already listed for sale on the dark web. Plaintiff and Class Members have already been the victims 

of actual fraud perpetrated with the PII stolen from Defendant, and face a present and immediate 

lifetime risk of identity theft, which is heightened here by the loss of their birthdates, Social 

Security numbers, and driver’s license numbers. 

1 See Exhibit A, Notice of Data Breach letter. 

2 https://astoriacompany.com/privacy-policy/ (last accessed February 1, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 2 of 39 PageID 2
3

8. This PII was compromised due to Defendant’s negligent, careless, and intentional 

acts and omissions and the failure to protect the PII of Plaintiff and Class Members. 

9. Plaintiff brings this action on behalf of all persons whose PII was compromised as 

a result of Defendant’s failure to: (i) adequately protect the PII of Plaintiff and Class Members; 

(ii) warn Plaintiff and Class Members of their inadequate information security practices; and (iii) 

avoid sharing the PII of Plaintiff and Class Members without adequate safeguards. Defendant’s 

conduct amounts to negligence and violates federal and state statutes. 

10. Plaintiff and Class Members have suffered concrete injury as a result of 

Defendant’s conduct. These injuries include: (i) fraudulent misuse of the stolen PII that is fairly 

traceable to this Data Breach; (ii) lost or diminished value of PII; (iii) out-of-pocket expenses 

associated with the prevention, detection, and recovery from identity theft and/or unauthorized use 

of their PII; (iv) lost opportunity costs associated with attempting to mitigate the actual 

consequences of the Data Breach, including but not limited to lost time, and (v) the present and 

immediate risk to their PII, which: (a) remains unencrypted and available for unauthorized third 

parties to access and abuse; and (b) may remain backed up in Defendant’s possession and is subject 

to further unauthorized disclosures so long as Defendant fails to undertake appropriate and 

adequate measures to protect the PII. 

11. Defendant disregarded the rights of Plaintiff and Class Members by intentionally, 

willfully, recklessly, or negligently failing to take and implement adequate and reasonable 

measures to ensure that Plaintiff’s and Class Members’ PII was safeguarded, failing to take 

available steps to prevent an unauthorized disclosure of data, and failing to follow applicable, 

required and appropriate protocols, policies and procedures regarding the encryption of data, even 

for internal use. As a result, the PII of Plaintiff and Class Members was compromised through 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 3 of 39 PageID 3
4

disclosure to an unknown and unauthorized criminal third party. Plaintiff and Class Members have 

a continuing interest in ensuring that their information is and remains safe, and they should be 

entitled to injunctive and other equitable relief. 

PARTIES 

12. Plaintiff Meranda Perlingiero is a resident and citizen the State of Missouri and 

intends to remain domiciled in and a citizen of the State of Missouri. 

13. Defendant Astoria Company LLC is a Delaware limited liability company with a 

principal place of business in Ft. Worth, Texas. 

14. All of Plaintiff’s claims stated herein are asserted against Defendant and any of 

their owners, predecessors, successors, subsidiaries, agents and/or assigns. 

JURISDICTION AND VENUE 

15. This Court has subject matter jurisdiction over this action under 28 U.S.C. 

§ 1332(d)(2) because this is a class action wherein the amount of controversy exceeds the sum or 

value of $5 million, exclusive of interest and costs, there are more than 100 members in the 

proposed class, and at least one member of the class is a citizen of a state different from Defendant. 

Plaintiff is a citizen of Missouri and therefore diverse from Defendant, which is headquartered in 

Texas. 

16. This Court has personal jurisdiction over Defendant because Astoria has its 

principal place of business within this District. On information and belief, some members of this 

Delaware limited liability company are also residents of Texas. 

17. Defendant is subject to the personal jurisdiction of the Court because it does or 

transacts business in, has agents in, or is otherwise found in and has purposely availed itself of the 

privilege of doing business in Texas and in this District, and because the alleged misconduct 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 4 of 39 PageID 4
5

occurred in and was directed to Texas and this District. 

18. Venue is proper in this District pursuant to 28 U.S.C. § 1391(b)(2) because a 

substantial part of the events or omissions giving rise to the claims occurred or were intentionally 

directed to residents and customers in this District. 

FACTUAL ALLEGATIONS 

Background 

19. Astoria operates a lead exchange, connecting consumers with the products and 

services they seek in near-real-time across multiple industries. This includes processing customer 

information in connection with expressed interest in obtaining an auto loan, mortgage or other 

financial service. As a result, Astoria maintains contact details and other PII about individuals even 

if Astoria has not had a direct relationship with those individuals. 

20. Plaintiff and Class Members relied on this sophisticated Defendant to keep their PII 

confidential and securely maintained, to use this information for business purposes only, and to 

make only authorized disclosures of this information. Plaintiff and Class Members demand 

security to safeguard their PII. 

21. Defendant had a duty to adopt reasonable measures to protect Plaintiff’s and Class 

Members’ PII from involuntary disclosure to third parties.

The Data Breach 

22. On its website, Defendant currently has posted an “Updated Summary of the 

Astoria Company 2021 Cyber-Attack.”3

 This summary was last updated March 29, 2021, and is 

therefore out of date. 

23. Despite the summary being out of date, Astoria admits in the summary that 

3 https://astoriacompany.com/cyber-update/ (last accessed February 4, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 5 of 39 PageID 5
6

cybercriminals were involved in this Data Breach: 

Two potential rogue actors were involved in the intrusion: User A, who Visited the site 

from Eastern-US IP Address and was subsequently traced to VPN servers located in 

Europe, and who we believe to be a cyber-criminal or hacker; and User B, who visited the 

site and browsed the database from a collection of three Central-US IP Addresses.4

24. Astoria also admits that the cybercriminals accessed its computer systems via a 

defunct WordPress site on an Astoria secondary server, that the cybercriminal gained access to the 

Astoria database, and that Astoria data was offered for sale on the dark web (or the Tor network).5

25. After nine months of denying that a data breach had even occurred, downplaying 

the extent of the data breach (claiming that only 70 people had PII compromised), and refusing to 

give notice of the Data Breach, on or about November 26, 2021, Defendant publicly announced 

that they experienced the Data Breach.6

 Defendant sent notice letters to various States’ Attorneys 

General and to approximately 940,00 individuals impacted by the Data Breach. The Notice to 

Plaintiff Perlingiero, for example, stated: 

Astoria Company (“Astoria”) investigated a cyber-attack and found that a third party may 

have obtained personal information about you. We are therefore providing notice to you of 

this event..7

26. Also in the notice to impacted individuals, Defendant stated: 

What happened? The following description is based on Astoria’s investigation to date: In 

late January 2021, an alleged security researcher, along with an associate, gained 

unauthorized access to an Astoria system which had a database of individuals’ personal 

information. The two individuals were able to obtain a portion of personal information 

maintained by the system, although the system prevented attempts to obtain further data. 

Astoria became aware of the intrusion on Feb 8, 2021 and took immediate steps to secure 

its systems and conduct an internal forensic investigation to determine what information 

was accessed during the intrusion. After many months of work, Astoria was able to obtain 

a copy of the data obtained by the security researcher and compare it with Astoria’s records. 

In an abundance of caution, Astoria is now notifying all individuals who were identified as 

potentially having sensitive data obtained during the incident. Additional technical details 

4 Id. 5 Id. 

6 See Exhibit A. 

7

 Exhibit A. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 6 of 39 PageID 6
7

about the cyber-attack are currently posted at https://astoriacompany.com/cyber-update/. 

Who was affected by this incident? The impacted information included first and last 

name, mailing address, email address, phone number, date of birth, social security number 

and/or driver’s license number and state, and in some instances employment information. 

What are we doing to protect your information? Astoria is implementing additional 

security measures to enhance the continued security of information in its care, and the 

incident has been reported to the FBI. 

Id. 

27. Defendant admits that an unauthorized criminal party “gained unauthorized access 

to” electronic files that contained sensitive PII belonging to Plaintiff and Class Members. 

Defendant also admits that the PII included “first and last name, mailing address, email address, 

phone number, date of birth, social security number and/or driver’s license number and state, and 

in some instances employment information.” Id. 

28. In response to the Data Breach, Defendant claims that it is “implementing 

additional security measures to enhance the continued security of information in its care.”8

However, the details of the root cause of the Data Breach, the vulnerabilities exploited, and the 

remedial measures undertaken to ensure a breach does not occur again have not been shared with 

the states’ Attorneys General or Plaintiff and Class Members, who retain a vested interest in 

ensuring that their information remains protected. 

29. What’s more, Defendant concedes Plaintiff and Class Members now face a present 

and immediate risk of identity theft because their sensitive PII has been stolen (‘obtained”) by 

criminals. In particular, Defendant warned Plaintiff and Class Members in the Notice to get a credit 

report, place a fraud alert, and place a security freeze”9

 

30. Plaintiff’s and Class Members’ non-encrypted information has already, or may in 

8

 Exhibit A. 

9

 Id. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 7 of 39 PageID 7
8

the immediate future, end up for sale on the dark web, or may simply fall into the hands of 

companies that will use the detailed PII for targeted marketing without the approval of Plaintiff 

and Class Members. Because of this Data Breach, unauthorized individuals have and can in the 

future easily access the PII of Plaintiff and Class Members. 

31. Defendant did not use reasonable security procedures and practices appropriate to 

the nature of the sensitive, non-encrypted information it was maintaining for Plaintiff and Class 

Members, causing their PII to be exposed. 

32. To prevent and detect cyber-attacks Defendant could and should have 

implemented, as recommended by the United States Government, the following measures: 

 Implement an awareness and training program. Because end users are targets, 

employees and individuals should be aware of the threat of ransomware and how it is 

delivered. 

 Configure firewalls to block access to known malicious IP addresses. 

 Patch operating systems, software, and firmware on devices. Consider using a 

centralized patch management system. 

 Set anti-virus and anti-malware programs to conduct regular scans automatically. 

 Manage the use of privileged accounts based on the principle of least privilege: no 

users should be assigned administrative access unless absolutely needed; and those 

with a need for administrator accounts should only use them when necessary. 

 Configure access controls—including file, directory, and network share permissions—

with least privilege in mind. If a user only needs to read specific files, the user should 

not have write access to those files, directories, or shares. 

 Disable macro scripts from office files transmitted via email. Consider using Office 

Viewer software to open Microsoft Office files transmitted via email instead of full 

office suite applications. 

 Implement Software Restriction Policies (SRP) or other controls to prevent programs 

from executing from common ransomware locations, such as temporary folders 

supporting popular Internet browsers or compression/decompression programs, 

including the AppData/LocalAppData folder. 

 Consider disabling Remote Desktop protocol (RDP) if it is not being used. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 8 of 39 PageID 8
9

 Use application whitelisting, which only allows systems to execute programs known 

and permitted by security policy. 

 Execute operating system environments or specific programs in a virtualized 

environment. 

 Categorize data based on organizational value and implement physical and logical 

separation of networks and data for different organizational units. 

33. To prevent and detect cyber-attacks Defendant could and should have 

implemented, as recommended by the United States Cybersecurity & Infrastructure Security 

Agency, the following measures: 

 Update and patch your computer. Ensure your applications and operating systems 

(OSs) have been updated with the latest patches. Vulnerable applications and OSs are 

the target of most ransomware attacks.... 

 Use and maintain preventative software programs. Install antivirus software, 

firewalls, and email filters—and keep them updated—to reduce malicious network 

traffic....10

34. To prevent and detect cyber-attacks attacks Defendant could and should have 

implemented, as recommended by the Microsoft Threat Protection Intelligence Team, the 

following measures: 

Secure internet-facing assets 

- Apply latest security updates 

- Use threat and vulnerability management 

- Perform regular audit; remove privileged credentials; 

Thoroughly investigate and remediate alerts 

- Prioritize and treat commodity malware infections as potential full 

compromise; 

Include IT Pros in security discussions 

- Ensure collaboration among [security operations], [security admins], and 

[information technology] admins to configure servers and other endpoints 

10 See Security Tip (ST19-001) Protecting Against Ransomware (original release date Apr. 11, 

2019), available at: https://us-cert.cisa.gov/ncas/tips/ST19-001 (last visited February 4, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 9 of 39 PageID 9
10

securely; 

Build credential hygiene 

- Use [multifactor authentication] or [network level authentication] and use 

strong, randomized, just-in-time local admin passwords; 

Apply principle of least-privilege 

- Monitor for adversarial activities 

- Hunt for brute force attempts 

- Monitor for cleanup of Event Logs 

- Analyze logon events; 

Harden infrastructure 

- Use Windows Defender Firewall 

- Enable tamper protection 

- Enable cloud-delivered protection 

- Turn on attack surface reduction rules and [Antimalware Scan Interface] for 

Office [Visual Basic for Applications].11

35. Given that Defendant was storing the PII of Plaintiff and Class Members, 

Defendant could and should have implemented all of the above measures to prevent and detect 

cyber-attacks. 

36. The occurrence of the Data Breach indicates that Defendant failed to adequately 

implement one or more of the above measures to prevent ransomware attacks, resulting in the Data 

Breach and the exposure of the PII of an undisclosed amount of current and former consumers, 

including Plaintiff and Class Members. 

Defendant Acquired, Collected and Stored Plaintiff’s and Class Members’ PII. 

37. Defendant acquired, collected, and stored Plaintiff’s and Class Members’ PII. 

38. As a condition of providing the full range of its website services, Defendant 

11 See Human-operated ransomware attacks: A preventable disaster (Mar 5, 2020), available at: 

https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-apreventable-disaster/ (last visited February 4, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 10 of 39 PageID 10
11

required that Plaintiff and Class Members entrust Defendant with highly sensitive, confidential 

PII. 

39. By obtaining, collecting, and storing the PII of Plaintiff and Class Members, 

Defendant assumed legal and equitable duties and knew or should have known that it was 

responsible for protecting the PII from disclosure. 

40. Plaintiff and Class Members have taken reasonable steps to maintain the 

confidentiality of their PII and relied on Defendant to keep their PII confidential and securely 

maintained, to use this information for business purposes only, and to make only authorized 

disclosures of this information. 

Securing PII and Preventing Breaches 

41. Defendant could have prevented this Data Breach by properly securing and 

encrypting the PII of Plaintiff and Class Members. Alternatively, Defendant could have destroyed 

the data that was no longer useful, especially outdated data. 

42. Defendant’s negligence in safeguarding the PII of Plaintiff and Class Members is 

exacerbated by the repeated warnings and alerts directed to businesses to protect and secure 

sensitive data. 

43. Despite the prevalence of public announcements of data breach and data security 

compromises, Defendant failed to take appropriate steps to protect the PII of Plaintiff and Class 

Members from being compromised. 

Defendant Failed to Comply with FTC Guidelines 

44. The Federal Trade Commission (“FTC”) has promulgated numerous guides for 

businesses which highlight the importance of implementing reasonable data security practices. 

According to the FTC, the need for data security should be factored into all business decisionCase 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 11 of 39 PageID 11
12

making. 

45. In 2016, the FTC updated its publication, Protecting Personal Information: A 

Guide for Business, which established cyber-security guidelines for businesses. The guidelines 

note that businesses should protect the personal customer information that they keep; properly 

dispose of personal information that is no longer needed; encrypt information stored on computer 

networks; understand their network’s vulnerabilities; and implement policies to correct any 

security problems.12 The guidelines also recommend that businesses use an intrusion detection 

system to expose a breach as soon as it occurs; monitor all incoming traffic for activity indicating 

someone is attempting to hack the system; watch for large amounts of data being transmitted from 

the system; and have a response plan ready in the event of a breach.13

46. The FTC further recommends that companies not maintain PII longer than is 

needed for authorization of a transaction; limit access to sensitive data; require complex passwords 

to be used on networks; use industry-tested methods for security; monitor for suspicious activity 

on the network; and verify that third-party service providers have implemented reasonable security 

measures. 

47. The FTC has brought enforcement actions against businesses for failing to 

adequately and reasonably protect customer data, treating the failure to employ reasonable and 

appropriate measures to protect against unauthorized access to confidential consumer data as an 

unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”), 15 

U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses must take 

to meet their data security obligations. 

12 Protecting Personal Information: A Guide for Business, Federal Trade Commission (2016). 

Available at https://www.ftc.gov/system/files/documents/plain-language/pdf-0136_protetingpersonal-information.pdf (last visited February 4, 2022). 

13 Id. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 12 of 39 PageID 12
13

48. Defendant failed to properly implement basic data security practices. 

49. Defendant’s failure to employ reasonable and appropriate measures to protect 

against unauthorized access to Plaintiff’s and Class Members’ PII constitutes an unfair act or 

practice prohibited by Section 5 of the FTC Act, 15 U.S.C. § 45. 

50. Defendant was at all times fully aware of its obligation to protect the PII of Plaintiff 

and Class Members. Defendant was also aware of the significant repercussions that would result 

from its failure to do so. 

Defendant Failed to Comply with Industry Standards 

51. Several best practices have been identified that at a minimum should be 

implemented by companies like Defendant, including but not limited to: educating all employees; 

strong passwords; multi-layer security, including firewalls, anti-virus, and anti-malware software; 

encryption, making data unreadable without a key; multi-factor authentication; backup data, and; 

limiting which employees can access sensitive data. Defendant failed to follow these industry best 

practices. 

52. Other best cybersecurity practices that are standard in the lead exchange industry 

include installing appropriate malware detection software; monitoring and limiting the network 

ports; protecting web browsers and email management systems; setting up network systems such 

as firewalls, switches and routers; monitoring and protection of physical security systems; 

protection against any possible communication system; training staff regarding critical points. 

Defendant failed to follow these cybersecurity best practices, including failure to train staff. 

53. Defendant failed to meet the minimum standards of any of the following 

frameworks: the NIST Cybersecurity Framework Version 1.1 (including without limitation 

PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 13 of 39 PageID 13
14

PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for 

Internet Security’s Critical Security Controls (CIS CSC), which are all established standards in 

reasonable cybersecurity readiness. 

54. These foregoing frameworks are existing and applicable industry standards in the 

healthcare industry, and Defendant failed to comply with these accepted standards thereby opening 

the door to the cyber incident and causing the data breach. 

Value of Personally Identifiable Information 

55. The Federal Trade Commission (“FTC”) defines identity theft as “a fraud 

committed or attempted using the identifying information of another person without authority.”14

The FTC describes “identifying information” as “any name or number that may be used, alone or 

in conjunction with any other information, to identify a specific person,” including, among other 

things, “[n]ame, Social Security number, date of birth, official State or government issued driver’s 

license or identification number, alien registration number, government passport number, 

employer or taxpayer identification number.”15

56. The PII of individuals remains of high value to criminals, as evidenced by the prices 

they will pay through the dark web. Numerous sources cite dark web pricing for stolen identity 

credentials. For example, Personal Information can be sold at a price ranging from $40 to $200, 

and bank details have a price range of $50 to $200.16 Experian reports that a stolen credit or debit 

14 17 C.F.R. § 248.201 (2013). 

15 Id. 16 Your personal data is for sale on the dark web. Here’s how much it costs, Digital Trends, Oct. 

16, 2019, available at: https://www.digitaltrends.com/computing/personal-data-sold-on-thedark-web-how-much-it-costs/ (last visited Jan. 19, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 14 of 39 PageID 14
15

card number can sell for $5 to $110 on the dark web.17 Criminals can also purchase access to entire 

company data breaches from $900 to $4,500.18 

57. Social Security numbers, for example, are among the worst kind of PII to have 

stolen because they may be put to a variety of fraudulent uses and are difficult for an individual to 

change. The Social Security Administration stresses that the loss of an individual’s Social Security 

number, as is the case here, can lead to identity theft and extensive financial fraud: 

A dishonest person who has your Social Security number can use it to get other 

personal information about you. Identity thieves can use your number and your 

good credit to apply for more credit in your name. Then, they use the credit cards 

and don’t pay the bills, it damages your credit. You may not find out that someone 

is using your number until you’re turned down for credit, or you begin to get calls 

from unknown creditors demanding payment for items you never bought. Someone 

illegally using your Social Security number and assuming your identity can cause 

a lot of problems.19

58. What is more, it is no easy task to change or cancel a stolen Social Security number. 

An individual cannot obtain a new Social Security number without significant paperwork and 

evidence of actual misuse. In other words, preventive action to defend against the possibility of 

misuse of a Social Security number is not permitted; an individual must show evidence of actual, 

ongoing fraud activity to obtain a new number. 

59. Even then, a new Social Security number may not be effective. According to Julie 

Ferguson of the Identity Theft Resource Center, “[t]he credit bureaus and banks are able to link 

the new number very quickly to the old number, so all of that old bad information is quickly 

17 Here’s How Much Your Personal Information Is Selling for on the Dark Web, Experian, Dec. 

6, 2017, available at: https://www.experian.com/blogs/ask-experian/heres-how-much-yourpersonal-information-is-selling-for-on-the-dark-web/ (last visited Jan 19, 2022). 

18 In the Dark, VPNOverview, 2019, available at: https://vpnoverview.com/privacy/anonymousbrowsing/in-the-dark/ (last visited Jan. 19, 2022). 

19 Social Security Administration, Identity Theft and Your Social Security Number, available at: 

https://www.ssa.gov/pubs/EN-05-10064.pdf (last visited Jan. 19, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 15 of 39 PageID 15
16

inherited into the new Social Security number.”20

60. Based on the foregoing, the information compromised in the Data Breach is 

significantly more valuable than the loss of, for example, credit card information in a retailer data 

breach because, there, victims can cancel or close credit and debit card accounts. The information 

compromised in this Data Breach is impossible to “close” and difficult, if not impossible, to 

change—Social Security number, driver’s license number, addresses, and financial information. 

61. This data demands a much higher price on the black market. Martin Walter, senior 

director at cybersecurity firm RedSeal, explained, “Compared to credit card information, 

personally identifiable information and Social Security numbers are worth more than 10x on the 

black market.”21

62. Among other forms of fraud, identity thieves may use Social Security numbers to 

obtain driver’s licenses, government benefits, medical services, and housing or even give false 

information to police. 

63. Driver’s license numbers are also incredibly valuable. “Hackers harvest license 

numbers because they’re a very valuable piece of information. A driver’s license can be a critical 

part of a fraudulent, synthetic identity – which go for about $1200 on the Dark Web. On its own, 

a forged license can sell for around $200.”22

64. According to national credit bureau Experian: 

20 Bryan Naylor, Victims of Social Security Number Theft Find It’s Hard to Bounce Back, NPR 

(Feb. 9, 2015), available at: http://www.npr.org/2015/02/09/384875839/data-stolen-by-anthem-shackers-has-millionsworrying-about-identity-theft (last visited Jan. 19, 2022). 

21 Time Greene, Anthem Hack: Personal Data Stolen Sells for 10x Price of Stolen Credit Card 

Numbers, IT World, (Feb. 6, 2015), available at: 

https://www.networkworld.com/article/2880366/anthem-hack-personal-data-stolen-sells-for-10xprice-of-stolen-credit-card-numbers.html (last visited February 4, 2022). 

22 https://www.forbes.com/sites/leemathews/2021/04/20/hackers-stole-customers-licensenumbers-from-geico-in-months-long-breach/?sh=3e4755c38658 (last accessed February 4, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 16 of 39 PageID 16
17

A driver’s license is an identity thief's paradise. With that one card, someone knows your 

birthdate, address, and even your height, eye color, and signature. If someone gets your 

driver's license number, it is also concerning because it's connected to your vehicle 

registration and insurance policies, as well as records on file with the Department of Motor 

Vehicles, place of employment (that keep a copy of your driver's license on file), doctor’s 

office, government agencies, and other entities. Having access to that one number can 

provide an identity thief with several pieces of information they want to know about you. 

Next to your Social Security number, your driver's license number is one of the 

most important pieces of information to keep safe from thieves.23

65. According to cybersecurity specialty publication CPO Magazine, “[t]o those 

unfamiliar with the world of fraud, driver’s license numbers might seem like a relatively harmless 

piece of information to lose if it happens in isolation.”24 However, this is not the case. As 

cybersecurity experts point out: 

It’s a gold mine for hackers. With a driver’s license number, bad actors can 

manufacture fake IDs, slotting in the number for any form that requires ID 

verification, or use the information to craft curated social engineering phishing 

attacks.25

66. Victims of driver’s license number theft also often suffer unemployment benefit 

fraud, as described in a recent New York Times article.26

67. The fraudulent activity resulting from the Data Breach may not come to light for 

years. 

68. There may be a time lag between when harm occurs versus when it is discovered, 

23 Sue Poremba, What Should I Do If My Driver’s License Number is Stolen?” (October 24, 

2018) https://www.experian.com/blogs/ask-experian/what-should-i-do-if-my-drivers-licensenumber-is-stolen/ (last accessed February 4, 2022). 

24 https://www.cpomagazine.com/cyber-security/geico-data-breach-leaks-drivers-licensenumbers-advises-customers-to-watch-out-for-fraudulent-unemployment-claims/ (last accessed 

February 4, 2022). 

25 Id. 26 How Identity Thieves Took My Wife for a Ride, NY Times, April 27, 2021 

https://www.nytimes.com/2021/04/27/your-money/identity-theft-auto-insurance.html (last 

accessed February 4, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 17 of 39 PageID 17
18

and also between when PII is stolen and when it is used. According to the U.S. Government 

Accountability Office (“GAO”), which conducted a study regarding data breaches: 

[L]aw enforcement officials told us that in some cases, stolen data may be held for 

up to a year or more before being used to commit identity theft. Further, once stolen 

data have been sold or posted on the Web, fraudulent use of that information may 

continue for years. As a result, studies that attempt to measure the harm resulting 

from data breaches cannot necessarily rule out all future harm.27

69. At all relevant times, Defendant knew, or reasonably should have known, of the 

importance of safeguarding the PII of Plaintiff and Class Members, including Social Security 

numbers, driver’s license numbers, and financial account information, and of the foreseeable 

consequences that would occur if Defendant’s data security system and network was breached, 

including, specifically, the significant costs that would be imposed on Plaintiff and Class Members 

as a result of a breach. 

70. Plaintiff and Class Members now face years of constant surveillance of their 

financial and personal records, monitoring, and loss of rights. The Class is incurring and will 

continue to incur such damages in addition to any fraudulent use of their PII. 

71. Defendant was, or should have been, fully aware of the unique type and the 

significant volume of data on Defendant’s server(s), amounting to potentially thousands of 

individuals’ detailed PII, and, thus, the significant number of individuals who would be harmed 

by the exposure of the unencrypted data. 

72. The injuries to Plaintiff and Class Members were directly and proximately caused 

by Defendant’s failure to implement or maintain adequate data security measures for the PII of 

Plaintiff and Class Members. 

73. The ramifications of Defendant’s failure to keep secure the PII of Plaintiff and Class 

27 Report to Congressional Requesters, GAO, at 29 (June 2007), available at: 

https://www.gao.gov/assets/gao-07-737.pdf (last visited Jan. 19, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 18 of 39 PageID 18
19

Members are long lasting and severe. Once PII is stolen, particularly Social Security numbers and 

financial information, fraudulent use of that information and damage to victims may continue for 

years. 

Plaintiff Meranda Perlingiero

74. Plaintiff Meranda Perlingiero is a resident and citizen the State of Missouri and 

intends to remain domiciled in and a citizen of the State of Missouri. 

75. Plaintiff Perlingiero received a letter dated November 26, 2021 from Defendant 

concerning the Data Breach. The letter stated that her first and last name, mailing address, email 

address, phone number, date of birth, Social Security number and/or driver’s license number and 

state, and in some instances employment information, were exposed in the Data Breach. 

76. Following the February 2021 Data Breach, in March 2021 an unauthorized party 

used Plaintiff Perlingiero’s PII to open a fraudulent account with Charles Schwab; in November 

2021, an unauthorized party used her PII to open multiple accounts with Vanguard, Metabank and 

Wells Fargo Bank; in December 2021, an unauthorized party used her PII to file an unemployment 

claim in her name; and in January 2022, an unauthorized party opened a Capital One checking 

account using Plaintiff Perlingiero’s PII. 

77. The actual fraud suffered by Plaintiff Perlingiero is fairly traceable to this Data 

Breach, as the type of PII stolen (most notably first and last name, mailing address, date of birth, 

Social Security number, and driver’s license number) is precisely the type of information that one 

would use to perpetrate the acts of fraud described herein. Moreover, the temporal proximity of 

the fraud to this Data Breach further demonstrates that Plaintiff Perlingiero’s injury is fairly 

traceable to this Data Breach. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 19 of 39 PageID 19
20

78. Since learning of the Data Breach, Plaintiff Perlingiero made reasonable efforts to 

mitigate the impact of the Data Breach, including but not limited to: researching the Data Breach; 

reviewing credit reports and financial account statements for any indications of actual or attempted 

identity theft or fraud; communications with various banking institutions regarding the multiple 

fraudulent accounts opened in her name and detailed above; implementing credit freezes; and 

contacting creditors and credit bureaus. Plaintiff Perlingiero has spent at least 48 hours dealing 

with the fallout from this Data Breach, valuable time Plaintiff Perlingiero otherwise would have 

spent on other activities, including but not limited to work and/or recreation. 

79. The Data Breach has caused Plaintiff Perlingiero emotional distress due to the 

release of her PII, which she believed would be protected from unauthorized access and disclosure, 

including anxiety about unauthorized parties viewing, selling, and/or using her PII for purposes of 

identity theft and fraud. Plaintiff Perlingiero is very concerned about identity theft and fraud, as 

well as the consequences of such identity theft and fraud resulting from the Data Breach. 

80. Plaintiff Perlingiero suffered actual injury from having his PII compromised as a 

result of the Data Breach including, but not limited to: (a) damage to and diminution in the value 

of his PII, a form of property that Defendant obtained from Plaintiff Perlingiero; (b) violation of 

her privacy rights; and (c) present, imminent and impending injury arising from the increased risk 

of identity theft and fraud. 

81. As a result of the Data Breach, Plaintiff Perlingiero anticipates spending 

considerable time and money on an ongoing basis to try to mitigate and address harms caused by 

the Data Breach. As a result of the Data Breach, Plaintiff Perlingiero is at a present risk and will 

continue to be at increased risk of identity theft and fraud for years to come. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 20 of 39 PageID 20
21

82. Plaintiff Perlingiero has suffered present and immediate injury arising from the 

actual financial fraud perpetrated against her, and the substantially increased risk of fraud, identity 

theft, and misuse resulting from her PII being placed in the hands of unauthorized third-parties and 

possibly criminals. 

83. Plaintiff Perlingiero has sustained actual damages as a result of the injuries, 

including the time spent mitigating the financial fraud perpetrated against her, the lost value of her 

PII, and emotional distress. 

84. Plaintiff Perlingiero has a continuing interest in ensuring that her PII, which, upon 

information and belief, remains backed up in Defendant’s possession, is protected and safeguarded 

from future breaches. 

CLASS ALLEGATIONS 

85. Plaintiff brings this suit on behalf of herself and a class of similarly situated 

individuals under Federal Rule of Civil Procedure 23, which is preliminarily defined as: 

All persons Astoria Company identified as being among those individuals 

impacted by the Data Breach, including all who were sent a notice of the Data 

Breach. 

86. Excluded from the Class are the following individuals and/or entities: Defendant 

and Defendant’s parents, subsidiaries, affiliates, officers and directors, and any entity in which 

Defendant has a controlling interest; all individuals who make a timely election to be excluded 

from this proceeding using the correct protocol for opting out; any and all federal, state or local 

governments, including but not limited to their departments, agencies, divisions, bureaus, boards, 

sections, groups, counsels and/or subdivisions; and all judges assigned to hear any aspect of this 

litigation, as well as their immediate family members. 

87. Plaintiff reserves the right to modify or amend the definition of the proposed class 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 21 of 39 PageID 21
22

before the Court determines whether certification is appropriate. 

88. This action is brought and may be maintained as a class action because there is a 

well-defined community of interest among many persons who comprise a readily ascertainable 

class. A well-defined community of interest exists to warrant class wide relief because Plaintiff 

and all members of the Classes were subjected to the same wrongful practices by Defendant, 

entitling them to the same relief. 

89. Numerosity. The Class Members are so numerous that joinder of all members is 

impracticable. Though the exact number and identities of Class Members are unknown at this time, 

public news reports indicate that approximately 940,000 individuals had their PII compromised in 

this Data Breach. The identities of Class Members are ascertainable through Astoria’s records, 

Class Members’ records, publication notice, self-identification, and other means. 

90. Commonality. There are questions of law and fact common to the Class, which 

predominate over any questions affecting only individual Class Members. These common 

questions of law and fact include, without limitation: 

a. Whether and to what extent Defendant had a duty to protect the PII of Plaintiff and 

Class Members; 

b. Whether Defendant had a duty not to disclose the PII of Plaintiff and Class Members 

to unauthorized third parties; 

c. Whether Defendant had a duty not to use the PII of Plaintiff and Class Members for 

non-business purposes; 

d. Whether Defendant failed to adequately safeguard the PII Plaintiff and Class 

Members; 

e. Whether and when Defendant actually learned of the Data Breach; 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 22 of 39 PageID 22
23

f. Whether Defendant adequately, promptly, and accurately informed Plaintiff and 

Class Members that their PII had been compromised; 

g. Whether Defendant violated the law by failing to promptly notify Plaintiff and Class 

Members that their PII had been compromised; 

h. Whether Defendant failed to implement and maintain reasonable security procedures 

and practices appropriate to the nature and scope of the information compromised in 

the Data Breach; 

i. Whether Defendant adequately addressed and fixed the vulnerabilities which 

permitted the Data Breach to occur; 

j. Whether Defendant engaged in unfair, unlawful, or deceptive practices by failing to 

safeguard the PII of Plaintiff and Class Members; 

k. Whether Plaintiff and Class Members are entitled to actual damages, nominal 

damages, and/or statutory damages as a result of Defendant’s wrongful conduct; 

l. Whether Plaintiff and Class Members are entitled to restitution as a result of 

Defendant’s wrongful conduct; and 

m. Whether Plaintiff and Class Members are entitled to injunctive relief to redress the 

imminent and currently ongoing harm faced as a result of the Data Breach. 

91. Typicality. Plaintiff’s claims are typical of those of other Class Members because 

Plaintiff’s PII, like that of every other Class member, was compromised in the Data Breach. 

92. Adequacy of Representation. Plaintiff will fairly and adequately represent and 

protect the interests of the Members of the Class. Plaintiff’s Counsel is competent and experienced 

in litigating Class actions, including data privacy litigation of this kind. 

93. Predominance. Astoria has engaged in a common course of conduct toward 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 23 of 39 PageID 23
24

Plaintiff and Class Members, in that all the Plaintiff’s and Class Members’ data was stored on the 

same computer systems and unlawfully accessed in the same way. The common issues arising 

from Defendant’s conduct affecting Class Members set out above predominate over any 

individualized issues. Adjudication of these common issues in a single action has important and 

desirable advantages of judicial economy. 

94. Superiority. A Class action is superior to other available methods for the fair and 

efficient adjudication of the controversy. Class treatment of common questions of law and fact is 

superior to multiple individual actions or piecemeal litigation. Absent a Class action, most Class 

Members would likely find that the cost of litigating their individual claims is prohibitively high 

and would therefore have no effective remedy. The prosecution of separate actions by individual 

Class Members would create a risk of inconsistent or varying adjudications with respect to 

individual Class Members, which would establish incompatible standards of conduct for Astoria. 

In contrast, the conduct of this action as a Class action presents far fewer management difficulties, 

conserves judicial resources and the parties’ resources, and protects the rights of each Class 

member. 

95. Astoria has acted on grounds that apply generally to the Class as a whole, so that 

Class certification, injunctive relief, and corresponding declaratory relief are appropriate on a 

Class-wide basis. 

96. Likewise, particular issues under Federal Rule 23(c)(4) are appropriate for 

certification because such claims present only particular, common issues, the resolution of which 

would advance the disposition of this matter and the parties’ interests therein. Such particular 

issues include, but are not limited to: 

a. Whether Astoria owed a legal duty to Plaintiff and the Class to exercise due care 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 24 of 39 PageID 24
25

in collecting, storing, and safeguarding their PII; 

b. Whether Astoria’s security measures to protect their data systems were 

reasonable in light of best practices recommended by data security experts; 

c. Whether Astoria’s failure to institute adequate protective security measures 

amounted to negligence; 

d. Whether Astoria failed to take commercially reasonable steps to safeguard 

consumer PII; and 

e. Whether adherence to FTC data security recommendations, and measures 

recommended by data security experts would have reasonably prevented the data 

breach. 

97. Finally, all members of the proposed Class are readily ascertainable. Astoria has access to 

Class Members’ names and addresses affected by the Data Breach. Class Members have already 

been preliminarily identified and sent notice of the Data Breach by Astoria. 

COUNT I 

Negligence 

(On Behalf of Plaintiff and the Class) 

98. Plaintiff and the Class re-allege and incorporate by reference herein all of the 

allegations contained in paragraphs 1 through 97. 

99. Astoria knowingly collected, came into possession of, and maintained Plaintiff’s 

and Class Members’ PII, and had a duty to exercise reasonable care in safeguarding, securing, and 

protecting such information from being compromised, lost, stolen, misused, and/or disclosed to 

unauthorized parties. 

100. Astoria had a duty under common law to have procedures in place to detect and 

prevent the loss or unauthorized dissemination of Plaintiff’s and Class Members’ PII. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 25 of 39 PageID 25
26

101. Defendant had full knowledge of the sensitivity of the PII and the types of harm 

that Plaintiff and Class Members could and would suffer if the PII were wrongfully disclosed. 

102. By assuming the responsibility to collect and store this data, and in fact doing so, 

and sharing it and using it for commercial gain, Defendant had a duty of care to use reasonable 

means to secure and safeguard their computer property—and Class Members’ PII held within it—

to prevent disclosure of the information, and to safeguard the information from theft. Defendant’s 

duty included a responsibility to implement processes by which they could detect a breach of its 

security systems in a reasonably expeditious period of time and to give prompt notice to those 

affected in the case of a data breach. 

103. Astoria had a duty to employ reasonable security measures under Section 5 of the 

Federal Trade Commission Act, 15 U.S.C. § 45, which prohibits “unfair. . . practices in or affecting 

commerce,” including, as interpreted and enforced by the FTC, the unfair practice of failing to use 

reasonable measures to protect confidential data. 

104. Defendant was subject to an “independent duty,” untethered to any contract 

between Defendant and Plaintiff or Class Members. 

105. A breach of security, unauthorized access, and resulting injury to Plaintiff and Class 

Members was reasonably foreseeable, particularly in light of Defendant’s inadequate security 

practices, including sharing and/or storing the PII of Plaintiff and Class Members on its computer 

systems. 

106. Plaintiff and Class Members were the foreseeable and probable victims of any 

inadequate security practices and procedures. Defendant knew or should have known of the 

inherent risks in collecting and storing the PII of Plaintiff and Class Members, the critical 

importance of providing adequate security of that PII, and the necessity for encrypting PII stored 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 26 of 39 PageID 26
27

on Defendant’s systems. 

107. Defendant’s own conduct created a foreseeable risk of harm to Plaintiff and Class 

Members. Defendant’s misconduct included, but was not limited to, their failure to take the steps 

and opportunities to prevent the Data Breach as set forth herein. Defendant’s misconduct also 

included their decisions not to comply with industry standards for the safekeeping of the PII of 

Plaintiff and Class Members, including basic encryption techniques freely available to Defendant. 

108. Plaintiff and Class Members had no ability to protect their PII that was in, and 

possibly remains in, Defendant’s possession. 

109. Defendant was in a position to protect against the harm suffered by Plaintiff and 

Class Members as a result of the Data Breach. 

110. Defendant had and continues to have a duty to adequately disclose that the PII of 

Plaintiff and Class Members within Defendant’s possession might have been compromised, how 

it was compromised, and precisely the types of data that were compromised and when. Such notice 

was necessary to allow Plaintiff and Class Members to take steps to prevent, mitigate, and repair 

any identity theft and the fraudulent use of their PII by third parties. 

111. Defendant had a duty to comply with the industry standards set out above. 

112. Astoria, through its actions and/or omissions, unlawfully breached its duties to 

Plaintiff and Class members by failing to exercise reasonable care in protecting and safeguarding 

Plaintiff’s and Class Members’ PII within Astoria’ possession. 

113. Astoria, through its actions and/or omissions, unlawfully breached its duty to 

Plaintiff and Class members by failing to have appropriate procedures in place to detect and 

prevent dissemination of Plaintiff’s and Class Members’ PII. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 27 of 39 PageID 27
28

114. Astoria, through its actions and/or omissions, unlawfully breached its duty to timely 

disclose to Plaintiff and Class Members that the PII within Astoria’ possession might have been 

compromised and precisely the type of information compromised. 

115. Astoria’s breach of duties owed to Plaintiff and Class Members caused Plaintiff’s 

and Class Members’ PII to be compromised. 

116. As a result of Astoria’s ongoing failure to notify Plaintiff and Class Members 

regarding the type of PII has been compromised, Plaintiff and Class Members are unable to take 

the necessary precautions to mitigate damages by preventing future fraud. 

117. Astoria’s breaches of duty caused Plaintiff and Class Members to suffer from 

identity theft, fraud, loss of time and money to monitor their finances for fraud, and loss of control 

over their PII. 

118. As a result of Astoria’s negligence and breach of duties, Plaintiff and Class 

Members are in danger of imminent harm in that their PII, which is still in the possession of third 

parties, will be used for fraudulent purposes. 

119. There is a close causal connection between Defendant’s failure to implement 

security measures to protect the PII of Plaintiff and Class Members and the harm, or risk of 

imminent harm, suffered by Plaintiff and Class Members. The PII of Plaintiff and Class Members 

was lost and accessed as the proximate result of Defendant’s failure to exercise reasonable care in 

safeguarding such PII, by adopting, implementing, and maintaining appropriate security measures. 

120. Plaintiff seeks the award of actual damages on behalf of herself and the Class. 

121. In failing to secure Plaintiff’s and Class Members’ PII and promptly notifying them 

of the Data Breach, Astoria is guilty of oppression, fraud, or malice, in that Astoria acted or failed 

to act with a willful and conscious disregard of Plaintiff’s and Class Members’ rights. Plaintiff, 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 28 of 39 PageID 28
29

therefore, in addition to seeking actual damages, seeks punitive damages on behalf of herself and 

the Class. 

122. Plaintiff seeks injunctive relief on behalf of the Class in the form of an order 

compelling Astoria to institute appropriate data collection and safeguarding methods and policies 

with regard to customer information. 

COUNT II 

Breach of Implied Contract 

(On Behalf of Plaintiff and the Class) 

123. Plaintiff and the Class re-allege and incorporate by reference herein all of the 

allegations contained in paragraphs 1 through 97. 

124. Through their course of conduct, Defendant, Plaintiff, and Class Members entered 

into implied contracts for the Defendant to implement data security adequate to safeguard and 

protect the privacy of Plaintiff’s and Class Members’ PII. 

125. Defendant induced Plaintiff and Class Members to provide and entrust their PII, 

including name, address, telephone number (work, home, mobile or other), email address, date of 

birth, driver’s license number, citizenship status, income, Social Security number, bank account 

information, employment information, home ownership information and active military 

information, as a condition obtaining full use of all Defendant’s services. Defendant states that 

refusal to provide this PII “may prevent the user from using certain Website features.”28

126. Defendant solicited and invited Plaintiff and Class Members to provide their PII as 

part of its regular business practices. Plaintiff and Class Members accepted Defendant’s offer and 

provided their PII to Defendant. 

28 https://astoriacompany.com/privacy-policy/ (last accessed February 2, 2022). 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 29 of 39 PageID 29
30

127. As a condition of being customers of Defendant, Plaintiff and Class Members 

provided and entrusted their PII to Defendant. In so doing, Plaintiff and Class Members entered 

into implied contracts with Defendant by which Defendant agreed to safeguard and protect such 

non-public information, to keep such information secure and confidential, and to timely and 

accurately notify Plaintiff and Class Members if their data had been breached and compromised 

or stolen. 

128. A meeting of the minds occurred when Plaintiff and Class Members agreed to, and 

did, provide their PII to Defendant, in exchange for, amongst other things, the protection of their 

Private Information. 

129. Plaintiff and Class Members fully performed their obligations under the implied 

contracts with Defendant. 

130. Defendant breached the implied contracts it made with Plaintiff and Class Members 

by failing to safeguard and protect their PII, and by failing to provide timely and accurate notice 

to them that their PII was compromised as a result of the Data Breach. 

131. As a direct and proximate result of Defendant’s above-described breach of implied 

contract, Plaintiff and Class Members have suffered (and will continue to suffer), ongoing, 

imminent, and impending threat of identity theft crimes, fraud, and abuse, resulting in monetary 

loss and economic harm; actual identity theft crimes, fraud, and abuse, resulting in monetary loss 

and economic harm; loss of the confidentiality of the stolen confidential data; the illegal sale of 

the compromised data on the dark web; expenses and/or time spent on credit monitoring and 

identity theft insurance; time spent scrutinizing bank statements, credit card statements, and credit 

reports; expenses and/or time spent initiating fraud alerts, decreased credit scores and ratings; lost 

work time; and other economic and non-economic harm. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 30 of 39 PageID 30
31

132. As a direct and proximate result of Defendant’s breach of the implied contracts, 

Plaintiff and Class Members sustained damages as alleged herein. 

133. Plaintiff and Class Members are entitled to compensatory, consequential, and 

nominal damages suffered as a result of the Data Breach, including the loss of the benefit of the 

bargain. 

COUNT III 

Invasion of Privacy 

(On Behalf of Plaintiff and the Class) 

134. Plaintiff and the Class re-allege and incorporate by reference herein all of the 

allegations contained in paragraphs 1 through 97. 

135. Plaintiff and Class Members had a legitimate expectation of privacy to their PII and 

were entitled to the protection of this information against disclosure to unauthorized third parties. 

136. Defendant owed a duty to Plaintiff and Class Members to keep their PII 

confidential. 

137. Defendant intentionally failed to protect and released to unknown and unauthorized 

third parties the non-redacted and non-encrypted PII of Plaintiff and Class Members. 

138. Defendant allowed unauthorized and unknown third parties access to and 

examination of the PII of Plaintiff and Class Members, by way of Defendant’s failure to protect 

the PII. 

139. The unauthorized release to, custody of, and examination by unauthorized third 

parties of the PII of Plaintiff and Class Members is highly offensive to a reasonable person. 

140. The intrusion was into a place or thing, which was private and is entitled to be 

private. Plaintiff and Class Members disclosed their PII to Defendant as part of their relationships 

with Defendant, but privately with an intention that the PII would be kept confidential and would 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 31 of 39 PageID 31
32

be protected from unauthorized disclosure. Plaintiff and Class Members were reasonable in their 

belief that such information would be kept private and would not be disclosed without their 

authorization. 

141. The Data Breach at the hands of Defendant constitutes an intentional interference 

with Plaintiff’s and Class Members’ interest in solitude or seclusion, either as to their persons or 

as to their private affairs or concerns, of a kind that would be highly offensive to a reasonable 

person. 

142. Defendant acted with intention and a knowing state of mind when it permitted the 

Data Breach to occur because it was with actual knowledge that its information security practices 

were inadequate and insufficient. 

143. Because Defendant acted with this knowing state of mind, it had notice and knew 

the inadequate and insufficient information security practices would cause injury and harm to 

Plaintiff and Class Members. 

144. As a proximate result of the above acts and omissions of Defendant, the PII of 

Plaintiff and Class Members was disclosed to third parties without authorization, causing Plaintiff 

and Class Members to suffer damages. 

145. Unless and until enjoined, and restrained by order of this Court, Defendant’s 

wrongful conduct will continue to cause great and irreparable injury to Plaintiff and Class 

Members in that the PII maintained by Defendant can be viewed, distributed, and used by 

unauthorized persons for years to come. Plaintiff and Class Members have no adequate remedy at 

law for the injuries in that a judgment for monetary damages will not end the invasion of privacy 

for Plaintiff and Class Members. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 32 of 39 PageID 32
33

COUNT IV 

Unjust Enrichment 

(On Behalf of Plaintiff and the Class) 

146. Plaintiff and the Class re-allege and incorporate by reference herein all of the 

allegations contained in paragraphs 1 through 97. 

147. This count is plead in the alternative to the breach of implied contract count above. 

148. Plaintiff and Class Members conferred a monetary benefit to Defendant when they 

provided their PII to receive Defendant’s services. 

149. Defendant knew that Plaintiff and Class Members conferred a monetary benefit to 

Defendant when it accepted and retained that benefit. Defendant profited from this monetary 

benefit, as the transmission of PII to those companies to whom Defendant makes service referrals 

is an integral part of Astoria’s business. Without transmitting Plaintiff’s and Class Members’ PII 

to third-parties, Defendant would have dramatically diminished business and profits. 

150. Defendant was supposed to use some of the monetary benefit provided to it from 

Plaintiff and Class Members to secure the PII belonging to Plaintiff and Class Members by paying 

for costs of adequate data management and security. 

151. Defendant should not be permitted to retain any monetary benefit belonging to 

Plaintiff and Class Members because Defendant failed to implement necessary security measures 

to protect the PII of Plaintiff and Class Members. 

152. Defendant gained access to the Plaintiff’s and Class Members’ PII through 

inequitable means because Defendant failed to disclose that it used inadequate security measures. 

153. Plaintiff and Class Members were unaware of the inadequate security measures and 

would not have provided their PII to Defendant had they known of the inadequate security 

measures. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 33 of 39 PageID 33
34

154. To the extent that this cause of action is pled in the alternative to the others, Plaintiff 

and Class Members have no adequate remedy at law. 

155. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class 

Members have suffered and will suffer injury, including but not limited to: (i) actual identity theft; 

(ii) the loss of the opportunity how their PII is used; (iii) the compromise and/or theft of their PII; 

(iv) out-of-pocket expenses associated with the prevention, detection, and recovery from identity 

theft, tax fraud, and/or unauthorized use of their PII; (v) lost opportunity costs associated with 

effort expended and the loss of productivity addressing and attempting to mitigate the actual and 

future consequences of the Data Breach, including but not limited to efforts spent researching how 

to prevent, detect, contest, and recover from tax fraud and identity theft; (vi) costs associated with 

placing freezes on credit reports; (vii) the continued risk to their PII, which remain in Defendant’s 

possession and is subject to further unauthorized disclosures so long as Defendant fails to 

undertake appropriate and adequate measures to protect the PII of Plaintiff and Class Members; 

and (viii) future costs in terms of time, effort, and money that will be expended to prevent, detect, 

contest, and repair the impact of the PII compromised as a result of the Data Breach for the 

remainder of the lives of Plaintiff and Class Members. 

156. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class 

Members have suffered and will continue to suffer other forms of injury and/or harm, including, 

but not limited to, anxiety, emotional distress, loss of privacy, and other economic and noneconomic losses. 

157. Defendant should be compelled to disgorge into a common fund or constructive 

trust, for the benefit of Plaintiff and Class Members, proceeds from the monetary benefit that it 

unjustly received from them. 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 34 of 39 PageID 34
35

PRAYER FOR RELIEF

WHEREFORE, Plaintiff, on behalf of herself and Class Members, requests judgment 

against Defendant and that the Court grant the following: 

A. For an Order certifying the Class, and appointing Plaintiff and her Counsel to 

represent the Class; 

B. For equitable relief enjoining Defendant from engaging in the wrongful conduct 

complained of herein pertaining to the misuse and/or disclosure of the PII of 

Plaintiff and Class Members; 

C. For injunctive relief requested by Plaintiff, including but not limited to, injunctive 

and other equitable relief as is necessary to protect the interests of Plaintiff and 

Class Members, including but not limited to an order: 

i. prohibiting Defendant from engaging in the wrongful and unlawful acts 

described herein; 

ii. requiring Defendant to protect, including through encryption, all data collected 

through the course of its business in accordance with all applicable regulations, 

industry standards, and federal, state or local laws; 

iii. requiring Defendant to delete, destroy, and purge the personal identifying 

information of Plaintiff and Class Members unless Defendant can provide to 

the Court reasonable justification for the retention and use of such information 

when weighed against the privacy interests of Plaintiff and Class Members; 

iv. requiring Defendant to implement and maintain a comprehensive Information 

Security Program designed to protect the confidentiality and integrity of the PII 

of Plaintiff and Class Members; 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 35 of 39 PageID 35
36

v. prohibiting Defendant from maintaining the PII of Plaintiff and Class Members 

on a cloud-based database; 

vi. requiring Defendant to engage independent third-party security 

auditors/penetration testers as well as internal security personnel to conduct 

testing, including simulated attacks, penetration tests, and audits on 

Defendant’s systems on a periodic basis, and ordering Defendant to promptly 

correct any problems or issues detected by such third-party security auditors; 

vii. requiring Defendant to engage independent third-party security auditors and 

internal personnel to run automated security monitoring; 

viii. requiring Defendant to audit, test, and train its security personnel regarding any 

new or modified procedures; 

ix. requiring Defendant to segment data by, among other things, creating firewalls 

and access controls so that if one area of Defendant’s network is compromised, 

hackers cannot gain access to other portions of Defendant’s systems; 

x. requiring Defendant to conduct regular database scanning and securing checks; 

xi. requiring Defendant to establish an information security training program that 

includes at least annual information security training for all employees, with 

additional training to be provided as appropriate based upon the employees’ 

respective responsibilities with handling personal identifying information, as 

well as protecting the personal identifying information of Plaintiff and Class 

Members; 

xii. requiring Defendant to routinely and continually conduct internal training and 

education, and on an annual basis to inform internal security personnel how to 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 36 of 39 PageID 36
37

identify and contain a breach when it occurs and what to do in response to a 

breach; 

xiii. requiring Defendant to implement a system of tests to assess its respective 

employees’ knowledge of the education programs discussed in the preceding 

subparagraphs, as well as randomly and periodically testing employees’ 

compliance with Defendant’s policies, programs, and systems for protecting 

personal identifying information; 

xiv. requiring Defendant to implement, maintain, regularly review, and revise as 

necessary a threat management program designed to appropriately monitor 

Defendant’s information networks for threats, both internal and external, and 

assess whether monitoring tools are appropriately configured, tested, and 

updated; 

xv. requiring Defendant to meaningfully educate all Class Members about the 

threats that they face as a result of the loss of their confidential personal 

identifying information to third parties, as well as the steps affected individuals 

must take to protect themselves; 

xvi. requiring Defendant to implement logging and monitoring programs sufficient 

to track traffic to and from Defendant’s servers; and for a period of 10 years, 

appointing a qualified and independent third party assessor to conduct a SOC 2 

Type 2 attestation on an annual basis to evaluate Defendant’s compliance with 

the terms of the Court’s final judgment, to provide such report to the Court and 

to counsel for the class, and to report any deficiencies with compliance of the 

Court’s final judgment; 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 37 of 39 PageID 37
38

D. For an award of damages, including actual, nominal, statutory, consequential, and 

punitive damages, as allowed by law in an amount to be determined; 

E. For an award of attorneys’ fees, costs, and litigation expenses, as allowed by law; 

F. For prejudgment interest on all amounts awarded; and 

G. Such other and further relief as this Court may deem just and proper. 

DEMAND FOR JURY TRIAL 

Plaintiff hereby demands that this matter be tried before a jury. 

Date: February 7, 2022 Respectfully Submitted, 

/s/ Joe Kendall_____________________ 

JOE KENDALL 

Texas Bar No. 11260700 

KENDALL LAW GROUP, PLLC 

3811 Turtle Creek Blvd., Suite 1450 

Dallas, Texas 75219 

214-744-3000 / 214-744-3015 (Facsimile) 

jkendall@kendalllawgroup.com 

M. ANDERSON BERRY (pro hac vice

forthcoming) 

CLAYEO C. ARNOLD, 

A PROFESSIONAL LAW CORP. 

865 Howe Avenue 

Sacramento, CA 95825 

Telephone: (916) 777-7777 

Facsimile: (916) 924-1829 

aberry@justice4you.com 

Gary M. Klinger (pro hac vice forthcoming) 

MASON LIETZ & KLINGER LLP 

227 W. Monroe Street, Suite 2100 

Chicago, IL 60606 

Phone: (202) 429-2290 

Fax: (202) 429-2294 

gklinger@masonllp.com 

 

David Lietz (pro hac vice forthcoming) 

DC Bar No. 430557 

MASON LIETZ & KLINGER LLP 

5101 Wisconsin Avenue NW, Suite 305 

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 38 of 39 PageID 38
39

Washington, DC 20016 

Tel.: (202) 640-1160 

dlietz@masonllp.com 

Attorneys for Plaintiff and the Putative Class

Case 4:22-cv-00097-O Document 1 Filed 02/07/22 Page 39 of 39 PageID 39