Complaint - 1

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

LAW OFFICES OF TODD M. FRIEDMAN, P.C.

Todd M. Friedman, Esq. (SBN: 216752)

tfriedman@toddflaw.com

21550 Oxnard St., Suite 780 

Woodland Hills, CA 91367

Telephone: (877) 206-4741

Facsimile: (866) 633-0228

Attorneys for Plaintiff 

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

MARGARITA SERRANO, on behalf 

of herself and all others similarly 

situated,

Plaintiff,

vs.

AUTOMOTIVE RECOVERY 

SERVICES, INC.,

Defendant.

________________________________

)

)

)

)

)

)

)

)

)

)

)

)

)

)

Case No. 

CLASS ACTION COMPLAINT 

1. VIOLATION OF CALIFORNIA 

UNFAIR COMPETITION LAW;

2. VIOLATION OF CALIFORNIA 

DATA BREACH ACT; and

3. NEGLIGENCE.

INTRODUCTION

1. MARGARITA SERRANO (“PLAINTIFF”) brings this class action 

for damages, injunctive relief, and any other available legal or equitable remedies, 

resulting from the illegal actions of AUTOMOTIVE RECOVERY SERVICES, 

INC. (“DEFENDANT”) and its related entities, subsidiaries and agents, in failing 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 1 of 16
Complaint - 2

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

to secure and protect its users’ personal information (“INFORMATION”) provided 

to DEFENDANT, which encompasses names, social security numbers, street 

addresses, e-mail addresses, passwords, phone numbers, driver’s license numbers 

and other information, in accordance with both industry security standards and 

DEFENDANT’s own security standards. PLAINTIFF alleges as follows upon 

personal knowledge as to herself and her own acts and experiences, and, as to all 

other matters, upon information and belief, including investigation conducted by 

her attorneys.

2. Despite assuring its users that it will provide them with reasonable 

protection in handling its users’ INFORMATION, the security standards employed 

by DEFENDANT have resulted in breaches of DEFENDANT’s networks and 

software. 

JURISDICTION AND VENUE

3. Jurisdiction is proper under the Class Action Fairness Act, 28 U.S.C. 

§ 1332(d)(2), because the claims of the individual class members, when aggregated 

among a proposed class numbering in the millions, exceeds the $5,000,000 

threshold for federal court jurisdiction. DEFENDANT is an Indiana Corporation.

Further, PLAINTIFF alleges a national class, which will result in at least one class 

member belonging to a different state than that of DEFENDANT. Therefore, both 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 2 of 16
Complaint - 3

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

elements of diversity jurisdiction under the Class Action Fairness Act of 2005 

(“CAFA”) are present, and this Court has jurisdiction. 

4. Venue is proper in the United States District Court for the Northern

District of California pursuant to 28 U.S.C. § 1391(b) and 1441(a) because the 

events giving rise to PLAINTIFF’s causes of action against DEFENDANT 

occurred within the State of California and the County of San Mateo as 

PLAINTIFF resides in San Bruno, California and within this judicial district.

PARTIES

5. PLAINTIFF is an individual citizen and resident of the County of San 

Mateo, State of California. 

6. DEFENDANT is an Indiana Corporation, operating nationally, in the 

business of automotive salvage and auction processing. DEFENDANT may also 

be known, insofar as it may be relevant to this cause of action, as VEHICLE 

DONATION PROCESSING CENTER. For the purposes of this complaint, the 

defendant will be referred to only as “DEFENDANT” henceforth. 

7. PLAINTIFF is informed and believes, and thereon alleges, that at all 

times relevant, DEFENDANT conducted business in the State of California. 

FACTUAL ALLEGATIONS

8. In or around May 2015, DEFENDANT discovered that PLAINTIFF’s 

personal information had been exposed to unauthorized persons (“hackers”). 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 3 of 16
Complaint - 4

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PLAINTIFF donated a vehicle to a separate charitable organization, a transaction 

that DEFENDANT administered, at some time between 2005 and 2014 (“donation 

period”), and as part of that administrative process, DEFENDANT collected 

information from PLAINTIFF and everyone making similar donations 

administered through DEFENDANT (“the INFORMATION”). All 

INFORMATION collected during the donation period was exposed to hackers 

from around July 2012 through May 2015. 

9. DEFENDANT did not notify PLAINTIFF until July 2015, 

approximately two months after discovering the exposure of PLAINTIFF’s and 

class members’ INFORMATION (hereinafter, the “notice” or “notice letter”).

10. PLAINTIFF believed, based on DEFENDANT’s representations, that 

INFORMATION given to DEFENDANT would be safe and DEFENDANT would 

take the measures required to secure her INFORMATION.

11. PLAINTIFF alleges upon information and belief that DEFENDANT 

represented to PLAINTIFF through statements or omissions that DEFENDANT’s 

security measures were up to industry standards and that the security measures were 

sufficient to prevent breaches that would expose her INFORMATION to theft. 

12. PLAINTIFF alleges upon information, belief, and PLAINTIFF’s 

experience of her information being exposed for nearly three years before 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 4 of 16
Complaint - 5

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DEFENDANT noticed a breach, that DEFENDANT’s security measures were in 

fact not as represented and were in fact substandard.

13. PLAINTIFF alleges upon information and belief that DEFENDANT 

receives fees for the automotive donations that it processes for charities, either in 

the form of invoicing the charities or receiving a percentage of each donation, 

thereby profiting from PLAINTIFF’s donation and INFORMATION. 

14. PLAINTIFF alleges upon information and belief that DEFENDANT 

represented to PLAINTIFF through statements or omissions that PLAINTIFF must 

use DEFENDANT’s services if she wishes to donate her automobile, and that in 

order to do so through DEFENDANT’s services, she must divulge 

INFORMATION to DEFENDANT. 

15. By giving INFORMATION to DEFENDANT, PLAINTIFF received 

no benefit while DEFENDANT received fees for its services. 

16. PLAINTIFF would never have given INFORMATION to 

DEFENDANT had DEFENDANT represented to PLAINTIFF its actual level of 

computer security. Had PLAINTIFF understood that her INFORMATION was not 

safe with DEFENDANT, she would never have given INFORMATION to 

DEFENDANT. 

17. DEFENDANT gave neither PLAINTIFF nor the general public any 

reasonable opportunity to discover the true nature of DEFENDANT’s security 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 5 of 16
Complaint - 6

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

measures or the safety and security of their INFORMATION before giving it to 

DEFENDANT.

18. DEFENDANT later confirmed this security breach and neither 

promptly notified its PLAINTIFF about the breach nor that her INFORMATION 

had been compromised.

19. Furthermore, DEFENDANT did not take adequate remedial 

measures, thereby causing PLAINTIFF to incur further financial damage and risk.

DEFENDANT offered PLAINTIFF twelve (12) months of AllClear services 

starting on the date of receipt of the notice letter. The financial risk to which 

DEFENDANT exposed PLAINTIFF through its intentional, reckless, and 

fraudulent actions is ongoing and is not and will not be remedied with twelve 

months of the identity protection services mentioned herein.

20. Furthermore, AllClear PRO, one of the AllClear services that 

DEFENDANT believed would help remedy the damage, requires PLAINTIFF to 

give her INFORMATION to AllClear. 

21. DEFENDANT knew or should have known that its products and 

services were not secure and left the INFORMATION of PLAINTIFF and other 

members of The Class vulnerable to theft.

22. DEFENDANT recklessly, or as a matter of gross negligence, failed to 

provide reasonable and adequate security measures. 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 6 of 16
Complaint - 7

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

23. Additionally, DEFENDANT failed to notify PLAINTIFF and the 

other members of The Class in a timely manner of the security breach, as required 

by law.

24. PLAINTIFF and The Class have all suffered irreparable harm and 

monetary damages as a result of DEFENDANT’s unlawful and wrongful conduct 

heretofore described. 

CLASS ACTION ALLEGATIONS

25. PLAINTIFF brings this action on behalf of herself and on behalf of 

all others similarly situated (“The Class”). PLAINTIFF represents, and is a

member of, The Class, consisting of:

All persons within the United States who had an account 

with DEFENDANT whose personal information was 

compromised as a result of the data breach that occurred 

on or about July 2012 through the date of filing.

26. DEFENDANT and its employees or agents are excluded from The 

Class. PLAINTIFF does not know the number of members in The Class, but 

believes the Class members number in millions, if not more. Thus, this matter 

should be certified as a Class action to assist in the expeditious litigation of this 

matter.

27. PLAINTIFF and members of The Class were harmed by the acts and 

omissions of DEFENDANT in at least the following ways: PLAINTIFF and 

CLASS Members have lost the security of their INFORMATION and now face a 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 7 of 16
Complaint - 8

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

substantially increased risk of identity theft as a result of DEFENDANT’s 

misrepresentations, concealments, and failure to disclose its substandard security 

protections.

28. This suit seeks only damages and injunctive relief for recovery of 

economic injury on behalf of the Class and it expressly is not intended to request 

any recovery for personal injury and claims related thereto. PLAINTIFF reserves

the right to expand the Class definition to seek recovery on behalf of additional 

persons as warranted as facts are learned in further investigation and discovery.

29. The joinder of the Class members is impractical and the disposition of 

their claims in the Class action will provide substantial benefits both to the parties 

and to the court. The Class can be identified through DEFENDANT’s records or 

DEFENDANT’S agents’ records.

30. There is a well-defined community of interest in the questions of law 

and fact involved affecting the parties to be represented. The questions of law and 

fact to the Class predominate over questions which may affect individual Class 

members, including the following:

a. Whether DEFENDANT failed to adequately protect its customers’ 

INFORMATION pursuant to industry-standard protocols and 

technology;

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 8 of 16
Complaint - 9

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

b. Whether DEFENDANT’s conduct and omissions as heretofore 

alleged are false, misleading, or reasonably likely to deceive its 

customers;

c. Whether DEFENDANT failed to disclose material facts relating to 

the character and quality of its security practices;

d. Whether DEFENDANT knowingly continued to disseminate false 

and misleading representations regarding its security practices;

e. Whether California law applies to the proposed Class;

f. Whether DEFENDANT’s conduct described herein was negligent 

and/or grossly negligent;

g. Whether DEFENDANT’s conducted described herein constitutes 

a violation of the California Data Breach Act, Cal. Civ. Code. § 

1798.80 et seq.;

h. Whether DEFENDANT violated the California Online Privacy 

Protection Act, Cal. Bus. & Prof. Code § 22576;

i. Whether PLAINTIFFS and the members of The Class were 

damaged by DEFENDANT’s conduct, and the extent of damages;

j. Whether DEFENDANT has engaged in unlawful, unfair, or 

fraudulent business practices in violation of Cal. Bus. & Prof. Code 

§ 17200 et seq.; and

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 9 of 16
Complaint - 10

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

k. Whether DEFENDANT should be enjoined from engaging in such 

conduct in the future.

31. As an individual whose personal information was compromised as a 

result of DEFENDANT’s wrongful conduct as herein alleged, PLAINTIFF is

asserting claims that are typical of The Class. PLAINTIFF will fairly and 

adequately represent and protect the interests of The Class in that PLAINTIFF has

no interests antagonistic to any member of The Class. 

32. PLAINTIFF and the members of The Class have all suffered 

irreparable harm as a result of the DEFENDANT’s unlawful and wrongful conduct. 

Absent a class action, The Class will continue to face the potential for irreparable 

harm. In addition, these violations of law will be allowed to proceed without 

remedy and DEFENDANT will likely continue such illegal conduct. Because of 

the size of the individual Class member’s claims, few, if any, Class members could 

afford to seek legal redress for the wrongs complained of herein.

33. PLAINTIFF has retained counsel experienced in handling class action 

claims.

34. A class action is a superior method for the fair and efficient 

adjudication of this controversy. Class-wide damages are essential to induce 

DEFENDANT to comply with the law. The interest of Class members in 

individually controlling the prosecution of separate claims against DEFENDANT

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 10 of 16
Complaint - 11

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

is small. Management of these claims is likely to present significantly fewer 

difficulties than those presented in many class claims. 

35. DEFENDANT has acted on grounds generally applicable to The 

Class, thereby making appropriate final injunctive relief and corresponding 

declaratory relief with respect to the Class as a whole.

FIRST CAUSE OF ACTION

UNLAWFUL COMPETITION LAW, CALIFORNIA BUSINESS AND 

PROFESSIONS CODE § 17200, et seq.

36. PLAINTIFF incorporates by reference all of the above paragraphs of 

this Complaint as though fully stated herein.

37. DEFENDANT’s acts, practices, and omissions detailed above 

constitute unlawful, unfair and/or fraudulent business practices and acts, within the 

meaning of California Business & Professions Code § 17200 et seq.

38. DEFENDANT’s acts, practices, and omissions detailed above 

constitute fraudulent practices in that they are likely to deceive a reasonable 

consumer. 

39. DEFENDANT’s acts, practices, and omissions detailed above, 

constitute unlawful practices and/or acts as they constitute violations of numbers 

provisions of California law.

40. DEFENDANT’s acts, practices, and omissions detailed above, 

constitute unlawful practices and/or acts in that they violate the California Data 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 11 of 16
Complaint - 12

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Breach Act, Cal. Civ. Code § 1798.80, et seq., and California’s Online Privacy Act 

(“OPPA”), Cal. Bus. & Prof. Code § 22576, which prohibits any company whose 

website or online service that collects personal identifiable information form 

California consumers from “knowingly and willfully” or “negligently and 

materially” breaching its own privacy policy. 

41. DEFENDANT has committed all of the aforesaid acts of infringement 

deliberately, willfully, maliciously and oppressively, without regard to 

PLAINTIFF’s and The Class’ legal, contractual, and exclusive proprietary rights.

42. As a direct and proximate result of DEFENDANT’s unlawful, unfair 

and fraudulent business practices as alleged herein, PLAINTIFF and Class 

members have suffered injury in fact in the form of INFORMATION theft, ongoing 

risk of identity theft, and the need for costly identity protection services in the 

future. Meanwhile, DEFENDANT has continued to administer the donations of 

automobiles at a substantial profit to only itself.

43. Pursuant to California Business & Professions Code §17203, 

PLAINTIFF seeks an order of this Court prohibiting DEFENDANT from engaging 

in the unlawful, unfair, or fraudulent business acts or practices set forth in this 

Complaint and/or ordering DEFENDANT perform its obligations under the law 

and the cancellation of any illegal obligations. PLAINTIFF additionally requests

an order from the Court requiring that DEFENDANT provide complete equitable 

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 12 of 16
Complaint - 13

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

relief, including that DEFENDANT disgorge profits and return or pay to 

PLAINTIFF and the members of The Class all of Defendant’s ill-gotten gains 

obtained from the contract or transaction entered into, and/or pay restitution. 

PLAINTIFF also requests a court order that an asset freeze or constructive trust be 

imposed over all monies in DEFENDANT’s possession which rightfully belong to 

PLAINTIFF and The Class.

SECOND CAUSE OF ACTION

VIOLATION OF THE CALIFORNIA DATA BREACH ACT, CAL CIV. 

CODE § 1798.80, et seq.

44. PLAINTIFF incorporates by reference all of the above paragraphs of 

this Complaint as though fully stated herein.

45. The July 2012 through May 2015 data breach constituted a “breach of 

the security system” of DEFENDANT pursuant to Cal. Civ. Code § 1798.82(g).

46. DEFENDANT recklessly, or as a matter of gross negligence, failed to 

provide reasonable and adequate security measures.

47. DEFENDANT unreasonably delayed informing PLAINTIFF and 

members of The Class about the security breach of The Class members’ 

INFORMATION after DEFENDANT knew of the breach. 

48. DEFENDANT failed to disclose to PLAINTIFF and members of The 

Class, in the most expedient time possible, the breach of security of their 

INFORMATION after DEFENDANT knew of the breach.

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 13 of 16
Complaint - 14

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

49. As a result of DEFENDANT’s violation of Cal. Civ. Code § 1798.82, 

PLAINTIFF and members of the Class suffered economic damages relating to 

expenses for credit monitoring and other related expenses. 

50. PLAINTIFF, individually and on behalf of the members of The Class, 

seeks all remedies available under Cal. Civ. Code § 1798.84.

51. PLAINTIFF, individually and on behalf of the members of The Class, 

also seeks reasonable attorneys’ fees and costs under Cal. Civ. Code § 1798.84(g). 

THIRD CAUSE OF ACTION

COMMON LAW NEGLIGENCE

52. PLAINTIFF incorporates by reference all of the above paragraphs of 

this Complaint as though fully stated herein.

53. DEFENDANT’s conduct described herein constituted an 

unreasonable breach of its duty of care owed to PLAINTIFF actually and 

proximately causing PLAINTIFF damages thereby. 

54. As a recipient and beneficiary of PLAINTIFF’s entrustment of 

INFORMATION, DEFENDANT owed PLAINTIFF a duty to keep PLAINTIFF’s 

INFORMATION secure from hackers. 

55. DEFENDANT did not comply with its duty to keep INFORMATION 

safe.

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 14 of 16
Complaint - 15

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

56. But for DEFENDANT’s breach of duty, PLAINTIFF’s 

INFORMATION would still be secure. 

57. Loss of security of INFORMATION, threats of identity theft, the need 

for costly identity theft and credit watch services, and other damages are precisely 

the kinds of risks and harm that make DEFENDANT’s conduct negligent. 

DEFENDANT is therefore the proximate cause of PLAINTIFF’s injury.

58. PLAINTIFF, as well as class members, suffered substantial loss of 

INFORMATION, ongoing threats of identity theft, and further harm as a result of 

DEFENDANT’s negligence. 

59. Therefore, DEFENDANT is liable to PLAINTIFF and The Class for 

its negligence.

PRAYER FOR RELIEF

WHEREFORE, PLAINTIFF respectfully requests that the Court grant 

PLAINTIFF and The Class members the following relief against DEFENDANT:

a. An order certifying the proposed class and appointing PLAINTIFF and 

PLAINTIFF’s counsel to represent The Class;

b. Injunctive relief prohibiting DEFENDANT from engaging in such 

conduct as alleged herein in the future; 

c. Actual, statutory and/or punitive damages;

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 15 of 16
Complaint - 16

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

d. Restitution, or any other equitable relief the Court may deem just and 

proper;

e. Reasonable attorneys’ fees and costs of the suit, including expert witness 

fees; and

f. Any other relief the Court may deem just and proper.

TRIAL BY JURY

Pursuant to the Seventh Amendment to the Constitution of the United States 

of America, PLAINTIFF is entitled to, and demands, a trial by jury.

Dated: January 13, 2017 Respectfully Submitted

By:/s/ Todd M. Friedman

Todd M. Friedman, Esq.

Law Offices of Todd M. Friedman, P.C.

Attorney for Plaintiffs

Case 3:17-cv-00203-JSC Document 1 Filed 01/13/17 Page 16 of 16