1 

UNITED STATES DISTRICT COURT FOR THE 

NORTHERN DISTRICT OF TEXAS 

DALLAS DIVISION 

Terrell Cline, on behalf of himself and all 

others similarly situated, 

 Plaintiff, 

v. 

Inline Network Integration LLC. 

 Defendant. 

§ 

§ 

§ 

§ 

§ 

§ 

§ 

§ 

§ 

Case No. 3:22-cv-1711 

 

PLAINTIFF’S ORIGINAL CLASS ACTION COMPLAINT

Plaintiff Terrell Cline (“Plaintiff”), individually and on behalf of all others similarly 

situated, brings this Class Action Petition against Defendant Inline Network Integration LLC 

(hereinafter known as “Inline” or “Defendant”), a Texas limited liability company, to obtain 

damages, restitution, and injunctive relief for the Class, as defined below, from Defendant. 

Plaintiff makes the following allegations upon information and belief, except as to his own actions, 

the investigation of counsel, and facts that are a matter of public record and also will likely have 

further evidentiary support after a reasonable opportunity for further investigation or discovery. 

I. NATURE OF THE ACTION

1. This class action arises out of the recent targeted cyberattack against Defendant 

Inline—a company that ironically offers IT data protection services for its customers. Defendant 

allowed a third party to access Defendant’s computer systems and data, resulting in the 

compromise of highly sensitive personal information belonging to consumers whose data was 

within Inline’s system (the “Data Breach”). Because of the Data Breach, Plaintiff and other 

victims (“Class Members”) suffered ascertainable losses in the form of the loss of the benefit of 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 1 of 36 PageID 1
2 

their bargain, out-of-pocket expenses and the value of their time reasonably incurred to remedy 

or mitigate the effects of the attack, emotional distress, and the imminent risk of future harm 

caused by the compromise of their sensitive personal information. 

2. Upon information and belief, the information compromised in the Data Breach is 

confidential personally identifiable information of consumers (collectively the “Private 

Information”). 

3. Plaintiff brings this class action lawsuit on behalf of those similarly situated to 

address Defendant’s inadequate safeguarding of Class Members’ Private Information that it 

collected and maintained, and for failing to provide timely and adequate notice to Plaintiff and 

other Class Members that their Private Information had been subject to the unauthorized access of 

an unknown third party or precisely what specific type of information was accessed. 

4. On information and belief, Defendant maintained the Private Information in a 

reckless manner. In particular, the Private Information was maintained on Defendant’s computer 

network in a condition vulnerable to a cyberattack. Upon information and belief, the mechanism 

of the Data Breach and potential for improper disclosure of Plaintiff’s and Class Members’ Private 

Information was a known risk to Defendant, and thus Defendant was on notice that failing to take 

steps necessary to secure the Private Information from those risks left that property in a dangerous 

condition. 

5. In addition, on information and belief, Defendant failed to properly monitor the 

computer network and IT systems that housed the Private Information. 

6. Plaintiff’s and Class Members’ identities are now at risk because of Defendant’s 

negligent conduct since the Private Information that Defendant collected and maintained is now in 

the hands of data thieves. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 2 of 36 PageID 2
3 

7. Armed with the Private Information accessed in the Data Breach, data thieves can 

commit a variety of crimes including, e.g., opening new financial accounts in Class Members’ 

names, taking out loans in Class Members’ names, using Class Members’ names to obtain medical 

services, using Class Members’ information to obtain government benefits, filing fraudulent tax 

returns using Class Members’ information, obtaining driver’s licenses in Class Members’ names 

but with another person’s photograph, and giving false information to police during an arrest, 

which could foreseeably result in the erroneous arrest of class members in the future. 

8. As a result of the Data Breach, Plaintiff and Class Members have been exposed to 

a heightened and imminent risk of fraud and identity theft. Plaintiff and Class Members must now 

and in the future closely monitor their financial accounts to guard against identity theft. 

9. Plaintiff and Class Members may also incur out of pocket costs for, e.g., purchasing 

credit monitoring services, credit freezes, credit reports, or other protective measures to deter and 

detect identity theft. 

10. By his Complaint, Plaintiff seeks to remedy these harms on behalf of himself and 

all similarly situated individuals whose Private Information was accessed during the Data Breach. 

11. Plaintiff seeks remedies including, but not limited to, compensatory damages, 

reimbursement of out-of-pocket costs, and injunctive relief including improvements to 

Defendant’s data security systems, future annual audits, and adequate credit monitoring services 

funded by Defendant. 

12. Accordingly, Plaintiff brings this action against Defendant seeking redress for its 

unlawful conduct, and asserting claims for: (i) negligence, (ii) breach of implied contract; (iii) 

negligence per se; (iv) breach of fiduciary duty; (v) intrusion upon seclusion/invasion of privacy 

and (vi) unjust enrichment. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 3 of 36 PageID 3
4 

II. PARTIES

Plaintiff 

13. Plaintiff Terrell Cline is a natural person, resident, and a citizen of the State of 

Mississippi. Defendant obtained and continues to maintain Plaintiff’s Private Information, and 

Defendant owed him a legal duty and obligation to protect that Private Information from 

unauthorized access and disclosure. Plaintiff would not have entrusted his Private Information to 

Defendant had he known that Defendant failed to maintain adequate data security. Plaintiff’s 

Private Information was compromised and disclosed as a result of Defendant’s inadequate data 

security, which resulted in the Data Breach. 

14. On July 19, 2022, Plaintiff received a form notice letter from Defendant dated July 

14, 2022, stating that Inline had experienced a “recent data security event” that may have involved 

Plaintiff’s information. The letter stated that more four months earlier, on March 12, 2022, 

Defendant became aware of “unusual activity within its digital environment.” After an 

investigation, Inline determined “an unauthorized actor may have acquired some Inline customer 

data” and that Inline determined some of Plaintiff’s information may have been involved in the 

incident. 

15. Inline’s form letter did not identify what personal information of Plaintiff’s had 

been compromised. The letter also did not identify how Inline obtained Plaintiff’s Personal 

Information in the first place. 

16. Defendant is a Texas limited liability company with its principal place of business 

and headquarters in Addison, Dallas County, Texas. 

III. JURISDICTION AND VENUE

17. This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. 

§ 1332(d)(2) in that (1) this action is a class action with more than one hundred (100) Class 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 4 of 36 PageID 4
5 

Members; (2) Defendant is a Texas limited liability company and is a citizen of Texas; (3) 

Plaintiff and all Class Members are United States citizens and Plaintiff is a citizen of 

Mississippi, thus satisfying the minimal diversity requirement of 28 U.S.C. § 1332(d)(2)(A); 

and (4) the matter in controversy exceeds the sum or value of $5,000,000 exclusive of interests 

and costs. 

18. Venue is proper in this District under 28 U.S.C. § 1391(b)(2) because Defendant 

maintains its principal place of business in the Dallas Division of the Northern District of Texas 

and a substantial part of the events or omissions giving rise to the claim occurred in the Dallas 

Division of the Northern District of Texas. 

IV. DEFENDANT’S BUSINESS

19. Defendant is an IT managed services provider, helping businesses across the U.S. 

with IT support, systems management, data protection services and help desk services. 

20. In the ordinary course of business, Defendant’s customers must provide 

Defendant with certain Personal Information in order to receive Defendant’s services. 

21. Defendant agreed to and undertook legal duties to maintain the Personal 

Information entrusted to it by Plaintiff and Class Members safely, confidentially, and in 

compliance with all applicable laws. 

22. Defendant held the Private Information of Plaintiff and Class Members. 

23. By obtaining, collecting, using, and deriving a benefit from Plaintiff’s and Class 

Members’ Private Information, Defendant assumed legal and equitable duties and knew or should 

have known that it was responsible to protect Plaintiff’s and Class Members’ Private Information 

from unauthorized disclosure. 

24. Plaintiff and Class Members have taken reasonable steps to maintain the 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 5 of 36 PageID 5
6 

confidentiality of their Private Information. 

25. Plaintiff and Class Members relied on Defendant to keep their Private Information 

confidential and securely maintained, and to make only authorized disclosures of this 

information. 

V. THE CYBERATTACK

26. In mid-July 2022, Defendant publicly disclosed that months earlier, on or about 

March 12, 2022, Defendant had detected “unusual activity” on its IT servers. Defendant informed 

the public that after an investigation, Defendant determined cybercriminals accessed its network. 

Defendant has not disclosed what personal information was compromised or when it determined 

who was affected. Inexplicably it took Inline four months after the Data Breach to inform victims 

their Personal Information had been compromised. 

27. Upon information and belief, thousands of consumers had their Private 

Information exposed in the Data Breach. 

28. The Private Information contained in the files accessed by hackers was not 

encrypted. 

29. Upon information and belief, the targeted Data Breach was expressly designed to 

gain access to private and confidential data of Plaintiff and the Class Members. 

30. Because of the Data Breach, data thieves were able to gain access to and hold 

hostage Defendant’s IT systems and, were able to compromise, access, and acquire the protected 

Private Information of Plaintiff and Class Members. 

31. Defendant had obligations created by contract law, industry standards, common 

law, and its own promises and representations made to Plaintiff and Class Members to keep their 

Private Information confidential and to protect it from unauthorized access and disclosure. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 6 of 36 PageID 6
7 

32. Defendant’s data security obligations were particularly important given the 

substantial increase in cyberattacks and/or data breaches in recent years. 

33. In 2021, a record 1,862 data breaches occurred, resulting in approximately 

293,927,708 sensitive records being exposed, a 68% increase from 2020.1 Of the 1,862 recorded 

data breaches, 330 of them, or 17.7% were in the medical or healthcare industry.2 The 330 

reported breaches reported in 2021 exposed nearly 30 million sensitive records (28,045,658), 

compared to only 306 breaches that exposed nearly 10 million sensitive records (9,700,238) in 

2020.3

34. Indeed, cyberattacks have become so notorious that the Federal Bureau of 

Investigation (“FBI”) and U.S. Secret Service have issued a warning to potential targets, so they 

are aware of, and prepared for, a potential attack. As one report explained, “[e]ntities like smaller 

municipalities and hospitals are attractive to ransomware criminals . . . because they often have 

lesser IT defenses and a high incentive to regain access to their data quickly.”4

35. In fact, according to the cybersecurity firm Mimecast, 90% of healthcare 

organizations experienced cyberattacks in the past year.5

36. Moreover, Defendant is an IT services firm and accordingly should be aware of 

the importance of safeguarding consumers’ Private Information, the increased prevalence of 

targeted cyber-attacks, the risks associated with maintaining Private Information, and the 

consequences to consumers should the integrity of the Private Information be compromised. 

1

 See 2021 Data Breach Annual Report (ITRC, Jan. 2022) (available at https://notified.idtheftcenter.org/s/), at 6. 2

 Id. 3

 Id. 4

 FBI, Secret Service Warn of Targeted, Law360 (Nov. 18, 2019), https://www.law360.com/articles/1220974/fbisecret-service-warn-of-targeted-ransomware (last visited August 1, 2022). 5

 See Maria Henriquez, Iowa City Hospital Suffers Phishing Attack, Security Magazine (Nov. 23, 2020), 

https://www.securitymagazine.com/articles/93988-iowa-city-hospital-suffers-phishing-attack (last visited August 1, 

2022). 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 7 of 36 PageID 7
8 

37. Therefore, the increase in such attacks, and attendant risk of future attacks, was 

widely known to the public and to anyone in Defendant’s industry, including Defendant. 

Defendant Fails to Comply with FTC Guidelines 

38. The Federal Trade Commission (“FTC”) has promulgated numerous guides for 

businesses which highlight the importance of implementing reasonable data security practices. 

According to the FTC, the need for data security should be factored into all business decisionmaking. 

39. In 2016, the FTC updated its publication, Protecting Personal Information: A 

Guide for Business, which established cyber-security guidelines for businesses. The guidelines 

note that businesses should protect the personal information that they keep; properly dispose of 

personal information that is no longer needed; encrypt information stored on computer networks; 

understand their network’s vulnerabilities; and implement policies to correct any security 

problems.6

 The guidelines also recommend that businesses use an intrusion detection system to 

expose a breach as soon as it occurs; monitor all incoming traffic for activity indicating someone 

is attempting to hack the system; watch for large amounts of data being transmitted from the 

system; and have a response plan ready in the event of a breach.7

40. The FTC further recommends that companies not maintain PII longer than is 

needed for authorization of a transaction; limit access to sensitive data; require complex passwords 

to be used on networks; use industry-tested methods for security; monitor for suspicious activity 

on the network; and verify that third-party service providers have implemented reasonable security 

measures. 

6

 Protecting Personal Information: A Guide for Business, Federal Trade Commission (2016). Available at 

https://www.ftc.gov/system/files/documents/plain-language/pdf-0136_proteting-personal-information.pdf (last 

visited August 1, 2022).

7

 Id. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 8 of 36 PageID 8
9 

41. The FTC has brought enforcement actions against businesses for failing to 

adequately and reasonably protect data, treating the failure to employ reasonable and appropriate 

measures to protect against unauthorized access to confidential consumer data as an unfair act or 

practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”), 15 U.S.C. § 45. 

Orders resulting from these actions further clarify the measures businesses must take to meet 

their data security obligations. 

42. Defendant failed to properly implement basic data security practices. 

43. Defendant was at all times fully aware of its obligation to protect the Private 

Information of persons who had provided it to Defendant. Defendant was also aware of the 

significant repercussions that would result from its failure to do so.

Defendant Fails to Comply with Industry Standards

44. Several best practices have been identified that at a minimum should be 

implemented by businesses like Defendant, including but not limited to: educating all employees; 

strong passwords; multi-layer security, including firewalls, anti-virus, and anti- malware 

software; encryption, making data unreadable without a key; multi-factor authentication; backup 

data; and limiting which employees can access sensitive data. 

45. Other best cybersecurity practices that are standard include installing appropriate 

malware detection software; monitoring and limiting the network ports; protecting web browsers 

and email management systems; setting up network systems such as firewalls, switches, and 

routers; monitoring and protection of physical security systems; protection against any possible 

communication system; and training staff regarding critical points. 

46. Defendant failed to meet the minimum standards of any of the following 

frameworks: the NIST Cybersecurity Framework Version 1.1 (including without limitation 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 9 of 36 PageID 9
10 

PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, 

PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for 

Internet Security’s Critical Security Controls (CIS CSC), which are all established standards in 

reasonable cybersecurity readiness. 

47. These foregoing frameworks are existing and applicable industry standards, and 

Defendant failed to comply with these accepted standards, thereby opening the door to and 

causing the Data Breach.

VI. DEFENDANT’S NEGLIGENT ACTS AND BREACH

48. Defendant breached its obligations to Plaintiff and Class Members and/or was 

otherwise negligent and reckless because it failed to properly maintain and safeguard its computer 

systems and data. Defendant’s unlawful conduct includes, but is not limited to, the following acts 

and/or omissions: 

a. Failing to maintain an adequate data security system to reduce the risk of 

data breaches; 

b. Failing to adequately protect consumers’ Private Information; 

c. Failing to properly monitor its own data security systems for existing 

intrusions; 

d. Failing to train its employees in the proper handling of emails containing 

the means by which the cyberattacks were able to first access Defendant’s 

networks, and to maintain adequate email security practices; 

e. Failing to put into place proper procedures, software settings, and data 

security software protections to adequately protect against a blunt force 

intrusion; 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 10 of 36 PageID 10
11 

f. Failing to comply with FTC guidelines for cybersecurity, in violation of 

Section 5 of the FTC Act; and 

g. Failing to adhere to industry standards for cybersecurity. 

49. As the result of antivirus and malware protection software in dire need of security 

updating, inadequate procedures for handling phishing emails or emails containing viruses or other 

malignant computer code, and other failures to maintain its networks in configuration that would 

protect against cyberattacks, Defendant negligently and unlawfully failed to safeguard Plaintiff’ 

and Class Members’ Private Information by allowing cyberthieves to access Defendant’s IT 

systems and remove data which contained unsecured and unencrypted Private Information. 

50. Defendant’s conduct is all the more egregious considering it holds itself out as an 

IT support provider, offering consulting services on “data protection” and anti-virus protection. 

51. Accordingly, as outlined below, Plaintiff and Class Members now face an increased 

risk of fraud and identity theft. In addition, Plaintiff and Class Members were also deprived of the 

benefit of the bargain that they made with Defendant. 

Data Breaches Cause Disruption and Put Consumers at an Increased Risk of Fraud and 

Identity Theft 

52. Data breaches are problematic because the breaches can negatively impact the 

overall daily lives of individuals affected by the attack. 

53. The United States Government Accountability Office released a report in 2007 

regarding data breaches (“GAO Report”) in which it noted that victims of identity theft will face 

“substantial costs and time to repair the damage to their good name and credit record.”8

54. That is because any victim of a data breach is exposed to serious ramifications 

8

 See U.S. Gov. Accounting Office, GAO-07-737, “Personal Information: Data Breaches Are Frequent, but Evidence 

of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown” (GOA, 2007). Available at 

https://www.gao.gov/new.items/d07737.pdf. (last visited August 1, 2022). 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 11 of 36 PageID 11
12 

regardless of the nature of the data. Indeed, the reason criminals steal personally identifiable 

information is to monetize it. They do this by selling the spoils of their cyberattacks on the black 

market to identity thieves who desire to extort and harass victims, taking over victims’ identities 

in order to engage in illegal financial transactions under the victims’ names. Because a person’s 

identity is akin to a puzzle, the more accurate pieces of data an identity thief obtains about a person, 

the easier it is for the thief to take on the victim’s identity, or otherwise harass or track the victim. 

For example, armed with just a name and date of birth, a data thief can utilize a hacking technique 

referred to as “social engineering” to obtain even more information about a victim’s identity, such 

as a person’s login credentials or Social Security number. Social engineering is a form of hacking 

whereby a data thief uses previously acquired information to manipulate individuals into 

disclosing additional confidential or personal information through means such as spam phone calls 

and text messages or phishing emails. 

55. The FTC recommends that identity theft victims take several steps to protect their 

personal and financial information after a data breach, including contacting one of the credit 

bureaus to place a fraud alert (an extended fraud alert that lasts for seven years if someone steals 

their identity), reviewing their credit reports, contacting companies to remove fraudulent charges 

from their accounts, placing a credit freeze on their credit, and correcting their credit reports.9

56. Identity thieves use stolen personal information such as Social Security numbers 

for a variety of crimes, including credit card fraud, phone or utilities fraud, and bank/finance fraud. 

57. Identity thieves can also use Social Security numbers to obtain a driver’s license or 

official identification card in the victim’s name but with the thief’s picture; use the victim’s name 

and Social Security number to obtain government benefits; or file a fraudulent tax return using the 

9

 See IdentityTheft.gov, Federal Trade Commission, https://www.identitytheft.gov/Steps (last visited August 1, 

2022).

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 12 of 36 PageID 12
13 

victim’s information. In addition, identity thieves may obtain a job using the victim’s Social 

Security number, rent a house or receive medical services in the victim’s name, and may even give 

the victim’s personal information to police during an arrest resulting in an arrest warrant being 

issued in the victim’s name. 

58. Moreover, theft of Private Information results in the loss of a valuable property 

right.10

59. Its value is axiomatic, considering the value of “big data” in corporate America and 

the fact that the consequences of cyber thefts include heavy prison sentences. Even this obvious 

risk to reward analysis illustrates beyond doubt that Private Information has considerable market 

value. 

60. It must also be noted there may be a substantial time lag – measured in years -- 

between when harm occurs and when it is discovered, and between when Private Information 

and/or financial information is stolen and when it is used. 

61. According to the U.S. Government Accountability Office, which conducted a study 

regarding data breaches: 

[L]aw enforcement officials told us that in some cases, stolen data may be held 

for up to a year or more before being used to commit identity theft. Further, once 

stolen data have been sold or posted on the Web, fraudulent use of that 

information may continue for years. As a result, studies that attempt to measure 

the harm resulting from data breaches cannot necessarily rule out all future harm. 

See GAO Report, at p. 29. 

62. Private Information is such a valuable commodity to identity thieves that once the 

information has been compromised, criminals often trade the information on the “cyber black10 See, e.g., John T. Soma, et al, Corporate Privacy Trend: The “Value” of Personally Identifiable Information (“PII”) 

Equals the “Value" of Financial Assets, 15 Rich. J.L. & Tech. 11, at *3-4 (2009) (“PII, which companies obtain at 

little cost, has quantifiable value that is rapidly reaching a level comparable to the value of traditional financial 

assets.”) (citations omitted). 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 13 of 36 PageID 13
14 

market” for years. 

63. There is a strong probability that entire batches of stolen information have been 

dumped on the black market and are yet to be dumped on the black market, meaning Plaintiff and 

Class Members are at an increased risk of fraud and identity theft for many years into the future. 

64. Thus, Plaintiff and Class Members must vigilantly monitor their financial and 

medical accounts for many years to come. 

65. Sensitive Private Information can sell for as much as $363 per record according to 

the Infosec Institute.11 Private Information is particularly valuable because criminals can use it to 

target victims with frauds and scams. Once Private Information is stolen, fraudulent use of that 

information and damage to victims may continue for years. 

66. For example, the Social Security Administration has warned that identity thieves 

can use an individual’s Social Security number to apply for additional credit lines.12 Such fraud 

may go undetected until debt collection calls commence months, or even years, later. Stolen Social 

Security Numbers also make it possible for thieves to file fraudulent tax returns, file for 

unemployment benefits, or apply for a job using a false identity.13 Each of these fraudulent 

activities is difficult to detect. An individual may not know that his or her Social Security Number 

was used to file for unemployment benefits until law enforcement notifies the individual’s 

employer of the suspected fraud. Fraudulent tax returns are typically discovered only when an 

individual’s authentic tax return is rejected. 

67. Moreover, it is not an easy task to change or cancel a stolen Social Security number. 

11 See Ashiq Ja, Hackers Selling Healthcare Data in the Black Market, InfoSec (July 27, 2015), 

https://resources.infosecinstitute.com/topic/hackers-selling-healthcare-data-in-the-black-market/ (last visited 

August 1, 2022).

12 Identity Theft and Your Social Security Number, Social Security Administration (2018) at 1. Available at 

https://www.ssa.gov/pubs/EN-05-10064.pdf (last visited August 1, 2022). 13 Id. at 4. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 14 of 36 PageID 14
15 

68. An individual cannot obtain a new Social Security number without significant 

paperwork and evidence of actual misuse. Even then, a new Social Security number may not be 

effective, as “[t]he credit bureaus and banks are able to link the new number very quickly to the 

old number, so all of that old bad information is quickly inherited into the new Social Security 

number.” 

69. This data, as one would expect, demands a much higher price on the black market. 

Martin Walter, senior director at cybersecurity firm RedSeal, explained, “[c]ompared to credit card 

information, personally identifiable information and Social Security Numbers are worth more than 

10x on the black market.” 

70. According to account monitoring company LogDog, coveted Social Security 

numbers were selling on the dark web for just $1 in 2016 – the same as a Facebook account.14 That 

pales in comparison with the asking price for medical data, which was selling for $50 and up.15

71. Because of the value of its collected and stored data, the medical industry has 

experienced disproportionally higher numbers of data theft events than other industries. 

72. For this reason, Defendant knew or should have known about these dangers and 

strengthened its data security accordingly. Defendant was put on notice of the substantial and 

foreseeable risk of harm from a data breach, yet it failed to properly prepare for that risk. 

VII. PLAINTIFF’S AND CLASS MEMBERS’ DAMAGES

73. To date, Defendant has done nothing to provide Plaintiff and the Class Members 

with relief for the damages they have suffered as a result of the Data Breach. Defendant has merely 

offered Plaintiff and Class Members some months of fraud and identity monitoring services, but 

14 See Omri Toppol, Email Security: How You Are Doing It Wrong & Paying Too Much, LogDog (Feb. 14, 2016), 

https://getlogdog.com/blogdog/email-security-you-are-doing-it-wrong/ (last visited August 1, 2022). 15 See Vaas, Cyberattacks, supra, n. 28. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 15 of 36 PageID 15
16 

this does nothing to compensate them for damages incurred and time spent dealing with the Data 

Breach. Signing up for this service requires Plaintiff and Class Members to forfeit time that could 

otherwise be spent making money or enjoying life. Moreover, it is unclear when the credit 

monitoring service will be rescinded, at which point Plaintiff and Class Members will be required 

to pay for credit monitoring services out of their own pocket. 

74. Plaintiff and Class Members have been damaged by the compromise of their Private 

Information in the Data Breach. 

75. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class 

Members have been placed at an imminent, immediate, and continuing increased risk of harm from 

fraud and identity theft. Plaintiff and Class Members face substantial risk of out-of-pocket fraud 

losses such as loans opened in their names, medical services billed in their names, tax return fraud, 

utility bills opened in their names, credit card fraud, and similar identity theft. 

76. Plaintiff and Class Members face substantial risk of being targeted for future 

phishing, data intrusion, and other illegal schemes based on their Private Information as potential 

fraudsters could use that information to target such schemes more effectively to Plaintiff and Class 

Members. 

77. Plaintiff and Class Members may also incur out-of-pocket costs for protective 

measures such as credit monitoring fees, credit report fees, credit freeze fees, and similar costs 

directly or indirectly related to the Data Breach. 

78. Plaintiff and Class Members suffered actual injury from having their Private 

Information compromised as a result of the Data Breach including, but not limited to (a) damage 

to and diminution in the value of their Private Information, a form of property that Defendant 

obtained from Plaintiff and Class Members; (b) violation of their privacy rights; and (c) imminent 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 16 of 36 PageID 16
17 

and impending injury arising from the increased risk of identity theft and fraud; and (d) emotional 

distress. 

79. Plaintiff and Class Members have suffered or will suffer actual injury as a direct 

result of the Data Breach. Many victims suffered ascertainable losses in the form of out-of-pocket 

expenses and the value of their time reasonably incurred to remedy or mitigate the effects of the Data 

Breach relating to: 

a. Reviewing and monitoring financial and other sensitive accounts and finding 

fraudulent insurance claims, loans, and/or government benefits claims; 

b. Purchasing credit monitoring and identity theft prevention; 

c. Placing “freezes” and “alerts” with reporting agencies; 

d. Spending time on the phone with or at financial institutions and/or 

government agencies to dispute unauthorized and fraudulent activity in their 

name; 

e. Contacting financial institutions and closing or modifying financial accounts; 

and 

f. Closely reviewing and monitoring Social Security Number, medical 

insurance accounts, bank accounts, and credit reports for unauthorized 

activity for years to come. 

80. Moreover, Plaintiff and Class Members have an interest in ensuring that their 

Private Information, which is believed to remain in the possession of Defendant, is protected from 

further breaches by the implementation of security measures and safeguards, including but not 

limited to, making sure that the storage of data or documents containing Private Information is not 

accessible online and that access to such data is password protected. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 17 of 36 PageID 17
18 

Plaintiff’s Experience

81. Until Plaintiff received Defendant’s letter about the Data Breach, he was unfamiliar 

with the Defendant. Unfortunately, the notification letter neither provided any information as to 

how or why Defendant was in possession of Plaintiff’s Private Information, nor did it inform 

Plaintiff as to what actual information was implicated in the Data Breach. Because Defendant 

failed to inform Plaintiff as to the scope of the Data Breach, Plaintiff is left to guess what 

information was compromised and how he should go about mitigating his risk of identity theft. 

82. Upon information and belief, Plaintiff entrusted confidential information such as 

name, address, date of birth, Social Security number and other personally identifiable information 

to Defendant through one of Defendant’s many managed services customers. Plaintiff provided 

such information with the reasonable expectation and understanding that Defendant would take, 

at a minimum, industry standard precautions to protect, maintain, and safeguard that information 

from unauthorized users or disclosure, and would timely notify him of any data security incidents 

related to him. 

83. As a result of the Data Breach, Plaintiff made reasonable efforts to mitigate the 

impact of the Data Breach after receiving the data breach notification letter, including but not 

limited to researching the Data Breach, reviewing credit reports, financial account statements, 

and/or medical records for any indications of actual or attempted identity theft or fraud. 

84. Plaintiff has suffered injury. As a result of the Data Breach, Plaintiff’s Personal 

Information has been compromised; Plaintiff is aware that his name was used without his 

permission to apply for credit. Plaintiff has also spent money on credit monitoring services 

through Experian to try to mitigate his risk . 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 18 of 36 PageID 18
19 

85. Plaintiff has spent a significant number of hours reviewing his accounts and 

contacting other businesses and will continue to spend valuable time Plaintiff otherwise would 

have spent on other activities, including but not limited to work and/or recreation. 

86. Plaintiff suffered actual injury from having his Private Information compromised 

as a result of the Data Breach including, but not limited to (a) damage to and diminution in the 

value of his Private Information, a form of property that Defendant obtained from Plaintiff; (b) 

violation of his privacy rights;(c) the likely theft of his Private Information and (d) imminent and 

impending injury arising from the increased risk of identity theft and fraud. 

87. As a result of the Data Breach, Plaintiff has also suffered emotional distress as a 

result of the release of his Private Information, which he believed would be protected from 

unauthorized access and disclosure, including anxiety about unauthorized parties viewing, 

selling, and/or using his Private Information for purposes of identity theft and fraud. Plaintiff is 

very concerned about identity theft and fraud, as well as the consequences of such identity theft 

and fraud resulting from the Data Breach. 

88. As a result of the Data Breach, Plaintiff anticipates spending considerable time and 

money on an ongoing basis to try to mitigate and address harms caused by the Data Breach. In 

addition, Plaintiff will continue to be at present, imminent, and continued increased risk of 

identity theft and fraud for years to come. 

VIII. CLASS ACTION ALLEGATIONS

89. Plaintiff brings this action on behalf of himself, and all other persons similarly 

situated. 

90. Plaintiff proposes the following Class definition, subject to amendment as 

appropriate: 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 19 of 36 PageID 19
20 

All persons whose Private Information was compromised as a result of the 

Data Breach, for which Defendant provided notice in July 2022 (the “Class”). 

91. Excluded from the Class are Defendant's officers and directors, and any entity 

in which Defendant has a controlling interest; and the affiliates, legal representatives, 

attorneys, successors, heirs, and assigns of Defendant. Excluded also from the Class are 

Members of the judiciary to whom this case is assigned, their families and members of their 

staff.

92. Plaintiff hereby reserves the right to amend or modify the class definitions 

with greater specificity or division after having had an opportunity to conduct discovery. 

The proposed Class meets the criteria for certification.

93. Numerosity. The Members of the Class are so numerous that joinder of all of 

them is impracticable. The exact number of Class Members is unknown to Plaintiff at this 

time.

94. Commonality. There are questions of law and fact common to the Class, 

which predominate over any questions affecting only individual Class Members. 

These common questions of law and fact include, without limitation:

a. Whether Defendant unlawfully used, maintained, lost, or disclosed 

Plaintiff’ and Class Members' Private Information; 

b. Whether Defendant failed to implement and maintain reasonable

security procedures and practices appropriate to the nature and scope 

of the information compromised in the Data Breach; 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 20 of 36 PageID 20
21 

c. Whether Defendant's data security systems prior to and during the 

Data Breach complied with applicable data security laws and 

regulations; 

d. Whether Defendant's data security systems prior to and during the 

Data Breach were consistent with industry standards; 

e. Whether Defendant owed a duty to Class Members to safeguard 

their Private Information; 

f. Whether Defendant breached its duty to Class Members to safeguard 

their Private Information; 

g. Whether computer hackers obtained Class Members' Private 

Information in the Data Breach; 

h. Whether Defendant knew or should have known that its data security 

systems and monitoring processes were deficient; 

i. Whether Plaintiff and Class Members suffered legally cognizable 

damages as a result of Defendant's misconduct; 

j. Whether Defendant's conduct was negligent; 

k. Whether Defendant's conduct was per se negligent; 

l. Whether Defendant's acts, inactions, and practices complained of 

herein amount to acts of intrusion upon seclusion under the law; 

m. Whether Defendant was unjustly enriched;

n. Whether Defendant failed to provide notice of the Data Breach in a 

timely manner; and

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 21 of 36 PageID 21
22 

o. Whether Plaintiff and Class Members are entitled to damages, civil 

penalties, punitive damages, and/or injunctive relief.

95. Typicality. Plaintiff’s claims are typical of those of other Class Members 

because Plaintiff’s Private Information, like that of every other Class member, was 

compromised in the Data Breach.

96. Adequacy of Representation. Plaintiff will fairly and adequately represent 

and protect the interests of the Members of the Class. Plaintiff’s Counsel is competent 

and experienced in litigating class actions, including data privacy litigation of this kind.

97. Predominance. Defendant has engaged in a common course of conduct 

toward Plaintiff and Class Members, in that all the Plaintiff’s and Class Members' data was 

stored on the same computer systems and unlawfully accessed in the same way. The 

common issues arising from Defendant's conduct affecting Class Members set out 

above predominate over any individualized issues. Adjudication of these common issues 

in a single action has important and desirable advantages of judicial economy.

98. Superiority. A class action is superior to other available methods for the fair 

and efficient adjudication of the controversy. Class treatment of common questions of law 

and fact is superior to multiple individual actions or piecemeal litigation. Absent a class 

action, most Class Members would likely find that the cost of litigating their individual 

claims is prohibitively high and would therefore have no effective remedy. The prosecution 

of separate actions by individual Class Members would create a risk of inconsistent or 

varying adjudications with respect to individual Class Members, which would establish 

incompatible standards of conduct for Defendant. In contrast, the conduct of this action 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 22 of 36 PageID 22
23 

as a class action presents far fewer management difficulties, conserves judicial resources and 

the parties' resources, and protects the rights of each Class member.

99. Defendant has acted on grounds that apply generally to the Class as a whole, so 

that class certification, injunctive relief, and corresponding declaratory relief are 

appropriate on a Class-wide basis.

100. Likewise, particular issues are appropriate for certification because such 

claims present only particular, common issues, the resolution of which would advance 

the disposition of this matter and the parties' interests therein. Such particular issues 

include, but are not limited to:

a. Whether Defendant failed to timely notify the public of the Data 

Breach;

b. Whether Defendant owed a legal duty to Plaintiff and the Class to 

exercise due care in collecting, storing, and safeguarding their Private 

Information;

c. Whether Defendant's security measures to protect their data 

systems were reasonable in light of best practices recommended by 

data security experts;

d. Whether Defendant's failure to institute adequate protective security 

measures amounted to negligence;

e. Whether Defendant failed to take commercially reasonable steps to 

safeguard consumer Private Information; and

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 23 of 36 PageID 23
24 

f. Whether adherence to FTC data security recommendations, and 

measures recommended by data security experts would have 

reasonably prevented the Data Breach.

101. Finally, all members of the proposed Class are readily ascertainable. Defendant 

has access to Class Members' names and addresses affected by the Data Breach. Class 

Members have already been preliminarily identified and sent notice of the Data Breach by 

Defendant.

IX. CAUSES OF ACTION 

FIRST COUNT 

NEGLIGENCE 

(On Behalf of Plaintiff and All Class Members) 

102. Plaintiff re-alleges and incorporates the above allegations as if fully set forth 

herein. 

103. Defendant collected consumers’ Private Information in the course of its 

business of providing IT managed services to its customers. 

104. By collecting and storing this data in Defendant’s computer system, and 

sharing it and using it for commercial gain, Defendant had a duty of care to use reasonable 

means to secure and safeguard their computer property—and Class Members' Private 

Information held within it—to prevent disclosure of the information, and to safeguard 

the information from theft. Defendant's duty included a responsibility to implement 

processes by which it could detect a breach of their security systems in a reasonably 

expeditious period and to give prompt notice to those affected in the case of a Data Breach. 

105. Defendant owed a duty of care to Plaintiff and Class Members to provide 

data security consistent with industry standards and other requirements discussed herein, 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 24 of 36 PageID 24
25 

and to ensure that its systems and networks, and the personnel responsible for them, 

adequately protected the Private Information. 

106. Defendant's duty of care to use reasonable security measures arose as a result 

of the special relationship that existed between Defendant and its customers, which is 

recognized by laws and regulations as well as common law. Defendant was in a position to 

ensure that its systems were sufficient to protect against the foreseeable risk of harm to 

Class Members from a Data Breach or data breach. 

107. In addition, Defendant had a duty to employ reasonable security measures 

under Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, which prohibits 

"unfair ... practices in or affecting commerce," including, as interpreted and enforced by 

the FTC, the unfair practice of failing to use reasonable measures to protect confidential 

data. 

108. Defendant's duty to use reasonable care in protecting confidential data arose 

not only as a result of the statutes and regulations described above, but also because 

Defendant is bound by industry standards to protect confidential Private Information. 

109. Defendant breached its duties, and thus was negligent, by failing to use 

reasonable measures to protect Class Members' Private Information. The specific 

negligent acts and omissions committed by Defendant include, but are not limited to, the 

following: 

a. Failing to adopt, implement, and maintain adequate security measures 

to safeguard Class Members' Private Information; 

b. Failing to adequately monitor the security of their networks and 

systems; 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 25 of 36 PageID 25
26 

c. Failure to periodically ensure that their email system had plans in 

place to maintain reasonable data security safeguards; 

d. Allowing unauthorized access to Class Members' Private 

Information;

e. Failing to detect in a timely manner that Class Members' Private 

Information had been compromised; and

f. Failing to timely notify Class Members about the Data Breach so that 

they could take appropriate steps to mitigate the potential for identity 

theft and other damages.

110. It was foreseeable that Defendant's failure to use reasonable measures to 

protect Class Members' Private Information would result in injury to Class Members. 

Further, the breach of security was reasonably foreseeable given the known high frequency 

of cyberattacks and data breaches and Defendant’s knowledge of these risks from working 

in IT security.

111. It was therefore foreseeable that the failure to adequately safeguard Class 

Members' Private Information would result in one or more types of injuries to Class 

Members.

112. Plaintiff and Class Members are entitled to compensatory and 

consequential damages suffered as a result of the Data Breach.

113. Defendant's negligent conduct is ongoing, in that it still holds the 

Private Information of Plaintiff and Class Members in an unsafe and unsecure manner.

114. Plaintiff and Class Members are also entitled to injunctive relief requiring 

Defendant to (i) strengthen its data security systems and monitoring procedures; (ii) 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 26 of 36 PageID 26
27 

submit to future annual audits of those systems and monitoring procedures; and (iii) 

continue to provide adequate credit monitoring to all Class Members.

SECOND COUNT 

NEGLIGENCE PER SE 

(On Behalf of Plaintiff and All Class Members) 

115. Plaintiff re-alleges and incorporates the above allegations as if fully set forth 

herein.

116. Pursuant to the Federal Trade Commission Act, 15 U.S.C. § 45, Defendant 

had a duty to provide fair and adequate computer systems and data security practices 

to safeguard Plaintiff and Class Members' Private Information. 

117. Defendant breached its duties to Plaintiff and Class Members under the 

Federal Trade Commission Act by failing to provide fair, reasonable, or adequate 

computer systems and data security practices to safeguard Plaintiff’s and Class 

Members' Private Information. 

118. Defendant's failure to comply with applicable laws and regulations 

constitutes negligence per se. 

119. But for Defendant's wrongful and negligent breach of their duties owed to 

Plaintiff and Class Members, Plaintiff and Class Members would not have been injured. 

120. The injury and harm suffered by Plaintiff and Class Members was the 

reasonably foreseeable result of Defendant's breach of their duties. Defendant knew or 

should have known that it was failing to meet its duties, and that Defendant's breach would 

cause Plaintiff and Class Members to experience the foreseeable harms associated with 

the exposure of their Private Information. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 27 of 36 PageID 27
28 

121. As a direct and proximate result of Defendant's negligent conduct, Plaintiff 

and Class Members have suffered injury and are entitled to compensatory, consequential, 

and punitive damages in an amount to be proven at trial. 

THIRD COUNT 

BREACH OF FIDUCIARY DUTY 

(On Behalf of Plaintiff and All Class Members) 

122. Plaintiff re-allege and incorporate the above allegations as if fully set forth 

herein. 

123. In light of the special relationship between Defendant and Plaintiff and Class 

Members, whereby Defendant became guardian of Plaintiff and Class Members' 

Private Information, Defendant became a fiduciary by its undertaking and guardianship 

of the Private Information, to act primarily for Plaintiff and Class Members, (1) for the 

safeguarding of Plaintiff and Class Members' Private Information; (2) to timely notify 

Plaintiff and Class Members of a Data Breach and disclosure; and (3) to maintain complete 

and accurate records of what information (and where) Defendant did and does store.

124. Defendant has a fiduciary duty to act for the benefit of Plaintiff and Class 

Members upon matters within the scope of Defendant’s relationship with them, in 

particular, to keep secure their Private Information.

125. Defendant breached its fiduciary duties to Plaintiff and Class Members by 

failing to diligently discovery, investigate, and give notice of the Data Breach in a 

reasonable and practicable period.

126. Defendant breached its fiduciary duties to Plaintiff and Class Members by 

failing to encrypt and otherwise protect the integrity of the systems containing Plaintiff 

and Class Members' Private Information.

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 28 of 36 PageID 28
29 

127. Defendant breached its fiduciary duties owed to Plaintiff and Class Members 

by failing to timely notify and/or warn Plaintiff and Class Members of the Data Breach.

128. Defendant breached its fiduciary duties to Plaintiff and Class Members 

by otherwise failing to safeguard Plaintiff’s and Class Members' Private Information.

129. As a direct and proximate result of Defendant's breaches of its fiduciary 

duties, Plaintiff and Class Members have suffered and will suffer injury, including but not 

limited to: (i) actual identity theft; (ii) the compromise, publication, and/or theft of their 

Private Information; (iii) out-of-pocket expenses associated with the prevention, detection, 

and recovery from identity theft and/or unauthorized use of their Private Information; (iv) 

lost opportunity costs associated with effort expended and the loss of productivity 

addressing and attempting to mitigate the actual and future consequences of the Data 

Breach, including but not limited to efforts spent researching how to prevent, detect, 

contest, and recover from identity theft; (v) the continued risk to their Private 

Information, which remains in Defendant's possession and is subject to further 

unauthorized disclosures so long as Defendant fails to undertake appropriate and 

adequate measures to protect the Private Information in their continued possession; (vi) 

future costs in terms of time, effort, and money that will be expended as result of the Data 

Breach for the remainder of the lives of Plaintiff and Class Members; and (vii) the 

diminished value of Defendant's services they received. 

130. As a direct and proximate result of Defendant's breach of its fiduciary 

duties, Plaintiff and Class Members have suffered and will continue to suffer other forms of 

injury and/or harm, and other economic and non-economic losses. 

FOURTH COUNT 

INTRUSION UPON SECLUSION/INVASION OF PRIVACY 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 29 of 36 PageID 29
30 

(On Behalf of Plaintiff and All Class Members) 

131. Plaintiff re-alleges and incorporates the above allegations as if fully set forth 

herein. 

132. The State of Texas recognizes the tort of Intrusion upon Seclusion, and adopts 

the formulation of that tort found in the Restatement (Second) of Torts, which states: 

One who intentionally intrudes, physically or otherwise, upon the 

solitude or seclusion of another or his private affairs or concerns, is 

subject to liability to the other for invasion of his privacy, if the 

intrusion would be highly offensive to a reasonable person. 

Restatement (Second) of Torts§ 652B (1977). 

133. Plaintiff and Class Members had a reasonable expectation of privacy in the 

Private Information Defendant mishandled. 

134. Defendant's conduct as alleged above intruded upon Plaintiff and Class 

Members' seclusion under common law. 

135. By intentionally failing to keep Plaintiff and Class Members' Private 

Information safe, and by intentionally misusing and/or disclosing said information to 

unauthorized parties for unauthorized use, Defendant intentionally invaded Plaintiff and Class 

Members' privacy by: 

a. Intentionally and substantially intruding into Plaintiff and Class 

Members' private affairs in a manner that identifies Plaintiff and 

Class Members and that would be highly offensive and objectionable 

to an ordinary person; 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 30 of 36 PageID 30
31 

b. Intentionally publicizing private facts about Plaintiff and Class 

Members, which is highly offensive and objectionable to an ordinary 

person; and 

c. Intentionally causing anguish or suffering to Plaintiff and Class 

Members. 

136. Defendant knew that an ordinary person in Plaintiff or Class Members' 

position would consider Defendant's intentional actions highly offensive and objectionable. 

137. Defendant invaded Plaintiff and Class Members' right to privacy and 

intruded into Plaintiff and Class Members' private affairs by intentionally misusing and/or 

disclosing their Private Information without their informed, voluntary, affirmative, and 

clear consent. 

138. Defendant intentionally concealed from and delayed reporting to Plaintiff and 

Class Members a security incident that misused and/or disclosed their Private Information 

without their informed, voluntary, affirmative, and clear consent. 

139. The conduct described above was at or directed at Plaintiff and the Class 

Members. 

140. As a proximate result of such intentional misuse and disclosures, Plaintiff 

and Class Members' reasonable expectations of privacy in their Private Information 

was unduly frustrated and thwarted. Defendant's conduct amounted to a substantial and 

serious invasion of Plaintiff’s and Class Members' protected privacy interests causing 

anguish and suffering such that an ordinary person would consider Defendant's intentional 

actions or inaction highly offensive and objectionable. 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 31 of 36 PageID 31
32 

141. In failing to protect Plaintiff’s and Class Members' Private Information, and 

in intentionally misusing and/or disclosing their Private Information, Defendant

acted with intentional malice and oppression and in conscious disregard of Plaintiff and 

Class Members' rights to have such information kept confidential and private. Plaintiff, 

therefore, seeks an award of damages on behalf of himself and the Class. 

X. JURY TRIAL DEMANDED 

142. Plaintiff demands a trial by jury on all claims so triable.

PRAYER FOR RELIEF 

WHEREFORE, Plaintiff, on behalf of himself and the Class Members, requests judgment 

against Defendant and that the Court grant the following: 

A. For an Order certifying the Class, and appointing Plaintiff and his Counsel to 

represent the Class; 

B. For equitable relief enjoining Defendant from engaging in the wrongful conduct 

complained of herein pertaining to the misuse and/or disclosure of the Private 

Information of Plaintiff and Class Members; 

C. For injunctive relief requested by Plaintiff, including but not limited to, injunctive 

and other equitable relief as is necessary to protect the interests of Plaintiff and 

Class Members, including but not limited to an order: 

i. prohibiting Defendant from engaging in the wrongful and unlawful acts 

described herein; 

ii. requiring Defendant to protect, including through encryption, all data collected 

through the course of its business in accordance with all applicable regulations, 

industry standards, and federal, state, or local laws; 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 32 of 36 PageID 32
33 

iii. requiring Defendant to delete, destroy, and purge the personal identifying 

information of Plaintiff and Class Members unless Defendant can provide to 

the Court reasonable justification for the retention and use of such information 

when weighed against the privacy interests of Plaintiff and Class Members; 

iv. requiring Defendant to implement and maintain a comprehensive Information 

Security Program designed to protect the confidentiality and integrity of the 

Private Information of Plaintiff and Class Members; 

v. prohibiting Defendant from maintaining the Private Information of Plaintiff and 

Class Members on a cloud-based database; 

vi. requiring Defendant to engage independent third-party security 

auditors/penetration testers as well as internal security personnel to conduct 

testing, including simulated attacks, penetration tests, and audits on 

Defendant’s systems on a periodic basis, and ordering Defendant to promptly 

correct any problems or issues detected by such third-party security auditors; 

vii. requiring Defendant to engage independent third-party security auditors and 

internal personnel to run automated security monitoring; 

viii. requiring Defendant to audit, test, and train its security personnel regarding any 

new or modified procedures; 

ix. requiring Defendant to segment data by, among other things, creating firewalls 

and access controls so that if one area of Defendant’s network is compromised, 

hackers cannot gain access to other portions of Defendant’s systems; 

x. requiring Defendant to conduct regular database scanning and securing checks; 

xi. requiring Defendant to establish an information security training program that 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 33 of 36 PageID 33
34 

includes at least annual information security training for all employees, with 

additional training to be provided as appropriate based upon the employees’ 

respective responsibilities with handling personal identifying information, as 

well as protecting the personal identifying information of Plaintiff and Class 

Members; 

xii. requiring Defendant to routinely and continually conduct internal training and 

education, and on an annual basis to inform internal security personnel how to 

identify and contain a breach when it occurs and what to do in response to a 

breach; 

xiii. requiring Defendant to implement a system of tests to assess its respective 

employees’ knowledge of the education programs discussed in the preceding 

subparagraphs, as well as randomly and periodically testing employees’ 

compliance with Defendant’s policies, programs, and systems for protecting 

personal identifying information; 

xiv. requiring Defendant to implement, maintain, regularly review, and revise as 

necessary a threat management program designed to appropriately monitor 

Defendant’s information networks for threats, both internal and external, and 

assess whether monitoring tools are appropriately configured, tested, and 

updated; 

xv. requiring Defendant to meaningfully educate all Class Members about the 

threats that they face as a result of the loss of their confidential personal 

identifying information to third parties, as well as the steps affected individuals 

must take to protect themselves; 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 34 of 36 PageID 34
35 

xvi. requiring Defendant to implement logging and monitoring programs sufficient 

to track traffic to and from Defendant’s servers; and for a period of 10 years, 

appointing a qualified and independent third party assessor to conduct a SOC 2 

Type 2 attestation on an annual basis to evaluate Defendant’s compliance with 

the terms of the Court’s final judgment, to provide such report to the Court and 

to counsel for the class, and to report any deficiencies with compliance of the 

Court’s final judgment; 

D. For an award of damages, including actual, nominal, statutory, and consequential 

damages, as allowed by law in an amount to be determined; 

E. For an award of attorneys’ fees, costs, and litigation expenses, as allowed by law; 

F. For prejudgment interest on all amounts awarded; and 

G. Such other and further relief as this Court may deem just and proper. 

Dated: August 8, 2022 Respectfully submitted, 

s/ Joe Kendall 

JOE KENDALL 

Texas Bar No. 11260700 

KENDALL LAW GROUP, PLLC 

3811 Turtle Creek Blvd., Suite 1450 

Dallas, Texas 75219 

214-744-3000 / 214-744-3015 (Facsimile) 

jkendall@kendalllawgroup.com 

 

GARY M. KLINGER*

MILBERG COLEMAN BRYSON 

PHILLIPS GROSSMAN, PLLC

227 W. Monroe Street, Suite 2100 

Chicago, IL 60606 

Phone: (866) 252-0878 

gklinger@milberg.com 

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 35 of 36 PageID 35
36 

Samuel J. Strauss* 

Raina C. Borrelli* 

TURKE & STRAUSS LLP 

613 Williamson Street, Suite 201 

Madison, WI 53703 

Telephone: (608) 237-1775 

Facsimile: (608) 509-4423 

raina@turkestrauss.com 

sam@turkestrauss.com 

 

 ATTORNEYS FOR PLAINTIFF 

 *Pro Hac Vice Forthcoming

Case 3:22-cv-01711-K Document 1 Filed 08/08/22 Page 36 of 36 PageID 36