Christopher I. Brain

cbrain@tousley.com

Kim D. Stephens

kstephens@tousley.com

Tousley Brain Stephens PLLC 

1700 Seventh Avenue, Suite 2200

Seattle, Washington 98101 

Tel: 206.682.5600 

Fax: 206.682.2992

Interim Lead Plaintiffs’ Counsel

Keith S. Dubanevich

kdubanevich@stollberne.com

Steve D. Larson

slarson@stollberne.com

Stoll Stoll Berne Lokting & Shlachter P.C.

209 SW Oak Street 

Portland, Oregon 97204 

Tel: 503.227.1600 

Fax: 503.227.6840

Interim Liaison Plaintiffs’ Counsel

[Additional counsel appear on the signature page.]

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF OREGON

IN RE: PREMERA BLUE CROSS 

CUSTOMER DATA SECURITY 

BREACH LITIGATION

This Document Relates to All Actions

Case No. 3:15-md-2633-SI

PLAINTIFFS’ FIRST AMENDED 

CONSOLIDATED CLASS ACTION 

ALLEGATION COMPLAINT

DEMAND FOR JURY TRIAL

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 1 of 87
TABLE OF CONTENTS

Page

- i -

I. NATURE OF THE CASE ..................................................................................... 1

II. PARTIES ............................................................................................................... 3

III. JURISDICTION AND VENUE ............................................................................ 7

IV. FACTUAL BACKGROUND................................................................................ 8

A. Premera Had A Duty And Contractual Obligation To Protect Its 

Members’ Sensitive Information From Unauthorized Disclosures. .......... 8

B. Premera Failed To Properly Protect Consumers’ Sensitive 

Information. ............................................................................................. 13

C. Premera Violated HIPAA, Industry Standard Data Protection 

Protocols, And Its Own Representations Regarding Data Security......... 16

D. It Is Well Established That Security Breaches Lead To Instances 

Of Identity Theft. ..................................................................................... 20

E. Plaintiffs’ Experiences Underscore The Fact That All Class 

Members Are In Imminent Danger Of Identity Theft. ............................ 23

ALASKA ..................................................................................................................................... 23

ARKANSAS................................................................................................................................ 24

CALIFORNIA ............................................................................................................................. 25

IDAHO......................................................................................................................................... 25

MARYLAND .............................................................................................................................. 26

MASSACHUSETTS.................................................................................................................... 26

NEW JERSEY ............................................................................................................................. 27

OREGON..................................................................................................................................... 27

TENNESSEE............................................................................................................................... 28

TEXAS......................................................................................................................................... 29

WASHINGTON .......................................................................................................................... 29

V. CLASS ALLEGATIONS .................................................................................... 35

A. Nationwide Data Breach Class ................................................................ 35

1. Nationwide Premera Policyholder and Plan Administration 

Subclass SHOULDN’T THIS INCLUDE THE FOLKS 

WHOSE PLANS PREMERA ADMINISTERED? ..................... 36

B. Alternate Statewide Common Law Classes............................................. 36

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 2 of 87
TABLE OF CONTENTS

(continued)

Page

- ii -

1. Statewide Premera Policyholder and Plan Administration 

Subclasses AND THOSE FOR WHOM PREMERA 

ADMINISTERED THEIR PLANS ............................................. 37

B. Alternate Statewide Statutory Classes..................................................... 37

C. Certification Of The Proposed Classes And Subclasses Is 

Appropriate. ............................................................................................. 39

II. CAUSES OF ACTION........................................................................................ 42

FIRST CLAIM FOR RELIEF

Violation of the Washington Consumer Protection Act (On behalf 

of Plaintiffs, the Nationwide Data Breach Class, and the 

Nationwide Premera Policyholder and Plan Administration 

Subclass) .................................................................................................. 42

SECOND CLAIM FOR RELIEF

Violation of Washington Data Breach Disclosure Law (On behalf 

of Plaintiffs and the Nationwide Data Breach Class) .............................. 49

THIRD CLAIM FOR RELIEF

Negligence (On behalf of Plaintiffs and the Nationwide Data 

Breach Class or, alternatively, the Statewide Common Law 

Classes) .................................................................................................... 50

FOURTH CLAIM FOR RELIEF

Breach of Express Contract (On behalf of Plaintiffs and the 

Nationwide Premera Policyholder and Plan Administration 

Subclass or, alternatively, the Statewide Premera Policyholder and 

Plan Administration Subclasses).............................................................. 55

FIFTH CLAIM FOR RELIEF

Breach of Contract Implied-In-Fact (On Behalf of Plaintiffs and 

the Nationwide Data Breach Class, or in the alterative, the 

Statewide Common Law Subclasses) (Plead in the Alternative to 

the Fourth Claim for Relief on Behalf of the Premera Policyholder 

and Plan Administration Subclasses)....................................................... 59

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 3 of 87
TABLE OF CONTENTS

(continued)

Page

- iii -

SIXTH CLAIM FOR RELIEF

Quasi-Contract/Restitution/Unjust Enrichment (On behalf of 

Plaintiffs and the Nationwide Premera Policyholder and Plan 

Administration Subclass or, alternatively, the Statewide Premera 

Policyholder and Plan Administration Subclasses) ................................. 62

SEVENTH CLAIM FOR RELIEF

Violation of State Consumer Protection Laws (In the Alternative to 

Count I) (On behalf of Plaintiffs and the Statewide Statutory 

Classes) .................................................................................................... 63

EIGHTH CLAIM FOR RELIEF

Violation of State Data Breach Notification Laws (In the 

alternative to Second Claim for Relief) (On behalf of Plaintiffs and 

the Statewide Statutory Classes).............................................................. 73

NINTH CLAIM FOR RELIEF

Violation of the California Confidential Medical Information Act 

(On behalf of Plaintiff Hansen-Bosse and the Statewide California 

Statutory Class)...................................................................................... 755

TENTH CLAIM FOR RELIEF

Misrepresentation by Omission (On behalf of Plaintiffs and the 

Nationwide Data Breach Class or, alternatively, the Statewide 

Common Law Classes) ............................................................................ 76

III. REQUEST FOR RELIEF .................................................................................... 79

IV. JURY DEMAND................................................................................................. 81

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 4 of 87
PAGE 1 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Plaintiffs Mary Fuerst, Ross Imbler, Anne Emerson, Debbie Hansen-Bosse, William 

Fitch, Eric Forseter, Anne Michelle Blackwolfe, Krishnendu and Madhuchanda Chakraborty, 

Howard Kaplowitz, Stuart and Ilene Hirsh, Darin Purcell, Kevin Smith and Catherine Bushman, 

Sharif Ailey, April Allred, Elizabeth Black, Ralph Christopherson, Robert and Theresa Foulon, 

Crystal Hayes, Barbara Lynch, Kevin McLallen, Surya Prakash, Gabriel and Laura Webster, and 

Joann Welch, individually and on behalf of the proposed Classes defined below, allege as 

follows upon personal knowledge, experience, information and belief, including investigation 

conducted by their attorneys.

I. NATURE OF THE CASE

1. Plaintiffs bring this class action lawsuit against Premera because of its failure 

to protect the confidential information of millions of consumers-including their names, dates of 

birth, mailing addresses, telephone numbers, email addresses, Social Security numbers, member 

identification numbers, medical claims information, financial information, and other protected 

health information as defined by the Health Insurance Portability and Accountability Act of 1996 

(“HIPAA”) (collectively, their “Sensitive Information”).

2. Premera is one of the largest healthcare benefits companies in the Pacific 

Northwest and is also a participant in the national Blue Cross Blue Shield Association (which 

offers healthcare to consumers throughout the United States and its territories, covering more 

than 105 million Americans). Premera’s participation in the Blue Cross Blue Shield Association 

provides its members with access to healthcare providers throughout the country and provides 

non-Premera Blue Cross members (referred to as “Blue members”) with access to its network. 

3. In order to become a Premera member (or, for Blue members, receive 

healthcare services from a provider within the Premera network), an individual must give 

Premera his or her Sensitive Information. Plaintiffs and the putative class took reasonable steps 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 5 of 87
PAGE 2 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

to preserve the confidentiality of their Sensitive Information in many ways, including protecting 

the Sensitive Information with confidential passwords and relying upon physician-patient 

privilege and confidentiality. Premera maintains this Sensitive Information in a centralized 

database.

4. As a healthcare benefits provider, Premera is required to protect both its 

members’ and also Blue members’ Sensitive Information, including by adopting and 

implementing specific data security regulations and standards set forth under HIPAA.

5. In addition to its implied statutory obligation, Premera expressly promises—

throughout its Notice of Privacy Practices, Code of Conduct, public statements, and other written 

assurances—to safeguard and protect Sensitive Information in accordance with HIPAA 

regulations, federal, state and local laws, and industry standards.

6. Unfortunately, Premera’s failure to protect the Sensitive Information in its 

control resulted in one of the largest healthcare data breaches in history. On March 17, 2015, 

Premera revealed that its computer network had been breached and the Sensitive Information of 

approximately 11 million of its former and current members, Blue members, and employees was 

compromised.

7. According to Premera, the breach started in May 2014 and went undetected 

for nearly one year. Worse yet, after discovering the breach, Premera waited months before 

notifying all affected individuals preventing Plaintiffs and the Class from taking steps to further 

prevent the misuse of their Sensitive Information. 

8. The breach not only revealed that Premera failed to provide the level of data 

protection that it promised and that members paid for, it also exposed millions of individuals’

Sensitive Information to an increased risk of misuse by unauthorized third parties (e.g., identity 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 6 of 87
PAGE 3 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

theft). In fact, affected individuals face a particularly real risk of misuse here (i.e., to the extent 

their information hasn’t been misused already) because their Sensitive Information was 

specifically targeted by hackers seeking to steal consumer data. Many of the class members have 

already suffered medical fraud, tax fraud, credit card fraud, and phishing scams, as a result of 

Premera’s illegal conduct. All class members are in real and imminent danger of the same fate.

9. Had Premera informed Plaintiffs and other members of the Classes that it 

would use inadequate security measures—including by using data security practices at odds with 

its own affirmative representations—members would not have been willing to sign-up or pay for 

Premera’s healthcare benefits at the price charged, if at all, and would not have been willing to 

provide their Sensitive Information to Premera.

10. Premera’s failure to implement adequate security protocols jeopardized 

millions of consumers’ Sensitive Information, fell well short of its statutory and professional 

standard obligations, fell short of Plaintiffs’ and other Class members’ reasonable expectations 

when they provided their Sensitive Information to Premera, and diminished the value of the 

services that Premera provided (in other words, because Premera failed to disclose its gross 

security inadequacies, it delivered a fundamentally less useful and less valuable service than the 

one members paid for). 

11. Accordingly, Plaintiffs bring suit, on behalf of themselves and all others 

similarly situated, to seek redress for Premera’s unlawful conduct.

II. PARTIES

12. Plaintiff Mary Fuerst is a natural person and citizen of the State of Alaska. 

Plaintiff Fuerst brings this action on behalf of herself and the Nationwide and Alaska Classes, as 

defined below.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 7 of 87
PAGE 4 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

13. Plaintiff Ross Imbler is a natural person and citizen of the State of Alaska. 

Plaintiff Imbler brings this action on behalf of himself and the Nationwide and Alaska Classes, 

as defined below.

14. Plaintiff Anne Emerson is a natural person and citizen of the State of 

Arkansas. Plaintiff Emerson brings this action on behalf of herself and the Nationwide and 

Arkansas Classes, as defined below.

15. Plaintiff Debbie Hansen-Bosse is a natural person and citizen of the State of 

California. Plaintiff Hansen-Bosse brings this action on behalf of herself and the Nationwide 

and California Classes, as defined below.

16. Plaintiff William Fitch is a natural person and citizen of the State of Idaho. 

Plaintiff Fitch brings this action on behalf of himself and the Nationwide and Idaho Classes, as 

defined below.

17. Plaintiff Eric Forseter is a natural person and citizen of the State of Maryland. 

Plaintiff Forseter brings this action on behalf of herself and the Nationwide and Maryland 

Classes, as defined below.

18. Plaintiff Anne Michelle Blackwolfe is a natural person and citizen of the State 

of Massachusetts. Plaintiff Blackwolfe brings this action on behalf of herself and the 

Nationwide and Massachusetts Classes, as defined below.

19. Plaintiffs Krishnendu & Madhuchanda Chakraborty are natural persons and 

citizens of the State of Massachusetts. Plaintiffs Chakraborty bring this action on behalf of 

themselves and the Nationwide and Massachusetts Classes, as defined below.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 8 of 87
PAGE 5 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

20. Plaintiff Howard Kaplowitz is a natural person and citizen of the State of New 

Jersey. Plaintiff Kaplowitz brings this action on behalf of himself and the Nationwide and New 

Jersey Classes, as defined below.

21. Plaintiffs Stuart and Ilene Hirsh are natural persons and citizens of the State of 

Oregon. Plaintiffs Hirsh bring this action on behalf of themselves and the Nationwide and 

Oregon Classes, as defined below.

22. Plaintiff Darin Purcell is a natural person and citizen of the State of Oregon. 

Plaintiff Purcell brings this action on behalf of himself and the Nationwide and Oregon Classes, 

as defined below.

23. Plaintiffs Kevin Smith and Catherine Bushman are natural persons and 

citizens of the State of Tennessee. Plaintiffs Smith and Bushman bring this action on behalf of 

themselves and the Nationwide and Tennessee Classes, as defined below.

24. Plaintiff Sharif Ailey is a natural person and citizen of the State of Texas. 

Plaintiff Ailey brings this action on behalf of himself and the Nationwide and Texas Classes, as 

defined below.

25. Plaintiff April Allred is a natural person and citizen of the State of 

Washington. Plaintiff Allred brings this action on behalf of herself and the Nationwide and 

Washington Classes, as defined below.

26. Plaintiff Elizabeth Black is a natural person and citizen of the State of 

Washington. Plaintiff Black brings this action on behalf of herself and the Nationwide and 

Washington Classes, as defined below.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 9 of 87
PAGE 6 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

27. Plaintiff Ralph Christopherson is a natural person and citizen of the State of 

Washington. Plaintiff Christopherson brings this action on behalf of himself and the Nationwide 

and Washington Classes, as defined below.

28. Plaintiffs Robert & Theresa Foulon are natural persons and citizens of the 

State of Washington. Plaintiffs Foulon bring this action on behalf of themselves and the 

Nationwide and Washington Classes, as defined below.

29. Plaintiff Crystal Hayes is a natural person and citizen of the State of 

Washington. Plaintiff Hayes brings this action on behalf of herself and the Nationwide and 

Washington Classes, as defined below.

30. Plaintiff Barbara Lynch is a natural person and citizen of the State of 

Washington. Plaintiff Lynch brings this action on behalf of herself and the Nationwide and 

Washington Classes, as defined below.

31. Plaintiff Kevin McLallen is a natural person and citizen of the State of 

Washington. Plaintiff McLallen brings this action on behalf of himself and the Nationwide and 

Washington Classes, as defined below.

32. Plaintiff Surya Prakash is a natural person and citizen of the State of 

Washington. Plaintiff Prakash brings this action on behalf of himself and the Nationwide and 

Washington Classes, as defined below.

33. Plaintiffs Gabriel & Laura Webster are natural persons and citizens of the 

State of Washington. Plaintiffs Webster bring this action on behalf of themselves and the 

Nationwide and Washington Classes, as defined below.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 10 of 87
PAGE 7 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

34. Plaintiff Joann Welch is a natural person and citizen of the State of 

Washington. Plaintiff Welch brings this action on behalf of herself and the Nationwide and 

Washington Classes, as defined below.

35. Defendant Premera Blue Cross is a healthcare benefits provider existing under 

the laws of the State of Washington with its headquarters and principal place of business located 

at 7001 220th Street SW, Building 1, Mountlake Terrace, Washington 98043. Premera’s 

relevant operations, including its primary marketing, administration and information security 

operations, as well as its vital employees (such as its Chief Information Security Officer) are all 

located in the State of Washington. Premera is also registered to conduct business in the State of 

Oregon (Oregon Secretary of State Registry Number 447360-80) and Alaska (Premera Blue 

Cross of Alaska, which is a trade name only).

III. JURISDICTION AND VENUE

36. This Court has subject matter jurisdiction over this action pursuant to 

28 U.S.C. § 1332(d)(2) because (a) at least one member of the putative Classes is a citizen of a 

state different from Defendant, and (b) the amount in controversy exceeds $5,000,000, exclusive 

of interest and costs.

37. This Court has personal jurisdiction over Defendant because it is registered to 

and regularly does conduct business in this District, and the unlawful conduct alleged in this 

Complaint occurred in, was directed to, and/or emanated, in part, from this District.

38. Venue is proper pursuant to 28 U.S.C. § 1391(b) because a substantial part of 

the events or omissions giving rise to the unlawful conduct alleged in this Complaint occurred in, 

was directed to, and/or emanated from this District. Venue is additionally proper because 

Defendant is registered to and does conduct business in this District.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 11 of 87
PAGE 8 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

IV. FACTUAL BACKGROUND

A. Premera Had A Duty And Contractual Obligation To Protect Its Members’

Sensitive Information From Unauthorized Disclosures.

39. Premera had a duty and obligation to keep confidential the Sensitive 

Information it obtained and to protect that information from unauthorized disclosures. Premera’s 

duty and obligations are based on: 1) HIPAA; 2) industry standards; 3) specific governmental 

warnings to Premera about its failure to meet those obligations; and 4) the promises it made to its 

members. All Class members provided their Sensitive Information to Premera with the common 

sense and reasonable understanding that Premera would comply with its obligations to keep 

Sensitive Information confidential and secure from unauthorized disclosures.

40. HIPPA mandates that Premera provide to every insured and everyone whose 

plan Premera administers a privacy notice. In its HIPPA mandated privacy notice, Premera 

promises every insured and everyone whose plan Premera administers it will keep Sensitive 

Information confidential and protect it from unauthorized disclosure, even beyond Premera’s 

regulatory obligations. In its Notice of Privacy Practices, Premera promises in relevant part:

THE PRIVACY OF YOUR MEDICAL AND FINANCIAL 

INFORMATION IS VERY IMPORTANT TO US.

At Premera Blue Cross, we are committed to maintaining the 

confidentiality of your medical and financial information, which 

we refer to as your “personal information,” regardless of format: 

oral, written, or electronic.

* * *

OUR RESPONSIBILITIES TO PROTECT YOUR PERSONAL 

INFORMATION

Under both the Health Insurance Portability and Accountability 

Act of 1996 (HIPAA) and the Gramm-Leach-Bliley Act, Premera 

Blue Cross must take measures to protect the privacy of your 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 12 of 87
PAGE 9 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

personal information. In addition, other state and federal privacy 

laws may provide additional privacy protection. Examples of your 

personal information include your name, Social Security number, 

address, telephone number, account number, employment, medical 

history, health records, claims information, etc.

We protect your personal information in a variety of ways. For 

example, we authorize access to your personal information by our 

employees and business associates only to the extent necessary to 

conduct our business of serving you, such as paying your claims. 

We take steps to secure our buildings and electronic systems from 

unauthorized access. We train our employees on our written 

confidentiality policy and procedures and employees are subject to 

discipline if they violate them. Our privacy policy and practices 

apply equally to personal information about current and former 

members; we will protect the privacy of your information even if 

you no longer maintain coverage through us.

We are required by law to:

protect the privacy of your personal information; provide this

Notice explaining our duties and privacy practices regarding your

personal information; notify you following a breach of your

unsecured personal information; and abide by the terms of this 

Notice.

41. Premera posts the same Notice of Privacy Practices on its website, 

acknowledging its duty and promising to protect all Sensitive Information in its possession.

42. Premera admitted its duty and promised to keep the Sensitive Information 

confidential and secure in other ways. For example, all individuals who register on Premera’s 

website must “accept” Premera’s Terms and Conditions. These Terms and Conditions contain a 

section entitled “Security of Your Personal Information,” in which Premera promises that 

“Premera.com takes precautions to protect users’ personal information both online and offline.”

43. Premera’s policy booklets, which form its member contracts, contain a section 

on “Privacy Policies and Practices” or a “Notice of Information Use and Disclosure,” which 

include promises such as:

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 13 of 87
PAGE 10 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

“We protect your privacy by making sure your information stays 

confidential. We have a company confidentiality policy and we 

require all employees to sign it.”

1

“To safeguard your privacy, we take care to ensure that your 

information remains confidential by having a company 

confidentiality policy and by requiring all employees to sign it.”

2

44. Premera’s website includes its Code of Conduct, which appears to include the 

“company confidentiality policy” referenced in the policy booklets.

3

 On “Customer 

Privacy,” Premera’s Code of Conduct promises:

We are committed to complying with federal and state privacy 

laws, including the HIPAA privacy regulations, that protect 

financial and health information of our customers. We use the 

following privacy principles to guide our actions:

Customers – Customers should enjoy the full array of privacy 

protections afforded to them by law and routinely granted by their 

providers. This is a values-based approach whereby we are 

focused on two core values: Customer Care and Integrity.

* * *

Where appropriate, we use technical and/or physical security 

safeguards to ensure our privacy policies are followed.

* * *

We are committed to ensuring the security of our facilities and 

electronic systems to prevent unauthorized access to Premera’s and 

our customers’ protected personal information (PPI).

We are expected to be aware of and follow established corporate 

policies, processes and procedures that are designated to secure our 

buildings and electronic systems in compliance with HIPAA 

Security requirements.

 

1

See, e.g., PBC00044925–44926, MSP Preferred Select Bronze 5250 HAS Benefit Booklet 

(2014).

2

See, e.g., PBC00046821, Premera Preferred Bronze 5250 HSA Benefit Booklet (2014).

3 Premera, Code of Conduct 12 (2016), available at

https://www.premera.com/documents/030553.pdf.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 14 of 87
PAGE 11 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

45. To further protect Sensitive Information from disclosure, Premera requires all 

vendors and contractors to sign Premera’s Vendor/Contractor Privacy Basics,4 which states:

Our policies and procedures require compliance with federal and 

state privacy laws, including HIPAA privacy and security 

regulations. Contractors, too, must follow our policies and 

procedures and comply with all laws and regulations to which the 

Company is subject.

46. As demonstrated by these excerpts from Premera’s Notice of Privacy 

Practices, contracts with Policyholder Plaintiffs (i.e., the policy booklets), Code of Conduct, and 

Vendor/Contractor Privacy Basics, Premera recognized the importance of keeping consumers’

Sensitive Information private and repeatedly promised to protect that Sensitive Information and 

comply with the data security requirements mandated by, among other things, federal and state 

privacy laws.

47. Premera’s data security obligations and promises were particularly important 

given the substantial increase in data breaches (particularly those in the healthcare industry) in 

the time period preceding Premera’s data breach. Premera’s failure to comply with those 

obligations and promises was particularly egregious in light of specific governmental warnings 

regarding the possibility of hacker attacks on companies like Premera. Such warnings further 

established Premera’s duty to keep class members’ Sensitive Information private and secure. 

48. For example, on April 8, 2014—just one month before the Premera breach

occurred—the Federal Bureau of Investigation’s Cyber Division issued a Private Industry 

Notification to companies within the healthcare sector, stating that “the health care industry is 

not technically prepared to combat against cyber criminals’ basic cyber intrusion tactics, 

techniques and procedures (TTPs), much less against more advanced persistent threats (APTs)”

 

4 Premera, Vendor/Contractor Privacy Basics (2014), available at

https://www.premera.com/documents/030628.pdf.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 15 of 87
PAGE 12 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

and pointed out that “[t]he biggest vulnerability was the perception of IT healthcare 

professionals’ beliefs that their current perimeter defenses and compliance strategies were 

working when clearly the data states otherwise.” The same warning specifically noted that “[t]he 

FBI has observed malicious actors targeting healthcare related systems, perhaps for the purpose 

of obtaining Protected Health Information (PHI) and/or Personally Identifiable Information 

(PII).”

5

49. Worse yet, a couple weeks before Premera’s breach, the U.S. Office of 

Personnel Management directly notified Premera about its network security vulnerabilities.6 The 

U.S. Office of Personnel Management’s April 18, 2014 report revealed that Premera failed to 

implement adequate measures to secure its network. It found “several areas of concern related to 

Premera’s network security controls” and noted that “patches are not being implemented in a 

timely manner,” “a methodology is not in place to ensure that unsupported or out-of-date 

software is not utilized,” and a vulnerability scan identified “insecure server configurations.”

7

50. Federal auditors notified Premera weeks before the breach that its networksecurity procedures were inadequate and informed it that some of the vulnerabilities could be 

exploited by hackers and expose sensitive information.8

 

5

(U) Health Care Systems and Medical Devices at Risk for Increased Cyber Intrusions for 

Financial Gain (Apr. 8, 2014), FBI Cyber Division Private Industry Notification, available at

http://www.aha.org/content/14/140408--fbipin-healthsyscyberintrud.pdf.

6 Mike Baker, Feds Warned Premera About Security Flaws Before Breach, Seattle Times, 

Mar. 18, 2015, available at http://www.seattletimes.com/business/local-business/feds-warnedpremera-about-security-flaws-before-breach/ (last visited Oct. 6, 2015).

7 U.S. Office of Personnel Management, Office of the Inspector General, Office of Audits, Audit 

of Information Systems General and Application Controls at Premera Blue Cross (Nov. 28, 

2014), https://s3.amazonaws.com/s3.documentcloud.org/documents/1688453/opm-audit.pdf.

8 Mike Baker, Feds Warned Premera About Security Flaws Before Breach, Seattle Times, 

available at http://www.seattletimes.com/business/local-business/feds-warned-premera-aboutsecurity-flaws-before-breach/ (Oct. 6, 2015).

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 16 of 87
PAGE 13 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

B. Premera Failed To Properly Protect Consumers’ Sensitive Information.

51. On May 5, 2014, hackers began the initial phase of their intrusion on 

Premera’s servers. A “phishing” email was sent to a Premera employee falsely purporting to be 

from a Premera Information Technology (IT) employee. The email included instructions to 

download a “security update.” Premera’s employee downloaded this “update,” which was 

actually malware that allowed hackers access to Premera’s servers. 

52. Notably, various internal security assessments that Premera had undertaken 

prior to this period confirmed that it was vulnerable to this exact type of attack.

53. The hackers used the domain name in their email of “premrera.com” (i.e., 

using an additional “r”). This wrong domain was visible in the email message. Around this 

same time, another phishing domain of “prennera.com” was also registered. Premera did not 

warn employees that scam domain names had been registered that were close to “Premera.com.”

54. After the Premera employee downloaded the malware, hackers had access to 

at least two of Premera’s servers for many months completely undetected.

55. In June of 2014, the U.S. Computer Emergency Readiness Team issued alerts 

regarding the danger of data hacking from a malware virus known as Gameover Zeus. 

56. In July of 2014, an end user reported a Trojan message to Premera’s IT 

department.

57. In August of 2014, a Premera virus scan detected a backdoor Trojan virus.

58. In September of 2014, Premera’s IT department indicated it was concerned 

about a possible “Gameover Zeus” infiltration, the dangers of which the media and U.S.

government had been reporting on for many months. 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 17 of 87
PAGE 14 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

59. On September 8, 2014, Premera IT employee, Gabriel Bigger, sent malware 

byte logs to Mandiant based on these concerns over Gameover Zeus infiltration. Mandiant 

quickly informed Premera the virus looked like Gameover Zeus on September 9, 2014.

60. On September 23, 2014, Premera IT informed senior executives that Premera 

computers had been infected with a virus. 

61. On October 10, 2014, Premera engaged Mandiant, a cyber-security firm, to 

perform an assessment of the security of its network. Mandiant provided its Mandiant Intelligent 

Response (MIR) agents (a tool to identify indicators of compromise and malware) to install on 

Premera’s workstations and laptops for the purposes of scanning for malware and other 

infections. 

62. On October 13, 2014, Jerry Vergeront provided a network status report that 

identified deficiencies in Premera’s Intrusion Detection System, a repeat deficiency initially 

identified in 2007

63. The pilot phase of the Mandiant project did not begin until December 2014 

and continued until early January 2015. Premera did not begin searching end-user work stations 

until January 8, 2015. Premera did not install network sensors until January 28, 2015. 

64. On January 29, 2015, Mandiant discovered a signature for SOGU malware 

traffic on the Premera network, confirmed infection of two servers, and confirmed that the 

malware was “beaconing” to attacker sites. SOGU is a type of Trojan that has been around for 

years. By January 30, 2015, Premera had finally uncovered that the SOGU malware had been in 

its system since May 2014. 

65. In February 2015, Mandiant continued to try to understand the full extent of 

the breach and whether and how much information had been removed from Premera’s system. 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 18 of 87
PAGE 15 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

At this time, Premera finally agreed to deploy Mandiant’s agents on all Premera servers, 

workstations, and laptops in order to assess the scope of the breach. This installation was only 

complete in late February, nearly a month after Mandiant first confirmed that a breach had 

occurred. 

66. On February 20, 2015, Premera notified the FBI of the data breach. On 

February 25, 2015, the FBI met with Premera and Mandiant. The FBI began its own 

investigation, as well.

67. Premera chose not to inform the public of the breach at this time although it 

had sufficient knowledge of the extent and scope of the breach, deciding instead to further 

investigate and attempt to remediate the breach before letting the public know that their Sensitive 

Information had been stolen (and was continuing to be stolen). 

68. Premera further waited until the weekend of March 6-8 to perform the 

complete remediation of its network, during which time information was still being accessed and 

stolen. Mandiant continued to monitor the network for the following week to ensure Premera 

had completely cleansed its system. 

69. It wasn’t until March 17, 2015—over eight months after being warned of a 

Trojan virus and 46 days after confirming the data breach—that Premera finally revealed to the 

public and governmental authorities other than the FBI that a massive data breach had occurred. 

70. In its notice, Premera revealed that its computer network was the target of “a 

sophisticated attack to gain unauthorized access to [its] Information Technology (IT) systems.”

9

 

As a result, the Sensitive Information belonging to approximately 11 million consumers—

including its current and former members, employees, and other Blue members—was 

 

9 Premera Has Been The Target Of A Sophisticated Cyberattack, Premera Blue Cross, available 

at http://premeraupdate.com/ (last visited Oct. 6, 2015).

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 19 of 87
PAGE 16 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

compromised. The breach affected Premera Blue Cross, Premera Blue Cross Blue Shield of 

Alaska, and affiliate brands Vivacity and Connexion Insurance Solutions, Inc. The breach also 

affected members of other Blue Cross Blue Shield plans who sought treatment in Washington, 

Oregon or Alaska.

71. Premera eventually acknowledged that the breach actually started in May 

2014 and went undetected by it for nearly one year.10

72. One month before Premera announced the Sensitive Information had been 

breached, another major healthcare provider reported that hackers had successfully taken 

sensitive information of approximately eighty million consumers. Security researchers believe 

that attackers initially gained access to the databases containing that information through 

phishing attempts (i.e., using legitimate-looking emails or websites to trick individuals into 

revealing confidential information, such as database login credentials) and linked malware11

involved in those phishing attacks to Chinese hackers who authorities refer to as “Deep Panda.”

73. Malware thought to have been authored by Deep Panda was later discovered 

in connection with the phishing website www.prennera.com.

C. Premera Violated HIPAA, Industry Standard Data Protection Protocols, 

And Its Own Representations Regarding Data Security.

74. HIPAA requires that healthcare providers (like Premera) adopt administrative, 

physical, and technical safeguards to ensure the confidentiality, integrity, and security of 

consumers’ Sensitive Information.

75. Unfortunately, Premera’s data breach resulted from a variety of failures to 

follow HIPAA mandated data-security protocols, many of which are also industry standard. 

 

10 Id.

11

“Malware” refers to malicious software designed to infiltrate and damage computers or 

computer systems.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 20 of 87
PAGE 17 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Among such deficient practices, Premera’s breach shows that it failed to implement (or 

inadequately implemented) information security policies or procedures such as effective 

employee training on phishing attempts, adequate intrusion detection systems, regular reviews of 

audit logs and authentication records, and other similar measures designed to protect the 

confidentiality of the Sensitive Information it maintained in its data systems.

76. More specifically, Premera’s security fiascos demonstrate that it failed to 

honor its duties and promises by not:

a. Maintaining an adequate data security system to reduce the risk of data 

breaches and cyber-attacks;

b. Adequately protecting Plaintiffs’ and the Classes’ Sensitive Information;

c. Ensuring the confidentiality and integrity of electronic protected health 

information it created, received, maintained, and transmitted in violation of 45 C.F.R.

§ 164.306(a)(1);

d. Implementing technical policies and procedures for electronic information 

systems that maintain electronic protected health information to allow access only to those 

persons or software programs that have been granted access rights in violation of 45 C.F.R.

§ 164.312(a)(1);

e. Implementing policies and procedures to prevent, detect, contain, and 

correct security violations in violation of 45 C.F.R. § 164.308(a)(1)(i);

f. Implementing procedures to review records of information system activity 

regularly, such as audit logs, access reports, and security incident tracking reports in violation of 

45 C.F.R. § 164.308(a)(1)(ii)(D);

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 21 of 87
PAGE 18 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

g. Protecting against any reasonably anticipated threats or hazards to the 

security or integrity of electronic protected health information in violation of 45 C.F.R.

§ 164.306(a)(2);

h. Protecting against reasonably anticipated uses or disclosures of electronic 

protected health information that are not permitted under the privacy rules regarding individually 

identifiable health information in violation of 45 C.F.R. § 164.306(a)(3);

i. Ensuring compliance with the HIPAA security standard rules by its 

workforce in violation of 45 C.F.R. § 164.306(a)(4); and

j. Training all members of its workforce effectively on the policies and 

procedures with respect to protected health information as necessary and appropriate for the 

members of its workforce to carry out their functions and to maintain security of protected health 

information in violation of 45 C.F.R. § 164.530(b).

77. Likewise, Premera’s security lapses demonstrate that it failed to follow 

through on its own representations about its data security practices, including those discussed 

above. Specifically, Premera did not:

a. Take precautions to protect users information, whether online or offline;

b. Maintain the confidentiality or privacy of the personal information—as 

defined by its Notice of Privacy Practices—in its control, specifically including information 

stored in electronic form;

c. Take steps to secure its electronic systems from unauthorized access;

d. Train its employees on Premera’s confidentiality policy and procedures 

and did not enforce its policy and procedures;

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 22 of 87
PAGE 19 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

e. Timely or reasonably notify affected individuals following the breach of 

their personal information;

f. Protect individuals’ privacy by making sure their information stayed 

confidential, including by failing to enforce or monitor employee compliance with its 

confidentiality policy or practices;

g. Ensure the security of its facilities and electronic systems to prevent 

unauthorized access to Premera’s and its customers’ protected personal information (PPI); and

h. Remain aware of or follow corporate policies, processes and procedures 

designated to secure electronic systems in compliance with HIPAA Security requirements.

78. Had Premera implemented the above-described data security protocols or 

policies, the consequences of the data breach could have been avoided, or at least significantly 

reduced (as the breach could have been detected nearly one year earlier, the amount of Sensitive 

Information compromised could have been greatly reduced or avoided entirely, and affected 

consumers could have been notified—and taken protective/mitigating actions—much sooner). 

For instance, had Premera (i) adequately trained its employees to protect themselves against 

phishing attempts (like those attempts described above), (ii) implemented adequate security 

protocols to detect breaches (i.e., detecting unauthorized access to its databases), or 

(iii) adequately reviewed authentication logs for anomalies (e.g., detecting abnormal access to its 

databases from unknown locations, or accessing or transferring large amounts of Sensitive 

Information), the breach could have been identified and thwarted before considerable amounts of 

Sensitive Information were compromised.

79. As discussed above, major healthcare entities (like Premera) have been 

targeted in damaging hacking attempts in recent years, and Premera was specifically warned that 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 23 of 87
PAGE 20 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

its network-security procedures were inadequate and that some of the vulnerabilities could be 

exploited by hackers to expose sensitive information (as described above). Premera thus knew 

or should have known that a data breach would likely result from its deficient security and 

privacy practices described above. Despite these warnings—and Premera’s own knowledge 

about the significant holes in its data security regime—Premera continued to assure its customers 

(and potential customers) that its data security systems were secure, including by making the 

express representations discussed above. 

80. Even though Premera promised its members and Blue members the abovedescribed security measures (i.e., that Premera’s promises, as well as HIPAA-mandated and 

industry standards would be used to protect their Sensitive Information), they were not 

adequately implemented (if at all), which resulted in the unauthorized release of Sensitive 

Information.

D. It Is Well Established That Security Breaches Lead To Instances Of Identity 

Theft.

81. The United States Government Accountability Office noted in a June 2007 

report on Data Breaches (“GAO Report”) that identity thieves use identifying data such as SSNs 

to open financial accounts, receive government benefits and incur charges and credit in a 

person’s name.12 As the GAO Report states, this type of identity theft is the most harmful 

because it may take some time for the victim to become aware of the theft, and the theft can 

impact the victim’s credit rating adversely.

 

12 See Personal Information: Data Breaches Are Frequent, but Evidence of Resulting Identity 

Theft Is Limited; However, the Full Extent Is Unknown (June 2007), United States Government 

Accountability Office, available at http://www.gao.gov/new.items/d07737.pdf.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 24 of 87
PAGE 21 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

82. In addition, the GAO Report states that victims of identity theft will face 

“substantial costs and inconveniences repairing damage to their credit records” and their “good 

name.”

13

83. According to the Federal Trade Commission (“FTC”), identity theft victims 

must often spend countless hours and large amounts of money repairing the impact to their 

credit.14 Identity thieves use stolen personal information such as SSNs for a variety of crimes, 

including credit card fraud, phone or utilities fraud, and bank/finance fraud.15

84. With access to an individual’s Sensitive Information, criminals can do more 

than just empty a victim’s bank account—they can also commit various types of fraud, 

including: obtaining a driver’s license or official identification card in the victim’s name but 

with the thief’s picture; using the victim’s name and SSN to obtain government benefits; or, 

filing a fraudulent tax return using the victim’s information. In addition, identity thieves may 

obtain a job using the victim’s SSN, rent a house or receive medical services, prescription drugs 

and goods, and fraudulent medical billing in the victim’s name, and may even give the victim’s 

personal information to police during an arrest resulting in an arrest warrant being issued in the 

 

13 Id.

14 See Identity Theft, Federal Trade Commission, http://www.consumer.ftc.gov/features/feature0014-identity-theft (last visited Oct. 6, 2015).

15 The FTC defines identity theft as “a fraud committed or attempted using the identifying 

information of another person without authority.” 17 C.F.R. § 248.201. The FTC describes 

“identifying information” as “any name or number that may be used, alone or in conjunction 

with any other information, to identify a specific person,” including, among other things, 

“[n]ame, Social Security number, date of birth, official State or government issued driver’s 

license or identification number, alien registration number, government passport number, 

employer or taxpayer identification number.” Id.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 25 of 87
PAGE 22 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

victim’s name.16 Further, loss of private and personal health information can expose the victim 

to loss of reputation, loss of job employment, blackmail and other negative effects.

85. Sensitive Information is such a valuable commodity to identity thieves that 

once the information has been compromised, criminals often trade the information on the “cyber 

black-market” for years. As a result of recent large-scale data breaches, identity thieves and 

cyber criminals have openly posted stolen credit card numbers, SSNs, and other Sensitive 

Information directly on various Internet websites making the information publicly available. In 

one study, researchers found hundreds of websites displaying stolen Sensitive Information. The 

study concluded:

It is clear from the current state of the credit card black-market that 

cyber criminals can operate much too easily on the Internet. They 

are not afraid to put out their email addresses, in some cases phone 

numbers and other credentials in their advertisements. It seems 

that the black market for cyber criminals is not underground at all. 

In fact, it’s very “in your face.”

17

86. A study by Experian found that the “average total cost” of medical identity 

theft to an individual is “about $20,000” per incident, and that a majority of victims of medical 

identity theft were forced to pay out-of-pocket costs for healthcare they did not receive in order 

to restore coverage.18 Almost half of medical identity theft victims lose their healthcare 

coverage as a result of the incident, while nearly one-third saw their insurance premiums rise, 

 

16 See Identity Theft, Federal Trade Commission, available at

http://www.consumer.ftc.gov/features/feature-0014-identity-theft (last visited Oct. 6, 2015).

17 See The Underground Credit Card Blackmarket, StopTheHacker, available at 

http://www.stopthehacker.com/2010/03/03/the-underground-credit-card-blackmarket/ (last 

visited Oct. 6, 2015).

18 See Elinor Mills, Study: Medical identity theft is costly for victims, CNET (Mar. 3, 2010), 

http://news.cnet.com/8301-27080_3-10460902-245.html (last visited Oct. 6, 2015).

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 26 of 87
PAGE 23 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

and forty percent were never able to resolve their identity theft at all.19 Indeed, data breaches 

and identity theft have a crippling effect on individuals and detrimentally impact the entire 

economy as a whole.

87. Further, medical databases are particularly high value targets for identity 

thieves. According to a 2012 Nationwide Insurance report, “[a] stolen medical identity has a $50 

street value – whereas a stolen social security number, on the other hand, only sells for $1.”

20

 In 

fact, the medical industry has experienced disproportionally higher instances of computer theft 

than any other industry.

88. In fact, individuals whose information was compromised in a similar data 

breach by the same hackers—Deep Panda—have already fallen victims to identity theft, such as 

tax return fraud.21

89. Indeed, Premera’s own data breach notification statements recognize the longlasting harmful effects of its misconduct and recommends that affected individuals remain 

vigilant to the possibility of fraud and identity theft by indefinitely reviewing their credit card, 

bank, and other financial statements for unauthorized activity.

E. Plaintiffs’ Experiences Underscore The Fact That All Class Members Are In 

Imminent Danger Of Identity Theft.

ALASKA

90. Plaintiff Mary Fuerst is a resident of Fairbanks, Alaska and was an Alaska 

resident during the period of the Premera Breach. Plaintiff Fuerst was a Premera policyholder 

from 2008 to 2013 and made partial premium payments under that policy through her employer. 

 

19 Id.

20 See Study: Few Aware of Medical Identity Theft Risk, Claims Journal, 

http://www.claimsjournal.com/news/national/2012/06/14/208510.htm (last visited Oct. 6, 2015).

21 See Jose Pagliery, A Hacker Stole Our $3,500 Tax Refund, CNN Money (Apr. 15, 2015), 

http://money.cnn.com/2015/04/15/technology/tax-hacker/ (last visited Oct. 6, 2015).

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 27 of 87
PAGE 24 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

In or around March 2015, Plaintiff Fuerst received a letter from Premera notifying her that her 

personal information may be compromised. Starting around the same time, she began receiving 

phishing calls seeking her personal information. Prior to the Premera breach she had not 

received calls of this nature. Soon thereafter, a fraudulent international charge appeared on 

Plaintiff Fuerst’s debit card. Although her bank ultimately reimbursed her for the fraudulent 

charge, Plaintiff Fuerst had to obtain a replacement card and complete a fraud affidavit. Plaintiff 

Fuerst has spent about 20 hours to date addressing issues arising from the Premera Breach.

91. Plaintiff Ross Imbler is a resident of Fairbanks, Alaska and was an Alaska 

resident during the period of the Premera Breach. Plaintiff Imbler has been a Premera 

policyholder since 2011 and makes partial premium payments through his employer. In or 

around March 2015, Plaintiff Imbler received three letters from Premera indicating that his, his 

wife’s, and his then 2-year-old daughter’s personal information may be compromised. Plaintiff 

Imbler is especially concerned about the long-term threat of identity theft to his daughter, as well 

as the immediate threat of fraud and identity theft for him and his wife. Plaintiff Imbler has 

spent about six hours to date addressing issues arising from the Premera Breach.

ARKANSAS

92. Plaintiff Anne Emerson is a resident of Little Rock, Arkansas and was an 

Arkansas resident during the period of the Premera Breach. Plaintiff Emerson has been an 

Arkansas Blue Cross Blue Shield (“AR BCBS”) policyholder since 2004 and, until mid-2015, 

made partial premium payments under that policy through her spouse’s employer. Since mid2015, she has been insured with AR BCBS under an individual policy with respect to which she 

has been making premium payments. Plaintiff Emerson received medical treatment in 

Washington State between 2004 and 2007. In or around March 2015, Plaintiff Emerson received 

a letter from AR BCBS notifying her that her personal information may have been compromised 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 28 of 87
PAGE 25 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

in the Premera Breach. Concerned that she would be the victim of fraud and/or identity theft, 

Plaintiff Emerson purchased credit monitoring and identity theft prevention that costs her 

approximately $100 annually. Plaintiff Emerson has spent about five hours to date addressing 

issues arising from the Premera Breach.

CALIFORNIA

93. Plaintiff Debbie Hansen-Bosse is a resident of San Clemente, California and 

was a California resident during the period of the Premera Breach. Plaintiff Hansen-Bosse and 

her two 14-year-old daughters have been Premera insureds since 2007. In or around March 

2015, Plaintiff Hansen-Bosse received a letter from Premera notifying her that her and her 

daughters’ personal information may have been compromised. In or around May 2015, while 

monitoring her credit, Plaintiff Hansen-Bosse discovered a hard inquiry for an auto loan on her 

credit report that she did not recognize and has been unable to verify as legitimate. Also in and 

around May 2015, Plaintiff Hansen-Bosse’s checking account was fraudulently accessed, 

causing failed automatic payments for two months of credit card payments. Concerned that she 

would be the victim of fraud and/or identity theft, Plaintiff Hansen-Bosse purchased credit 

monitoring and identity theft prevention that costs her approximately $25 per month. Plaintiff 

Hansen-Bosse has spent about 30 hours to date addressing issues arising from the Premera 

Breach.

IDAHO

94. Plaintiff William Fitch is a resident of Rigby, Idaho and was an Idaho resident 

during the period of the Premera Breach. Plaintiff Fitch was a Blue Cross of Blue Shield of 

Idaho policyholder from 1995 to 2013 and made partial premium payments through his 

employer. In or around March 2015, Plaintiff Fitch received a letter from Premera notifying him 

that his personal information may have been compromised. Starting around the same time, he 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 29 of 87
PAGE 26 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

began receiving phishing calls and emails seeking his personal information. Prior to the Premera 

breach he had not received these suspicious solicitations. Plaintiff Fitch has spent about 30 hours 

to date addressing issues arising from the Premera Breach.

MARYLAND

95. Plaintiff Eric Forseter is a resident of Bethesda, Maryland and was a Maryland 

resident during the period of the Premera Breach. Plaintiff Forseter was a Premera policyholder 

from 2008 to May 2015 and made partial premium payments through his employer. In or around 

March 2015, Plaintiff Forseter received a letter from Premera notifying him that his personal 

information may have been compromised. On or around May 1, 2015, a criminal fraudulently 

charged approximately $2,000 in airline tickets and office furniture on Plaintiff Forseter’s credit 

card account. Although his financial institution ultimately reversed the fraudulent charges, 

Plaintiff Forseter had to wait for a replacement card and reset automatic bill payments for at least 

25 accounts with the new card number. Plaintiff Forseter has spent about 20 hours to date 

addressing issues arising from the Premera Breach.

MASSACHUSETTS

96. Plaintiff Anne Michelle Blackwolfe is a resident of Shrewsbury, 

Massachusetts and was a Massachusetts resident during the period of the Premera Breach. 

Plaintiff Blackwolfe has been a Premera policyholder since 2009 and makes partial premium 

payments through her employer. In or around March 2015, Plaintiff Blackwolfe received a letter 

from Premera notifying her that her personal information may have been compromised. Plaintiff 

Blackwolfe has spent about 25 hours to date addressing issues arising from the Premera Breach.

97. Plaintiffs Krishnendu and Madhuchanda Chakraborty are residents of 

Burlington, Massachusetts and were Massachusetts residents during the period of the Premera 

Breach. Mr. Chakraborty was a Premera policyholder, with Mrs. Chakraborty as a dependent 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 30 of 87
PAGE 27 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

insured, for approximately six months in 2012 and made partial premium payments through his 

employer. In or around March 2015, the Chakrabortys received a letter from Premera notifying 

them that their personal information may have been compromised. In and around June 2015, 

Mrs. Chakraborty had unauthorized online music charges on her credit card account. Although 

her bank ultimately reversed the fraudulent charges, she had to wait for a new credit card and 

temporarily lost access to her line of credit. The Chakrabortys have spent about fifteen hours to 

date addressing issues arising from the Premera Breach.

NEW JERSEY

98. Plaintiff Howard Kaplowitz is a resident of Livingston, New Jersey and was a 

New Jersey resident during the period of the Premera Breach. Plaintiff Kaplowitz has been a 

Premera policyholder since about 2012 and makes partial premium payments through his 

employer. In or around March 2015, Plaintiff Kaplowitz received a letter from Premera 

notifying him that his personal information may have been compromised. Plaintiff Kaplowitz 

has spent about ten hours to date addressing issues arising from the Premera Breach, including 

monitoring his credit report for fraudulent activity. 

OREGON

99. Plaintiffs Stuart and Ilene Hirsh are residents of Salem, Oregon and were 

Oregon residents during the period of the Premera Breach. Mr. Hirsh was a Premera 

policyholder, with Mrs. Hirsh as a dependent insured, from approximately 1999 to 2006 and 

made partial premium payments through his employer. In or around March 2015, Mr. and 

Mrs. Hirsh received letters from Premera notifying them that their personal information may 

have been compromised. Mr. and Mrs. Hirsh have spent about six hours to date addressing issues 

arising from the Premera Breach, including monitoring their credit reports for fraudulent activity.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 31 of 87
PAGE 28 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

100. Plaintiff Darin Purcell is a resident of Milwaukie, Oregon and was an Oregon 

resident during the period of the Premera Breach. Plaintiff Purcell has been a Premera 

policyholder since 2013 and makes partial premium payments through his employer. In or 

around March 2015, Plaintiff Purcell received a letter from Premera notifying him that his 

personal information may have been compromised. Plaintiff Purcell has spent about three hours 

to date addressing issues arising from the Premera Breach, including monitoring his credit report 

for fraudulent activity. 

TENNESSEE

101. Plaintiffs Kevin Smith and Catherine Bushman, husband and wife, are 

residents of Franklin, Tennessee and were Tennessee residents during the period of the Premera 

Breach. Plaintiffs Smith and Bushman were both Premera policyholders at various times from 

approximately 2005 to 2010, then approximately 2011 to 2013, and each made partial premium 

payments through their employer. In or around March 2015, Plaintiffs Smith and Bushman 

received letters from Premera notifying them that their personal information may have been 

compromised. Also in and around March 2015, Plaintiffs Smith and Bushman received a large 

IRS tax refund check despite having not yet filed their 2014 tax return. After contacting the IRS, 

they discovered that someone had filed a fraudulent tax return using their names and Social 

Security numbers. Plaintiffs Smith and Bushman then filed identity theft affidavits with the IRS 

and the FTC, a police report, and sought a credit watch with one of the credit bureaus. At an inperson appointment with the IRS in Nashville, they were informed that, going forward, they will 

have to manually submit their tax returns with a security PIN. The processing of their 2014 tax 

return and refund was delayed approximately four months. In or around July of 2015, a criminal 

attempted to fraudulently open a credit card in both of their names, but the bank called Plaintiffs 

Smith and Bushman and they were able to confirm the fraud and cancel the account. Plaintiffs 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 32 of 87
PAGE 29 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Smith and Bushman have spent about 30 hours each to date addressing issues arising from the 

Premera Breach. 

TEXAS

102. Plaintiff Sharif Ailey is a resident of Keller, Texas and was a Texas resident 

during the period of the Premera Breach. Plaintiff Ailey has been a Premera policyholder since 

November 2011 and makes partial premium payments through his employer. In or around 

March 2015, Plaintiff Ailey received a letter from Premera notifying him that his personal 

information may have been compromised. In or around June 2015, Plaintiff Ailey discovered 

fraudulent credit accounts were being opened in his name. He has spent approximately $100 

requesting credit reports, freezing his credit report, and attempting to remove the fraudulent 

activity from his credit report. As a result of these credit issues caused by the Premera Breach, 

Plaintiff Ailey was unable to refinance the mortgage on his house. Plaintiff Ailey has spent 

about 25 hours to date addressing issues arising from the Premera Breach. 

WASHINGTON

103. Plaintiff April Allred is a resident of Washington and was a Washington 

resident during the period of the Premera Breach. Plaintiff Allred and her son were Premera 

insureds from 2007 to 2009 and from 2011 to 2012, and her husband, the policyholder, made 

partial premium payments through his employer. In or around March 2015, Plaintiff Allred 

received a letter from Premera notifying her that her and her family’s personal information may 

have been compromised. On or about April 15, 2015, Plaintiff Allred’s 2014 income tax return 

was rejected due to the use of her son’s Social Security number in another fraudulently filed 

return. Plaintiff Allred had to take additional trips to her accountant’s office, submit her tax 

return manually by mail, and wait several weeks longer to receive her tax refund. Plaintiff 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 33 of 87
PAGE 30 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Allred has spent about 25 hours to date addressing issues arising from the Premera Breach, 

including monitoring her credit report and bank accounts for fraudulent activity. 

104. Plaintiff Elizabeth Black is a resident of Seattle, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff Black was a Premera 

policyholder from 2000 to 2005 and made partial premium payments through her employer. On 

or about February 18, 2015, Plaintiff Black received a cellular phone that she never ordered, with 

an order date of February 13, 2015. On or about February 23, 2015, she learned that four 

additional cellular phones were fraudulently purchased in her name at two different retail 

locations in Oregon. On or about February 20, 2015, Plaintiff Black received a debit card for 

which she never applied. After speaking with the various vendors and indicating that these 

accounts were fraudulently opened, Plaintiff Black learned that the personal information used to 

open the accounts included her name, date of birth, mailing address, and Social Security number. 

After contacting the vendors multiple times, speaking with their fraud departments, and filing 

police reports, she was able to cancel the accounts. Plaintiff Black had to take time off from 

work without pay to tend to these problems, in addition to time spent at work on the phone trying 

to mitigate and resolve the identity theft and fraud. In or around March 2015, Plaintiff Black 

finally received a letter from Premera notifying her that her personal information may have been 

compromised. Plaintiff Black has spent about 25 hours to date addressing issues arising from the 

Premera Breach, including checking her credit report and bank accounts for fraudulent activity. 

In addition, Plaintiff Black also spent approximately $70 in unreimbursed overnight postage to 

place security freezes on her credit report. 

105. Plaintiff Ralph Christopherson is a resident of Seatac, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff Christopherson has been 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 34 of 87
PAGE 31 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

a Premera policyholder since 2011 and makes partial premium payments through his employer. 

In or around March 2015, Plaintiff Christopherson received a letter from Premera notifying him 

that his personal information may have been compromised. On or about April 2, 2015, Plaintiff 

Christopherson was the victim of a phishing scam: a man called, claiming he could help fix his

computer, and he already had Plaintiff Christopherson’s Social Security number and some old 

credit card numbers. After getting remote access to Plaintiff Christopherson’s computer, the 

criminal fraudulently accessed Plaintiff Christopherson’s bank account to steal approximately 

$900 via Western Union. He is still in the process of seeking reimbursement for this fraud. 

Plaintiff Christopherson has spent about 80 hours to date addressing issues arising from the 

Premera Breach, including placing credit locks on his bank account and credit reports, 

attempting to resolve the fraudulent charges, and monitoring his accounts for additional fraud.

106. Plaintiffs Robert and Theresa Foulon are residents of Bellevue, Washington 

and were Washington residents during the period of the Premera Breach. Mr. Foulon has been a 

Premera policyholder, with Mrs. Foulon and their children as dependent insureds, from 

approximately 1992 to 2009, then 2010 to present. Mr. Foulon now makes premium payments 

through his self-employment; prior to 2009 he made partial premium payments through his 

employer. In or around March 2015, the Foulons received letters from Premera notifying them 

that their and their children’s personal information may have been compromised. In or around 

April 2015, they then received a letter from the IRS indicating that their $9,539 tax refund was 

processing even though they had not yet filed a return. After logging into his tax account and 

seeing the bank account destination for the direct deposit was not theirs, Mr. Foulon contacted 

the IRS and reported that the tax return was fraudulent. The Foulons had to fill out the necessary 

forms to report the fraud and file their actual tax return manually, which they will always have to 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 35 of 87
PAGE 32 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

do going forward. On or about September 14, 2015, they received another letter from the IRS 

verifying that the prior return was fraudulent and providing a PIN for future filings. Mr. Foulon 

is still attempting to sort out his family’s 2014 tax return due to this attempted identity theft. The 

Foulons have spent about 30 hours to date addressing issues arising from the Premera Breach, 

including monitoring their credit reports for additional fraudulent activity. 

107. Plaintiff Crystal Hayes is a resident of Lynnwood, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff Hayes has been a 

Premera policyholder since 2012 and makes partial premium payments through her employer. In 

or around March 2015, Plaintiff Hayes received a letter from Premera notifying her that her 

personal information may have been compromised. Soon after the breach notification, her credit 

cards were cancelled and reissued due to fraudulent activity, but Plaintiff Hayes was unaware of 

the cancellation and her cards were declined when she attempted to use them. She had to reset 

her automatic bill payments with the reissued card information as well. Plaintiff Hayes has spent 

about five hours to date addressing issues arising from the Premera Breach, including requesting 

and checking her credit report and bank statements for fraudulent activity. 

108. Plaintiff Barbara Lynch is a resident of Seattle, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff Lynch has been a 

Premera policyholder for approximately 17 years and makes premium payments through her 

employer. Starting in and around January 2015, numerous fraudulent credit inquiries appeared 

on Plaintiff Lynch’s credit report, causing her credit score to drop approximately 100 points. 

Soon thereafter, she received notification from three different financial institutions that 

fraudulent accounts were opened in her name. Concerned that she would be the victim of 

additional fraud and/or identity theft, Plaintiff Lynch immediately purchased credit monitoring 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 36 of 87
PAGE 33 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

and identity theft protection, which costs her $30 per month. In or around March 2015, Plaintiff 

Lynch received a letter from Premera notifying her that her personal information may have been 

compromised. Plaintiff Lynch estimates that she has spent over 100 hours to date addressing 

issues arising from the Premera Breach, including aggressive remedial measures to restore her 

credit score. She continues to receive fraud alerts to the present day. 

109. Plaintiff Kevin McLallen is a resident of Covington, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff McLallen has been a 

Premera policyholder since approximately 2011 and makes partial premium payments through 

his employer (and now through COBRA). In or around March 2015, Plaintiff McLallen received 

a letter from Premera notifying him that his personal information may have been compromised. 

In or around April 2015, fraudulent charges appeared on Plaintiff McLallen’s credit and debit 

cards for small charges in New Jersey and Michigan. Even more recently, Plaintiff McLallen 

has received phishing calls where the criminals already have many of his personal identifying 

information. Plaintiff McLallen has spent about ten hours to date addressing issues arising from 

the Premera Breach, including pulling credit reports and purchasing his credit scores - and 

unreimbursed expense - to ensure they were accurate. He also spent time calling his banks to 

notify them of the fraudulent activity and researching additional credit security services. 

110. Plaintiff Surya Prakash is a resident of Seattle, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff Prakash was a Premera 

policyholder from 2005 to 2012 and made partial premium payments through his employer. In 

or around December 2014, approximately $3,500 in fraudulent charges appeared on his bank 

account. Plaintiff Prakash immediately notified the bank and canceled the account, but was 

without access to the stolen funds for two weeks until reimbursement. In or around February 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 37 of 87
PAGE 34 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

2015, he again experienced fraudulent activity totaling approximately $250 on different bank 

accounts. Again, Plaintiff Prakash canceled the cards and had to wait a few weeks for 

reimbursement of the stolen funds. In or around March 2015, Plaintiff Prakash received a letter 

from Premera notifying him that his personal information may have been compromised. In or 

around August 2015, Plaintiff Prakash received a letter from a collections company indicating he 

purchased over $2,000 in plane tickets that he never purchased. He has contacted all three credit 

bureaus to place alerts and freezes on his credit report. Plaintiff Prakash has spent about five 

hours to date addressing issues arising from the Premera Breach, including monitoring his bank 

accounts and credit report for additional fraud. 

111. Plaintiffs Gabriel and Laura Webster are residents of Seattle, Washington and 

were Washington residents during the period of the Premera Breach. Mr. Webster has been a 

Group Health and Regence Blue Cross policyholder, with Mrs. Webster and their 12-year-old 

son as dependent insureds, from approximately 2009 to 2011 and 2012 to present, respectively. 

Mr. Webster made premium payments on these policies through his employer, and the Websters 

all received medical treatment in Washington State from 2009 to present. In or around 

November 2014, Mr. Webster had fraudulent charges on his credit card. Although these charges 

were ultimately reimbursed, he temporarily lost access to his line of credit. In or around 

February 2015, the Websters attempted to file their 2014 tax return but were prevented from 

doing so due to a fraudulent return already filed in their names. They had to pay their accountant 

an extra fee to submit an amended filing and had to manually file the tax return. Going forward, 

the Websters will have to file their taxes using a new security PIN provided to them by the IRS 

every year. In or around March 2015, the Websters received letters from Premera notifying them

that their and their son’s personal information may have been compromised. The Websters have 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 38 of 87
PAGE 35 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

spent about 25 hours to date addressing issues arising from the Premera Breach, including 

numerous hours on the telephone attempting to resolve the fraudulent tax return. 

112. Plaintiff Joann Welch is a resident of Moses Lake, Washington and was a 

Washington resident during the period of the Premera Breach. Plaintiff Welch has been a Blue 

Cross of Illinois policyholder for over a decade and makes partial premium payments through 

her former employer’s retirement plan. She has received medical treatment in Washington State 

for the past 25 years. In or around March 2015, Plaintiff Welch received a letter from Premera 

notifying her that her personal information may have been compromised. Around the same time 

as the breach notification, she received an automated phishing call seeking her personal 

information and referencing her former employer. Prior to the Premera breach she had not 

received any such suspicious calls. Plaintiff Welch has spent about four hours to date addressing 

issues arising from the Premera Breach, including ordering and checking her credit report for 

fraudulent activity.

V. CLASS ALLEGATIONS

A. Nationwide Data Breach Class

113. Pursuant to Fed. R. Civ. P. 23(b)(1), (b)(2), and (b)(3), Plaintiffs assert 

statutory claims under the Washington Consumer Protection Act (First Claim for Relief) and the 

Washington data breach notification statute (Second Claim for Relief), and common law claims 

for negligence (Third Claim for Relief), contract implied-in-fact (Fifth Claim for Relief) and 

misrepresentation by omission (Tenth Claim for Relief) on behalf of a nationwide class defined 

as follows:

Nationwide Data Breach Class: All persons in the United States 

whose Sensitive Information was maintained on Premera’s 

database and compromised as a result of the breach announced by 

Premera on or around March 17, 2015.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 39 of 87
PAGE 36 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

1. Nationwide Premera Policyholder and Plan Administration Subclass 

114. Plaintiffs Fuerst, Imbler, Emerson, Kunz, Fitch, Gregory, Forseter, 

Blackwolfe, Chakraborty, Kaplowitz, Hirsh, Purcell, Bushman, Ailey, Allred, Black, 

Christopherson, Foulon, Hayes, Lynch, McLallen, Prakash, Webster, and Welch assert their 

common law claims for breach of express contract (Fourth Claim for Relief), breach of implied 

contract (Fifth Claim for Relief), and unjust enrichment (Sixth Claim for Relief) on behalf of a 

nationwide subclass defined as follows:

Nationwide Premera Policyholder and Plan Administration

Subclass: All Nationwide Data Breach Class members who paid 

money to Premera prior to March 17, 2015 in exchange for health

insurance or plan administration. 

115. As alleged herein, Premera’s headquarters are in Mountlake Terrace, 

Washington, its data centers and servers are located in Washington, and the Premera employees 

responsible for making decisions with respect to data security are based in Washington. 

Premera’s conduct resulting in the data breach took place exclusively, or primarily, in 

Washington. Premera, being headquartered in Washington, would reasonably expect to be 

bound by the laws of Washington. Furthermore, the majority of the Nationwide Data Breach 

Class members are residents of the state of Washington. Accordingly, applying Washington law 

to the claims of the Nationwide Data Breach Class and Nationwide Premera Policyholder and 

Plan Administration Subclass is appropriate.

B. Alternate Statewide Common Law Classes

116. Pursuant to Fed. R. Civ. P. 23(b)(1), (b)(2), and (b)(3), and in the alternative 

to the common law claim for negligence asserted on behalf of the Nationwide Data Breach Class, 

117. Plaintiffs assert their common law claim for negligence (Third Claim for 

Relief) on behalf of separate statewide classes defined as follows:

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 40 of 87
PAGE 37 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Statewide [name of State] Common Law Classes: All residents 

of [name of State] whose Sensitive Information was maintained on 

Premera’s database and compromised as a result of the breach 

announced by Premera on or around March 17, 2015.

1. Statewide Premera Policyholder and Plan Administration Subclasses

118. Plaintiffs Fuerst, Imbler, Emerson, Kunz, Fitch, Gregory, Forseter, Blackwolfe, 

Chakraborty, Kaplowitz, Hirsh, Purcell, Bushman, Ailey, Allred, Black, Christopherson, Foulon, 

Hayes, Lynch, McLallen, Prakash, Webster, and Welch assert their common law claims for 

breach of contract (Forth Claim for Relief), breach of implied contract (Fifth Claim for Relief), 

unjust enrichment (Sixth Claim for Relief), and misrepresentation by omission (Tenth Claim for 

Relief) on behalf of separate statewide subclasses defined as follows:

Statewide [name of State] Premera Policyholder and Plan 

Administration Subclasses: All residents of [name of State] 

whose Sensitive Information was maintained on Premera’s 

database and compromised as a result of the breach announced by 

Premera on or around March 17, 2015, and who paid money to 

Premera prior to March 17, 2015 in exchange for health insurance

or plan administration. 

B. Alternate Statewide Statutory Classes

119. Pursuant to Fed. R. Civ. P. 23(b)(1), (b)(2), and (b)(3), and in the alternative to 

the statutory claims asserted on behalf of the Nationwide Data Breach Class, Plaintiffs Emerson, 

Hansen-Bosse, Fitch, McKenzie, Gregory, Forseter, Blackwolfe, Kaplowitz, Hirsh, Purcell, 

Ailey, Black, Christopherson, Foulon, Hayes, Lynch, McLallen, Prakash, Webster, and Welch 

assert statutory claims for violation of state consumer protection statutes (Seventh Claim for 

Relief) and state data breach notification statutes (Eighth Claim for Relief) on behalf of separate 

statewide classes, defined as follows:

Statewide [name of State] Statutory Classes: All residents of 

[name of State] whose Sensitive Information was maintained on 

Premera’s database and compromised as a result of the breach 

announced by Premera on or around March 17, 2015.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 41 of 87
PAGE 38 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

120. Plaintiffs Emerson, Hansen-Bosse, Fitch, McKenzie, Gregory, Forseter, 

Blackwolfe, Kaplowitz, Hirsh, Purcell, Ailey, Black, Christopherson, Foulon, Hayes, Lynch, 

McLallen, Prakash, Webster, and Welch assert the state consumer protection statute claims 

(Seventh Claim for Relief) under the consumer protection laws of the following states: Arizona, 

Arkansas, California, Colorado, Connecticut, Delaware, Hawaii, Idaho, Illinois, Indiana, Iowa, 

Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Montana, Nebraska, 

New Hampshire, New Jersey, New Mexico, Nevada, New York, North Carolina, North Dakota, 

Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Dakota, Texas, Utah, Vermont, 

Washington, West Virginia, and Wyoming.

121. Plaintiffs Hansen-Bosse, Kaplowitz, Bushman, Ailey, Allred, Black, 

Christopherson, Foulon, Hayes, Lunch, McLallen, Prakash, Webster, and Welch assert the state 

data breach notification law claims (Eighth Claim for Relief) on behalf of separate statewide 

classes in and under the respective data breach statutes of the following states: California, 

Illinois, Iowa, Louisiana, Maryland, New Hampshire, New Jersey, North Carolina, South 

Carolina, Tennessee, Texas, Virginia, and Washington.

122. Plaintiff Hansen-Bosse also asserts claims for violation of the California 

Confidential Medical Information Act (Ninth Claim for Relief).

123. Excluded from the Classes and Subclass are: (1) Defendant, any entity or division 

in which Defendant has a controlling interest, and its legal representatives, officers, directors, 

assigns, and successors; (2) the Judge to whom this case is assigned and the Judge’s staff; and 

(3) governmental entities. Plaintiffs reserve the right to amend the Class definitions if discovery 

and further investigation reveal that the Class should be expanded, divided into further 

subclasses or modified in any other way.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 42 of 87
PAGE 39 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

C. Certification Of The Proposed Classes And Subclasses Is Appropriate.

124. Each of the proposed classes and subclasses meet the requirements for 

certification under Fed. R. Civ. P. 23(a), (b)(1), (b)(2), and (b)(3).

125. Numerosity: The exact number of members of the Classes is unknown to 

Plaintiffs at this time, but on information and belief, there are approximately 11 million 

individuals in the Classes, making joinder of each individual member impracticable. Ultimately, 

members of the Classes will be easily identified through Premera’s records.

126. Commonality and Predominance: There are many questions of law and fact 

common to the claims of Plaintiffs and the other members of the Classes, and those questions 

predominate over any questions that may affect individual members of the Classes. Common 

questions for the Classes include:

a. Whether Defendant failed to safeguard Plaintiffs’ and the Classes’

Sensitive Information adequately;

b. Whether Defendant failed to protect or otherwise keep Plaintiffs’ and the 

Classes’ Sensitive Information secure, as promised; 

c. Whether Defendant’s storage of Plaintiffs’ and the Classes’ Sensitive 

Information in the manner alleged violated HIPAA, federal, state and local laws, or industry 

standards;

d. Whether Defendant engaged in unfair or deceptive practices by failing to 

safeguard Plaintiffs’ and the Classes’ Sensitive Information properly as promised;

e. Whether Defendant violated the consumer protection statutes applicable to 

Plaintiffs and each of the Classes;

f. Whether Defendant failed to notify Plaintiffs and members of the Classes 

about the security breach as soon as practical and without delay after the breach was discovered;

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 43 of 87
PAGE 40 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

g. Whether Defendant acted negligently in failing to safeguard Plaintiffs’ and 

the Classes’ Sensitive Information;

h. Whether Defendant violated the California Confidential Medical 

Information Act;

i. Whether contracts existed between Defendant, on the one hand, and 

Plaintiffs and the members of the each of the Classes, on the other;

j. Whether Defendant’s conduct described herein constitutes a breach of its 

contracts with Plaintiffs and the members of each of the Classes; 

k. Whether Defendant should retain the money paid by Plaintiffs and 

members of each of the Classes to protect their Sensitive Information; and

l. Whether Plaintiffs and the members of the Classes are entitled to damages 

as a result of Defendant’s conduct.

127. Typicality: Plaintiffs’ claims are typical of the claims of the members of the 

Classes. Plaintiffs and the members of the Classes sustained damages as a result of Defendant’s 

uniform wrongful conduct during transactions with them.

128. Adequacy: Plaintiffs will fairly and adequately represent and protect the interests 

of the Classes, and have retained counsel competent and experienced in complex litigation and 

class actions. Plaintiffs have no interests antagonistic to those of the Classes, and Defendant has 

no defenses unique to Plaintiffs. Plaintiffs and their counsel are committed to prosecuting this 

action vigorously on behalf of the members of the proposed Classes, and have the financial 

resources to do so. Neither Plaintiffs nor their counsel have any interest adverse to those of the 

other members of the Classes.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 44 of 87
PAGE 41 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

129. Risks of Prosecuting Separate Actions: This case is appropriate for certification 

because prosecution of separate actions would risk either inconsistent adjudications which would 

establish incompatible standards of conduct for the Defendant or would be dispositive of the 

interests of members of the proposed Classes.

130. Policies Generally Applicable to the Classes: This class action is appropriate 

for certification because Defendant has acted or refused to act on grounds generally applicable to 

the Plaintiffs and proposed Classes as a whole, thereby requiring the Court’s imposition of 

uniform relief to ensure compatible standards of conduct towards members of the Classes, and 

making final injunctive relief appropriate with respect to the proposed Classes as a whole. 

Defendant’s practices challenged herein apply to and affect the members of the Classes 

uniformly, and Plaintiffs’ challenge of those practices hinges on Defendant’s conduct with 

respect to the proposed Classes as a whole, not on individual facts or law applicable only to 

Plaintiffs.

131. Superiority: This case is also appropriate for certification because class 

proceedings are superior to all other available means of fair and efficient adjudication of the 

claims of Plaintiffs and the members of the Classes. The injuries suffered by each individual 

member of the Classes are relatively small in comparison to the burden and expense of 

individual prosecution of the litigation necessitated by Defendant’s conduct. Absent a class 

action, it would be virtually impossible for individual members of the Classes to obtain effective 

relief from Defendant. Even if members of the Classes could sustain individual litigation, it 

would not be preferable to a class action because individual litigation would increase the delay 

and expense to all parties, including the Court, and would require duplicative consideration of 

the legal and factual issues presented here. By contrast, a class action presents far fewer 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 45 of 87
PAGE 42 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

management difficulties and provides the benefits of single adjudication, economies of scale, and 

comprehensive supervision by a single Court.

II. CAUSES OF ACTION

FIRST CLAIM FOR RELIEF

Violation of the Washington Consumer Protection Act

(On behalf of Plaintiffs, the Nationwide Data Breach Class,

and the Nationwide Premera Policyholder and Plan Administration Subclass)

132. Plaintiffs incorporate the foregoing allegations as if fully set forth herein.

133. Plaintiffs and the Nationwide Data Breach Class are current and former members 

of Premera or those who received services from healthcare providers in the Premera network and 

who provided Premera with their Sensitive Information.

134. Defendant is headquartered in Washington; its strategies, decision-making, and 

commercial transactions originate in Washington; most of its key operations and employees 

reside, work, and make company decisions (including data security decisions) in Washington; 

and Defendant and many of its employees are part of the people of the State of Washington. The 

conduct that Plaintiffs challenge directly affects the people of the State of Washington.

135. Washington’s Consumer Protection Act, RCW §§ 19.86.010, et seq. (“CPA”), 

protects both consumers and competitors by promoting fair competition in commercial markets 

for goods and services.

136. To achieve that goal, the CPA prohibits any person from using “unfair methods of 

competition or unfair or deceptive acts or practices in the conduct of any trade or commerce. . . .”

RCW § 19.86.020. 

137. Defendant expressly represented-including in its Notice of Privacy Practices, 

Code of Conduct, public statements, and other consumer-facing representations-that it would 

safeguard and protect Sensitive Information, including in accordance with HIPAA regulations, 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 46 of 87
PAGE 43 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

federal, state and local laws, and industry standards. Premera’s specific representations are set 

forth above in paragraphs 40-46. Premera made these representations available to the 

Nationwide Data Breach Class at all times (including through its website) and at the time that 

Class Members received services from its healthcare facilities. These representations were made

to the Nationwide Premera Policy Holder and administration Subclass in the enrollment process.

138. Consistent with its representations, Defendant accepted responsibility for securing 

Plaintiffs’ and the Nationwide Data Breach Class’s Sensitive Information. Given that it was 

Defendant’s responsibility for creating, overseeing, maintaining, and otherwise implementing its 

own data security practices, Defendant knew (or should have known) that it was not adequately 

protecting Plaintiffs’ or the Nationwide Data Breach Class’s Sensitive Information in accordance 

with its express guarantees. This is particularly true given the many warning signs that 

Premera’s systems were at risk of a breach-including those affecting the larger healthcare 

industry (e.g., the many other medical data breaches and warning of the Federal Bureau of 

Investigation’s Cyber Division) and those relating to Premera’s own security (e.g., the findings 

of the U.S. Office of Personnel Management investigation of Premera’s own systems). See 

especially paragraphs48-50 infra.

139. Despite this knowledge, Defendant failed to disclose that its data security systems 

and practices did not comport with the express representations set forth above in paragraph 40-

46, and otherwise described herein. In sum, and as set forth specifically above in paragraphs 67-

70, Defendant did not disclose that it did not take appropriate steps to secure electronic systems 

from unauthorized use, did not ensure that authorized personal had access to Sensitive 

Information only to the extent necessary to conduct their business, and did not meet its 

obligations under HIPAA and other state, local, and federal laws. Instead, Defendant continued 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 47 of 87
PAGE 44 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

to represent that its data security system was secure, even though it knew (or should have 

known) that it was not.

140. Premera’s conduct was deceptive. By failing to honestly disclose its true data 

security practices at the time that it accepted and maintained the Sensitive Information of 

Plaintiffs and members of the Nationwide Data Breach Class, Premera made affirmative 

misrepresentations and, thus, engaged in deceptive acts or practices. 

141. Given that Defendant alone knew about the true state of its data security and 

privacy practices and Defendant also knew that no reasonable consumer would purchase insecure 

health insurance services (i.e., services that did not comport with a provider’s own 

representations about its data security, or its other duties to comply with applicable law and/or 

industry standards), Defendant purposefully used its inflated representations of data security and 

privacy protocols, which it knew were false at the time they were made to consumers, to mislead 

Plaintiffs into using and/or paying for its insecure services. Premera’s conduct therefore had the 

capacity to deceive a substantial portion of the public.

142. Prior to the Premera’s public announcement of the data breach, neither Plaintiffs, 

nor members of the Nationwide Data Breach Class, nor the general public could have known that 

Defendant was not implementing the data security and privacy protocols in accordance with its 

own consumer-facing representations and applicable duties. Defendant knew that Plaintiffs and 

the Nationwide Data Breach Class would not allow Defendant access to their Sensitive 

Information-and thereby not give Defendant their business-if they knew Defendant could not and 

would not protect their Sensitive Information as it represented. And rather than implement the 

data security and privacy protocols it promised-including by timely notifying Plaintiffs and the 

Nationwide Data Breach Class promptly about the data breach-Defendant actively concealed its 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 48 of 87
PAGE 45 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

true practices and protocols (which were of material concern to all of its customers) in order to 

lead consumers to give Defendant access to their Sensitive Data, while at the same time 

expressly promising that Sensitive Information would be protected as described above.

143. Premera’s conduct was also unfair. By failing to disclose its compliance with its 

own data security representations and other obligations, Premera engaged in unfair acts or 

practices. Premera made the data security representations discussed above to attract consumersincluding Plaintiffs and members of the Nationwide Data Breach Class-who were concerned 

about the privacy and security of their Sensitive Information. 

144. Premera, however, failed to make good on its promises of data security by not 

investing the necessary resources in its cybersecurity program, not promptly notifying Plaintiffs 

and the Nationwide Data Breach Class promptly about the data breach, and otherwise not living 

up to the specific representations and obligations set forth above in paragraphs 40-46. Given the 

known risk of maintaining Sensitive Information with lax cybersecurity practices, Premera’s 

conduct was likely to cause substantial injuries to consumers. 

145. As set out above, because only Premera knew (or should have known) that it was 

not complying with its own data security representations and obligations, there was no way for 

members of the public, including Plaintiffs and members of the Nationwide Data Breach Class, 

to avoid the injury caused by Premera’s conduct. Further, Premera’s failure to live up to its data 

security representations and obligations did not create any countervailing benefits.

146. Consumers-like Plaintiffs and members of the Classes-value their privacy. 

Companies (such as health insurers) that offer adequate data security protections are more 

valuable to consumers than those with substandard security practices. As such, consumers will, 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 49 of 87
PAGE 46 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

if given the choice between two otherwise identical services, choose one with adequate security 

practices over one with substandard security practices.

147. Because of this consumer preference for data security, a healthcare benefits

company safeguarding and protecting Sensitive Information in accordance with HIPAA 

regulations, federal, state and local laws, and industry standards-in addition with its own 

affirmative representations of its data security practices-commands a higher market price for its 

coverage than a provider with substandard security.

148. Based on the representations made by Defendant, Plaintiffs and the Nationwide 

Premera Policyholder and Plan Administration Subclass believed Defendant would adequately 

protect their Sensitive Information, those security protections were valuable to them, and the 

protections formed the basis of their bargain inasmuch as Plaintiffs and the Nationwide Premera 

Policyholder and Plan Administration Subclass would not have purchased healthcare benefits

from Defendant at the prices charged (if at all) had Defendant disclosed its substandard security 

practices. Accordingly, Defendant’s omission regarding its true protection practices was 

material.

149. To Plaintiffs and the Nationwide Premera Policyholder and Plan Administration

Subclass, Defendant’s as-promised healthcare benefits offered significantly more utility or value 

than what was delivered, which lacked meaningful security protections. Thus, to Plaintiffs and 

the Nationwide Premera Policyholder and Plan Administration Subclass, Defendant’s secured 

healthcare benefits-as promised and paid-for-was substantially more valuable than the unsecure 

insurance received.

150. Accordingly, had Plaintiffs and members of the Nationwide Premera Policyholder 

and Plan Administration Subclass known that Defendant did not actually implement its promised 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 50 of 87
PAGE 47 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

data security and privacy protocols, they would not have been willing to purchase its healthcare 

benefits at the prices charged, if they would have paid money at all. 

151. Likewise, had Plaintiffs and members of the Nationwide Data Breach Class 

known that Defendant did not actually implement its promised data security and privacy 

protocols, they would not have been willing to provide Defendant with their Sensitive 

Information.

152. Defendant’s failure to disclose its actual (and substandard) security practices 

substantially injured the public because it caused millions of consumers to enter into transactions 

they otherwise would not have, and because it compromised the integrity of Plaintiffs’ and the 

Nationwide Class’s Sensitive Information. Further, Defendant’s use of substandard security did 

not create any benefits sufficient to outweigh the harm it caused.

153. Defendant’s deceptive and unfair acts or practices occurred in its trade or business 

and has proximately caused injury to Plaintiffs and the putative Nationwide Class. Defendant’s 

general course of conduct is injurious to the public interest, and such acts are ongoing and/or 

have a substantial likelihood of being repeated inasmuch as the long-lasting harmful effects of its 

misconduct may last for years (e.g., affected individuals could experience identity theft for 

years). As a direct and proximate result of Defendant’s unfair acts, Plaintiffs and members of the 

Nationwide Data Breach Class have suffered actual injuries, including without limitation 

investing substantial time or money in monitoring and remediating the harm inflicted upon them.

154. As a result of Defendant’s conduct, Plaintiffs and members of the Nationwide 

Data Breach Class have suffered actual damages, including the lost value of their privacy, the 

lost value of their personal data and lost property in the form of their breached and compromised 

Sensitive Information (which is of great value to third parties); ongoing, imminent, certainly 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 51 of 87
PAGE 48 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

impending threat of identity theft crimes, fraud, and abuse, resulting in monetary loss and 

economic harm; actual identity theft crimes, fraud, and abuse, resulting in monetary loss and 

economic harm; loss of the confidentiality of the stolen confidential data; the illegal sale of the 

compromised data on the deep web black market; expenses and/or time spent on credit 

monitoring and identity theft insurance; time spent scrutinizing bank statements, credit card 

statements, and credit reports; expenses and/or time spent initiating fraud alerts; decreased credit 

scores and ratings; lost work time; and other economic and non-economic harm.

155. Further, as a result of Defendant’s conduct, Plaintiffs and members of the 

Nationwide Premera Policyholder and Plan Administration Subclass have suffered actual 

damages in an amount equal to the difference in the market value of the secure healthcare 

benefits they paid for and the unsecured healthcare benefits they received.

156. Accordingly, Plaintiffs, on behalf of themselves and members of the Nationwide 

Data Breach Class and Nationwide Premera Policyholder and Plan Administration Subclass, seek 

to enjoin further violation and recover actual damages and treble damages (where applicable), 

together with the costs of bringing this suit, including reasonable attorneys’ fees.

157. With respect to injunctive relief, Plaintiffs, on behalf of themselves and members 

of the Nationwide Data Breach Class and Nationwide Premera Policyholder and Plan 

Administration Subclass, seek an Order requiring Premera to: (1) engage third-party security 

auditors/penetration testers as well as internal security personnel to conduct testing, including 

simulated attacks, penetration tests, and audits on Premera’s systems on a periodic basis, and 

ordering Premera to correct any problems or issues detected by such third-party security auditors 

promptly; (2) engage third-party security auditors and internal personnel to run automated 

security monitoring; (3) audit, test, and train its security personnel regarding any new or 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 52 of 87
PAGE 49 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

modified procedures; (4) segment data by, among other things, creating firewalls and access 

controls so that if one area of Premera’s network is compromised, hackers cannot gain access to 

other portions of Premera; (5) curing checks; (6) routinely and continually conduct internal 

training and education to inform internal security personnel how to identify and contain a breach 

when it occurs and what to do in response to a breach; and (7) meaningfully educate all class 

members about the threats they face as a result of the loss of their confidential financial, 

personal, and health information to third parties, as well as the steps affected individuals must 

take to protect themselves.

SECOND CLAIM FOR RELIEF

Violation of Washington Data Breach Disclosure Law

(On behalf of Plaintiffs and the Nationwide Data Breach Class)

158. Plaintiffs incorporate all the foregoing factual allegations as if fully set forth 

herein.

159. Plaintiffs allege additionally and alternatively that RCW § 19.255.010(2) provides 

that “[a]ny person or business that maintains computerized data that includes personal 

information that the person or business does not own shall notify the owner or licensee of the 

information of any breach of the security of the data immediately following discovery, if the 

personal information was, or is reasonably believed to have been, acquired by an unauthorized 

person.” See RCW § 19.255.010(2) (2005).

160. The data breach described in Section II resulted in an “unauthorized acquisition of 

computerized data that compromise[d] the security, confidentiality, [and] integrity of personal 

information maintained by” Defendant and, therefore, experienced a “breach of [its] security of 

[its] system”, as defined by RCW § 19.255.010(4) (2005).

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 53 of 87
PAGE 50 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

161. Defendant failed to disclose the breach of its network immediately, after 

discovering the breach. Instead, it waited months before notifying all affected individuals. 

Defendant unreasonably delayed informing Plaintiffs and members of the Nationwide Data 

Breach Class about the data breach after it knew or should have known that the data breach had 

occurred. 

162. Defendant’s failure to provide notice immediately after discovering the breach is 

a violation of RCW § 19.255.010.

THIRD CLAIM FOR RELIEF

Negligence

(On behalf of Plaintiffs and the Nationwide Data Breach Class

or, alternatively, the Statewide Common Law Classes)

163. Plaintiffs incorporate all the foregoing factual allegations as if fully set forth 

herein.

164. Plaintiffs allege additionally and alternatively that Premera required Plaintiffs and 

Nationwide Data Breach Class members or alternatively, members of the Statewide Common 

Law Classes, to submit Sensitive non-public personal health and financial information in order to 

obtain coverage under a health insurance policy and/or receive treatment in the Blue Cross Blue 

Shield network. 

165. By collecting and storing this data, Premera had a duty of care to use reasonable 

means to secure and safeguard this personal and health information, to prevent disclosure of the 

information, and to guard the information from theft. Premera’s duty included a responsibility to 

implement a process by which it could detect a breach of its security systems in a reasonably 

expeditious period of time and to give immediate notice in the case of a data breach.

166. Furthermore, given the other major data breaches affecting the healthcare industry 

and the warnings provided by federal auditors that Premera’s network-security procedures were 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 54 of 87
PAGE 51 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

inadequate and that the vulnerabilities could be exploited by hackers and expose sensitive 

information (as described above), Plaintiffs and the Nationwide Data Breach Class members or 

alternatively, members of the Statewide Common Law Classes, are part of a well-defined, 

foreseeable, finite, and discernible group that was at high risk of having their Sensitive 

Information stolen. 

167. Premera owed a duty to Plaintiff and members of the Nationwide Data Breach 

Class or alternatively, members of the Statewide Common Law Classes, to provide security 

consistent with industry standards, statutory requirements, and the other requirements discussed 

herein, and to ensure that its systems and networks—and the personnel responsible for them—

adequately protected its consumers’ Sensitive Information. 

168. Premera admitted and assumed its duty to implement reasonable security 

measures as a result of its general conduct, internal policies and procedures, its Privacy Policy, 

and its Code of Conduct, in which Premera states that it is “committed to ensuring the security of 

our facilities and electronic systems to prevent unauthorized access to Premera’s and our 

customers’ personal protected information (PPI).” Through these and other statements, Premera 

specifically assumed the duty to comply with industry standards and HIPAA in protecting 

confidential information.

169. Premera’s duty to use reasonable security measures arose as a result of the special 

relationship that existed between Premera and the Plaintiffs and the members of the Nationwide 

Data Breach Class or alternatively, members of the Statewide Common Law Classes. The 

special relationship arose because Plaintiffs and the members of the Nationwide Data Breach 

Class or alternatively, members of the Statewide Common Law Classes, entrusted Defendant 

with their confidential data, as part of the health treatment process. Only Premera was in a 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 55 of 87
PAGE 52 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

position to ensure that its systems were sufficient to protect against the harm to Plaintiffs and the 

members of the Nationwide Data Breach Class or alternatively, members of the Statewide 

Common Law Classes, from a data breach.

170. Premera’s duty to use reasonable security measures also arose under HIPAA, 

pursuant to which Premera is required to “reasonably protect” confidential data from “any 

intentional or unintentional use or disclosure” and to “have in place appropriate administrative, 

technical, and physical safeguards to protect the privacy of protected health information.” 

45 C.F.R. § 164.530(c)(1). The confidential data at issue in this case constitutes “protected 

health information” within the meaning of HIPAA.

171. In addition, Premera had a duty to use reasonable security measures under Section 

5 of the Federal Trade Commission Act, 15 U.S.C. § 45, which prohibits “unfair . . . practices in 

or affecting commerce,” including, as interpreted and enforced by the FTC, the unfair practice of 

failing to use reasonable measures to protect confidential data by healthcare benefit providers 

like Defendant. The FTC publications and data security breach orders described above further 

form the basis of Premera’s duty. 

172. Premera’s duty to use reasonable care in protecting confidential data arose not 

only as a result of the common law and the statutes and regulations described above, but also 

because it was bound by, and had committed to comply with, industry standards for the 

protection of confidential Sensitive Information. 

173. Premera breached its common law, statutory and other duties—and thus, was 

negligent—by failing to use reasonable measures to protect consumers’ confidential data from 

hackers and by failing to provide timely notice of the at-issue breach. The specific negligent acts 

and omissions committed by Premera include, but are not limited to, the following:

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 56 of 87
PAGE 53 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

a. Failing to adopt, implement, and maintain adequate security measures to 

safeguard Plaintiffs’ and proposed Nationwide Data Breach Class members’ or alternatively, 

members of the Statewide Common Law Classes’, confidential data; 

b. Failing to monitor the security of its networks adequately; 

c. Allowing unauthorized access to Plaintiffs’ and the proposed Nationwide 

Data Breach Class members’ or, alternatively, members of the Statewide Common Law Classes’, 

confidential data; 

d. Failing to recognize in a timely manner that Plaintiffs’ and proposed 

Nationwide Data Breach Class members’ or alternatively, members of the Statewide Common 

Law Classes’, confidential data had been compromised; and

e. Failing to warn Plaintiffs and the members of the proposed Nationwide 

Data Breach Class or alternatively, members of the Statewide Common Law Classes, in a timely 

manner that their Sensitive Information was likely to be and had been compromised.

174. It was foreseeable that Premera’s failure to use reasonable measures to protect 

confidential data, to disclose to Plaintiffs its inadequate security system, and to provide timely 

notice of a breach of such data would result in injury to Plaintiffs and the members of the 

Nationwide Data Breach Class or alternatively, members of the Statewide Common Law 

Classes. Further, the breach of security, unauthorized access, and resulting injury to Plaintiffs 

and the members of the Nationwide Data Breach Class or alternatively, members of the 

Statewide Common Law Classes were reasonably foreseeable, particularly in light of the other 

major data breaches affecting the healthcare industry and the warning provided by federal 

auditors (described in Section I, above) that Premera’s network-security procedures were 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 57 of 87
PAGE 54 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

inadequate and that the vulnerabilities could be exploited by hackers and expose sensitive 

information.

175. It was therefore reasonably foreseeable that the failure to adequately safeguard 

confidential data would result in one or more of the following injuries to Plaintiffs and the 

members of the proposed Nationwide Data Breach Class or alternatively, members of the 

Statewide Common Law Classes: ongoing, imminent, certainly impending threat of identity 

theft crimes, fraud, and abuse, resulting in monetary loss and economic harm; actual identity 

theft crimes, fraud, and abuse, resulting in monetary loss and economic harm; loss of the value of 

their privacy and the confidentiality of the stolen confidential data; the illegal sale of the 

compromised data on the deep web black market; expenses and/or time spent on credit 

monitoring and identity theft insurance; time spent scrutinizing bank statements, credit card 

statements, and credit reports; expenses and/or time spent initiating fraud alerts; decreased credit 

scores and ratings; lost work time; and other economic and non-economic harm.

176. Accordingly, Plaintiffs, on behalf of themselves and members of the Nationwide 

Data Breach Class or alternatively, members of the Statewide Common Law Classes, seek an 

order declaring that Defendant’s conduct constitutes negligence, and awarding them damages in 

an amount to be determined at trial.

177. Washington law should apply to the negligence claim of the Nationwide Class, or, 

alternatively, the negligence claims of the Statewide Common Law Classes should be governed 

by the law of each state in which such state specific claims are brought.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 58 of 87
PAGE 55 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

FOURTH CLAIM FOR RELIEF

Breach of Express Contract

(On behalf of Plaintiffs and the Nationwide Premera Policyholder and Plan Administration

Subclass or, alternatively, the Statewide Premera and Plan Administration Policyholder 

and Plan Administration Subclasses)

178. Plaintiffs incorporate all foregoing factual allegations as if fully set forth herein.

179. Plaintiffs and members of the Nationwide Premera Policyholder and Plan 

Administration Subclass or alternatively, members of the Statewide Premera Policyholder and 

Plan Administration Subclasses, allege additionally and alternatively that they entered into valid 

and enforceable contracts with Defendant whereby Defendant promised to provide healthcare 

and to protect their Sensitive information. Plaintiffs and members of the Nationwide Premera 

Policyholder and Plan Administration Subclass or alternatively, members of the Statewide 

Premera Policyholder and Plan Administration Subclasses, agreed to, among other things, pay 

money in consideration for such services.

180. Both the provision of healthcare and the protection of Plaintiffs’ Sensitive 

Information were material aspects of Plaintiffs’ and the Nationwide Premera Policyholder and 

Plan Administration Subclass members’ or alternatively, members of the Statewide Premera 

Policyholder and Plan Administration Subclasses’, agreements with Defendant. 

181. As alleged in Paragraphs 39-46, above, Premera sends its Notice of Privacy 

Policy and its policy booklets to all members of the Nationwide Premera Policyholder and Plan 

Administration Subclass, forming an express contract requiring Premera to implement data 

security adequate to safeguard and protect the confidentiality of Sensitive Information. 

182. Premera’s policy booklets incorporate by reference Premera’s company 

confidentiality policy, Code of Conduct, and Vendor/Contractor Privacy Basics in each of which, 

as alleged in Paragraphs 40-45, above, Premera explicitly promised to implement data security 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 59 of 87
PAGE 56 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

that would comply with federal and state laws, as well as industry standards, and that would 

safeguard and protect the confidentiality of Sensitive Information.

183. Alternatively, the express contracts between Premera and Plaintiffs and members 

of Nationwide Premera Policyholder and Plan Administration Subclass (or alternatively, 

members of the Statewide Premera Policyholder and Plan Administration Subclasses) included 

implied terms requiring Premera to implement data security adequate to safeguard and protect 

the confidentiality of their Sensitive Information, including in accordance with HIPAA 

regulations, federal, state and local laws, and industry standards. No member of the Subclass 

would have entered into contracts with Premera without understanding that their Sensitive 

Information would be safeguarded and protected; stated otherwise, data security—as set forth in 

Premera’s Notice of Privacy Practices, Code of Conduct, and Vendor/Contractor Privacy 

Basics—was an essential implied term of the Parties’ express contract.

184. These contracts required that Defendant protect Plaintiffs’ and the Nationwide 

Premera Policyholder and Plan Administration Subclass members’ or alternatively, members of 

the Statewide Premera Policyholder and Plan Administration Subclasses’, Sensitive Information 

and to prevent unauthorized access to such information.

185. Unfortunately, Defendant did not safeguard Plaintiffs’ and the Nationwide 

Premera Policyholder and Plan Administration Subclass members’ or alternatively, members of

the Statewide Premera Policyholder and Plan Administration Subclasses’, Sensitive Information. 

Specifically, Defendant did not comply with its promises to abide by HIPAA, federal, state and 

local laws, or industry standards, or otherwise protect individuals’ Sensitive Information, as set 

forth above in paragraphs 67-69.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 60 of 87
PAGE 57 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

186. The failure to meet these promises and obligations constitutes a breach of express 

contract. 

187. Because Defendant allowed unauthorized access to Plaintiffs’ and the Nationwide 

Premera Policyholder and Plan Administration Subclass members’ or alternatively, members of 

the Statewide Premera Policyholder and Plan Administration SubclassPolicyholder and Plan 

Administration Subclasses’, Sensitive Information and otherwise failed to safeguard it as

promised, Defendant breached its contracts with Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration SubclassPolicyholder and Plan Administration 

Subclass (or alternatively, members of the Statewide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclasses).

188. A meeting of the minds occurred, as Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration SubclassPolicyholder and Plan Administration 

Subclass or alternatively, members of the Statewide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclasses, agreed to, among 

other things, provide Defendant with their accurate and complete information (including their 

Sensitive Information) and to pay Defendant in exchange for its agreement to, among other 

things, protect their Sensitive Information.

189. Defendant breached these contracts by failing to implement (or adequately 

implement) sufficient security measures to protect Plaintiffs’ and the Nationwide Premera 

Policyholder and Plan Administration SubclassPolicyholder and Plan Administration Subclass

members’ or alternatively, members of the Statewide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclasses’, Sensitive 

Information.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 61 of 87
PAGE 58 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

190. Defendant’s failure to fulfill its data security and management promises resulted 

in Plaintiffs and members of the Nationwide Premera Policyholder and Plan Administration 

SubclassPolicyholder and Plan Administration Subclass or alternatively, members of the 

Statewide Premera Policyholder and Plan Administration SubclassPolicyholder and Plan 

Administration Subclasses, receiving healthcare benefits that was of less value than they paid for 

(i.e., healthcare benefits coverage without adequate protection of Plaintiffs Sensitive 

Information).

191. Defendant’s failure to fulfill its data security and management promises resulted 

in Plaintiffs and members of the Nationwide Premera Policyholder and Plan Administration 

SubclassPolicyholder and Plan Administration Subclass or alternatively, members of the 

Statewide Premera Policyholder and Plan Administration SubclassPolicyholder and Plan 

Administration Subclasses, losing the value of their privacy. 

192. Stated otherwise, because Plaintiffs and members of the Nationwide Premera 

Policyholder and Plan Administration SubclassPolicyholder and Plan Administration Subclass or 

alternatively, members of the Premera Policyholder and Plan Administration 

SubclassPolicyholder and Plan Administration Subclasses, paid for privacy protections (as part 

of, among other things, their premiums) they did not receive what they paid for— even though 

such protections were a material part of their contracts with Defendant— i.e. the full benefit of 

their bargain.

193. As a result of Defendant’s conduct, Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration SubclassPolicyholder and Plan Administration 

Subclass or alternatively, members of the Statewide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclasses, have suffered 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 62 of 87
PAGE 59 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

damages because they did not get the benefit of the bargain, including but not limited to the 

difference in the value of the secure healthcare benefits they paid for and the insecure healthcare 

benefits they received.

194. As a result of Defendant’s conduct, Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration SubclassPolicyholder and Plan Administration 

Subclass or alternatively, members of the Statewide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclasses, have suffered actual 

damages in an amount equal to the value of their privacy. 

195. Accordingly, Plaintiffs, on behalf of themselves and the other members of the 

Nationwide Premera Policyholder and Plan Administration SubclassPolicyholder and Plan 

Administration Subclass, or alternatively, the Statewide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclasses, seek an order 

declaring that Defendant’s conduct constitutes breach of express contract, and awarding them 

damages in an amount to be determined at trial.

FIFTH CLAIM FOR RELIEF

Breach of Contract Implied-In-Fact

(On Behalf of Plaintiffs and the Nationwide Data Breach Class, or in the alterative, the 

Statewide Common Law Subclasses) (Plead in the Alternative to the Fourth Claim for 

Relief on Behalf of the Premera Policyholder and Plan Administration 

SubclassPolicyholder and Plan Administration Subclasses)

196. Plaintiffs incorporate all the foregoing factual allegations as if fully set forth 

herein.

197. In order to procure Defendant’s health insurance and/or other benefits, Plaintiffs 

and all Class members provided Defendant with their Sensitive Information.

198. By providing their Sensitive Information, and upon Defendant’s acceptance of 

such information, Plaintiffs and all Class members, on one hand, and Defendant, on the other 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 63 of 87
PAGE 60 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

hand, entered into implied-in-fact contracts for the provision of data security, separate and apart 

from any express contracts concerning health insurance or other benefits that such Plaintiffs or 

Class members may have had with Defendant.

199. These implied contracts between Defendant and all Class members obligated 

Defendant to take reasonable steps to secure and safeguard Class members’ Sensitive 

Information. The terms of these implied contracts are further described in the federal laws, state 

law, local laws, and industry standards alleged above, and Defendant expressly assented to these 

terms in its Notice of Privacy Practices, Code of Conduct, and public statements, also alleged 

above.

200. Under these implied contracts for data security, Defendant was further obligated 

to provide Plaintiffs and all Class members, with prompt and sufficient notice of any and all 

unauthorized access and/or theft of their Sensitive Information.

201. Without such implied contracts, Plaintiffs and all Class members would not have 

provided their Sensitive Information to Defendant.

202. As described throughout, Defendant did not take reasonable steps to safeguard 

Plaintiffs’ and other Class members’ Sensitive Information.

203. Because Defendant allowed unauthorized access to Plaintiffs’ Sensitive 

Information and failed to take reasonable steps to safeguard that information, Defendant 

breached its implied contracts with Plaintiffs and all Class members.

204. Plaintiffs and all Class members suffered damages as a result of Defendant’s 

breach of its implied contracts in the amount of the value of the privacy that was lost in 

Plaintiffs’ and other Class members’ Sensitive Information, which amount will be determined at 

trial. 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 64 of 87
PAGE 61 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

205. With regard to members of the Nationwide Premera Policyholder and Plan 

Administration SubclassPolicyholder and Plan Administration Subclass, members of the 

Statewide Premera Policyholder and Plan Administration SubclassPolicyholder and Plan 

Administration Subclasses, and any other Class members who paid Defendant for health 

benefits, Defendant’s failure to fulfill its data security and management promises also resulted in 

such Plaintiffs and Class members receiving less than the benefit of their bargain (e.g., treatment 

without adequate data security and management practices). 

206. Stated otherwise, because such Plaintiffs paid for privacy protections (as part of, 

among other things, premiums or other payments for health treatment) they did not receive what 

they paid for—even though such protections were a material part of their contracts with 

Defendant—i.e. the full benefit of their bargain. 

207. As a result of Defendant’s conduct, members of the Nationwide Premera 

Policyholder and Plan Administration SubclassPolicyholder and Plan Administration Subclass, 

members of the Statewide Premera Policyholder and Plan Administration Subclasses, and any 

other Class members who paid Defendant for healthcare, suffered damages because they did not 

get the benefit of their bargain, including but not limited to the difference in the value of the 

secure health benefits for which they paid and the insecure health benefits they received.

208. As a result of Defendant’s conduct, Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration Subclass or alternatively, members of the 

Statewide Premera Policyholder and Plan Administration Subclasses, have suffered actual 

damages in an amount equal to the value of their privacy. 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 65 of 87
PAGE 62 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

209. Accordingly, Plaintiffs, on behalf of themselves and all Class members, seek an 

order declaring that Defendant’s conduct constitutes breach of contract implied-in-fact, and 

awarding them damages in an amount to be determined at trial.

SIXTH CLAIM FOR RELIEF

Quasi-Contract/Restitution/Unjust Enrichment

(On behalf of Plaintiffs and the Nationwide Premera Policyholder and Plan Administration 

Subclass or, alternatively, the Statewide Premera Policyholder and Plan Administration 

Subclasses)

210. Plaintiffs incorporate all foregoing factual allegations as if fully set forth herein.

211. Plaintiffs and members of the Nationwide Premera Policyholder and Plan 

Administration Subclass or alternatively, members of the Statewide Premera Policyholder and 

Plan Administration Subclasses, allege additionally and alternatively that they conferred a 

monetary benefit on Defendant in the form of fees paid for healthcare benefits. Defendant 

appreciated or had knowledge of the benefits conferred upon it by Plaintiffs and members of the 

Nationwide Premera Policyholder and Plan Administration Subclass or alternatively, members of 

the Statewide Premera Policyholder and Plan Administration Subclasses.

212. The fees for healthcare benefits that Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration Subclass or alternatively, members of the 

Statewide Premera Policyholder and Plan Administration Subclasses, paid (directly or indirectly) 

to Defendant were supposed to be used by Defendant, in part, to pay for the administrative costs 

of data management and security. 

213. Defendant did not use such fees to pay for the administrative costs of data 

management and security.

214. As a result of Defendant’s conduct, Plaintiffs and members of the Nationwide 

Premera Policyholder and Plan Administration Subclass or alternatively, members of the 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 66 of 87
PAGE 63 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Statewide Premera Policyholder and Plan Administration Subclasses, suffered actual damages in 

an amount equal to the difference in the free-market value of the secure healthcare benefits for 

which they paid and the insecure healthcare benefits they received.

215. Under principals of equity and good conscience, Defendant should not be 

permitted to retain the money belonging to Plaintiffs and members of the Nationwide Premera 

Policyholder and Plan Administration Subclass, or alternatively, the Statewide Premera 

Policyholder and Plan Administration Subclasses, because Defendant failed to implement (or 

adequately implement) the data management and security measures that they paid for and that 

were otherwise mandated by HIPAA regulations, federal, state and local laws, and industry 

standards.

SEVENTH CLAIM FOR RELIEF

Violation of State Consumer Protection Laws

(In the Alternative to Count I)

(On behalf of Plaintiffs and the Statewide Statutory Classes)

216. Plaintiffs incorporate all the foregoing allegations as if fully set forth herein.

217. Plaintiffs allege additionally and alternatively that the consumer protection laws 

listed below were enacted to protect consumers by promoting fair competition in commercial 

markets for goods and services. Specifically, they prohibit unlawful, unfair, deceptive, or 

fraudulent business acts or practices.

218. As described herein, Defendant has engaged in unlawful, unfair, and deceptive 

business acts or practices. 

219. Based on its statutory and common law obligations, and as admitted and assumed 

by its own statements, Defendant had a duty to safeguard and protect Sensitive Information. 

Defendant expressly represented—including in its Notice of Privacy Practices, Code of Conduct, 

public statements, and other consumer-facing representations—that it would safeguard and 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 67 of 87
PAGE 64 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

protect Sensitive Information in accordance with HIPAA regulations, federal, state and local 

laws, and industry standards. Premera’s specific representations are set forth above in 

paragraphs 40–46. Defendant made these misrepresentations to Plaintiffs and the Statewide 

Statutory Subclasses when they enrolled in Defendant’s health plans or agreed to provide 

Sensitive Information to Premera in exchange for coverage of healthcare services.

220. Consistent with its representations, Defendant accepted responsibility for securing 

Plaintiffs’ and the Statewide Statutory Classes’ Sensitive Information. Given that it was 

Defendant’s responsibility for creating, overseeing, maintaining, and otherwise implementing its 

own data security practices, Defendant knew (or should have known) that it was not adequately 

protecting Plaintiffs’ or the Statewide Statutory Classes’ Sensitive Information in accordance 

with its express guarantees. This is particularly true given the many warning signs that 

Premera’s systems were at risk of a breach—including those affecting the larger healthcare 

industry (e.g., the many other medical data breaches and warning of the Federal Bureau of 

Investigation’s Cyber Division) and those relating to Premera’s own security (e.g., the findings 

of the U.S. Office of Personnel Management investigation of Premera’s own systems).

221. In particular, Defendant failed to disclose that its data security systems and 

practices did not comport with the express representations set forth above in paragraph 40–46,

and otherwise described herein. As set forth specifically above in paragraphs 67-70, Defendant 

did not disclose that it did not take appropriate steps to secure electronic systems from 

unauthorized use, did not ensure that authorized personal had access to Sensitive Information 

only to the extent necessary to conduct their business, and did not meet its obligations under 

HIPAA and other state, local, and federal laws. In other words, Premera’s data security 

representations amounted to affirmative misrepresentations or, at least, were misleading because 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 68 of 87
PAGE 65 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

of Premera’s failure to disclose its actual data security practices. Its conduct was therefore 

unlawful.

222. Consistent with its representations, Defendant accepted responsibility for securing 

Plaintiffs’ and the Statewide Statutory Classes’ Sensitive Information. Given that it was 

Defendant’s responsibility for creating, overseeing, maintaining, and otherwise implementing its 

own data security practices, Defendant knew (or should have known) that it was not adequately 

protecting Plaintiffs’ or the Statewide Statutory Classes’ Sensitive Information in accordance 

with its express guarantees.

223. By failing to disclose its compliance with its own data security representations 

and other obligations, Premera engaged in unfair acts or practices. Premera made the data 

security representations discussed above to attract consumers—including Plaintiffs and members 

of the Statewide Statutory Classes —who were concerned about the privacy and security of their 

Sensitive Information. 

224. Premera, however, failed to make good on its promises of data security by not 

investing the necessary resources in its cybersecurity program, not promptly notifying Plaintiffs 

and the Statewide Statutory Classes promptly about the data breach, and otherwise not living up 

to the specific representations and obligations set forth above in paragraphs 40-45. Given the 

known risk of maintaining Sensitive Information with lax cybersecurity practices, Premera’s 

conduct was likely to cause substantial injuries to consumers. 

225. As set out above, because only Premera knew (or should have known) that it was 

not complying with its own data security representations and obligations, there was no way for 

members of the public, including Plaintiffs and members of the Statewide Statutory Classes, to 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 69 of 87
PAGE 66 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

avoid the injury caused by Premera’s conduct. Further, Premera’s failure to live up to its data 

security representations and obligations did not create any countervailing benefits.

226. Consumers—like Plaintiffs and members of the Statewide Statutory Classes—

value their privacy. Services (including healthcare benefits) that offer greater data security 

protections are more valuable to consumers than those with substandard security practices. 

Consumers will, if given the choice between two otherwise identical services, choose one with 

adequate security practices over one with substandard security practices.

227. Because of this consumer preference for data security, a healthcare benefits

company safeguarding and protecting Sensitive Information in accordance with HIPAA 

regulations, federal, state and local laws, and industry standards commands a higher market price 

for its coverage than a provider with substandard security.

228. Prior to the breach, neither Plaintiffs, nor members of the Statewide Statutory 

Classes, nor the general public knew that Defendant was not implementing data security and 

privacy protocols in accordance with its own consumer-facing representations and applicable 

duties. Defendant knew that Plaintiffs and the Statewide Statutory Classes would not allow 

Defendant access to their Sensitive Information—and thereby not give Defendant their 

business—if they knew Defendant could not and would not protect their Sensitive Information as 

it represented. And rather than implement the data security and privacy protocols it promised, 

Defendant actively concealed its true practices and protocols (which were of material concern to 

all of its customers) in order to lead consumers to give Defendant access to their Sensitive Data, 

while at the same time expressly promising that Sensitive Information would be protected as 

described above.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 70 of 87
PAGE 67 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

229. Based on the representations made by Defendant, Plaintiffs and the Statewide 

Statutory Classes believed Defendant would adequately protect their Sensitive Information, those 

security protections were valuable to them, and the protections formed the basis of their bargain 

inasmuch as Plaintiffs and the Statewide Statutory Classes would not have purchased healthcare 

benefits from Defendant at the prices charged (if at all) had Defendant disclosed its substandard 

security practices. Accordingly, Defendant’s omission regarding the true protection standard 

was material.

230. To Plaintiffs and the Statewide Statutory Classes, Defendant’s as-promised 

healthcare benefits offered significantly more utility or value than what was delivered, which 

lacked meaningful security protections. Thus, to Plaintiffs and the Statewide Statutory Classes, 

Defendant’s secured healthcare benefits—as promised and paid-for—was substantially more 

valuable than the unsecure insurance received.

231. Accordingly, had Plaintiffs and members of the Statewide Statutory Classes 

known that Defendant did not actually implement its promised data security and privacy 

protocols, they would not have been willing to purchase its healthcare benefits at the prices 

charged, if they would have paid money at all. 

232. Likewise, had Plaintiffs and members of the Statewide Statutory Classes known 

that Defendant did not actually implement its promised data security and privacy protocols, they 

would not have been willing to provide Defendant with their Sensitive Information.

233. Defendant’s failure to disclose its substandard security practices substantially 

injured the public because it caused millions of consumers to enter into transactions they 

otherwise would not have, and because it compromised the integrity of Plaintiffs’ and the 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 71 of 87
PAGE 68 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Statewide Statutory Classes’ Sensitive Information. Further, Defendant’s use of substandard 

security did not create any benefits sufficient to outweigh the harm it caused.

234. Defendant’s unfair acts or practices occurred in its trade or business and have 

injured a substantial portion of the public. Defendant’s general course of conduct is injurious to

the public interest, and such acts are ongoing and/or have a substantial likelihood of being 

repeated inasmuch as the long-lasting harmful effects of its misconduct may last for years (e.g., 

affected individuals could experience identity theft years later). As a direct and proximate result 

of Defendant’s unfair acts, Plaintiffs and members of the Statewide Statutory Classes have 

suffered and will suffer actual injuries. Accordingly, Defendant’s inadequate data security 

measure practices and/or omissions regarding its data security and privacy-related practices 

constitutes unlawful, deceptive, and unfair conduct in violation of the following State-specific 

consumer protection laws:

a. Arizona Consumer Fraud Act, Ariz. Rev. Stat. § 44-1522;

b. Arkansas Deceptive Trade Practices Act, Ark. Code Ann. §§ 4-88-107–

108;

c. California Consumer Legal Remedies Act, Cal. Civ. Code §§ 1750, et 

seq.;

d. California Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et 

seq.;

e. Colorado Consumer Protection Act, Colo. Rev. Stat. § 6-1-105(1);

f. Connecticut Unfair Trade Practices Act, Conn. Gen. Stat. §§ 42-110b, et 

seq.;

g. Delaware Consumer Fraud Act, Del. Code Ann. tit. 6, §§ 2513, et seq.;

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 72 of 87
PAGE 69 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

h. Delaware Deceptive Trade Practices Act, Del. Code Ann. Tit. 6, 

§§ 2532(5) and (7);

i. Hawaii Consumer Protection Act, Haw. Rev. Stat. Ann. §§ 480-2(a), et 

seq.;

j. Hawaii Deceptive Trade Practices Act, Haw. Rev. Stat. Ann. §§ 481A3(a)(5), (7), and (12), et seq.;

k. Idaho Consumer Protection Act, Idaho Code Ann. §§ 48-603, et seq.;

l. Illinois Consumer Fraud and Deceptive Business Practices Act, 815 Ill. 

Comp. Stat. Ann. §§ 505/2, et seq.;

m. Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Comp. Stat. Ann. 

§§ 510/2, et seq.;

n. Indiana Deceptive Consumer Sales Act, Ind. Code Ann. § 24-5-0.5-3(a), 

(b)(1), and (2), et seq.;

o. Iowa Consumer Fraud Act, Iowa Code §§ 714H.3 and 714H.5, et seq.;

p. Kansas Consumer Protection Act, Kan. Stat. Ann. § 50-626(a) and 

(b)(1)(A), (D) and (b)(3), et seq.;

q. Kentucky Consumer Protection Act, Ky. Rev. Stat. Ann. § 367.170(1) and 

(2), et seq.;

r. Maine Unfair Trade Practices Act, Me. Rev. Stat. Ann. tit. 5, § 207, et 

seq.;

s. Maine Uniform Deceptive Trade Practices Act, Me. Rev. Stat. Ann. tit. 10, 

§ 1212(1)(E) and (G), et seq.; 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 73 of 87
PAGE 70 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

t. Maryland Consumer Protection Act, Md. Code Ann. Com. Law, 

§ 13-301(1), (2)(i)-(ii),(iv), (5)(i), and (9)(i), et seq.;

u. Massachusetts Consumer Protection Act, Mass. Gen. Laws ch. 93A, 

§ 2(a), et seq.;

v. Michigan Consumer Protection Act, Mich. Comp. Laws Ann. 

§ 445.903(1)(c), (e), (s), and (cc), et seq.;

w. Minnesota Uniform Deceptive Trade Practices Act, Minn. Stat. 

§ 325D.44, subd. 1(5), (7), and (13), et seq.;

x. Minnesota Consumer Fraud Act, Minn. Stat. § 325F.69, subd. 1, and 

Minn. Stat. § 8.31, subd. 3(A);

y. Montana Unfair Trade Practices and Consumer Protection Act, Mont. 

Code Ann. §§ 30-14-103;

z. Nebraska Consumer Protection Act, Neb. Rev. Stat. Ann. § 59-1602;

aa. Nebraska Uniform Deceptive Trade Practices Act, Neb. Rev. Stat. Ann. 

§ 87-302(A)(5) and (7);

bb. New Hampshire Consumer Protection Act, N.H. Rev. Stat. Ann. § 358-

A:2(V) and (VII); 

cc. New Jersey Consumer Fraud Act, N.J. Stat. Ann. § 56:8-2;

dd. New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-12-2(D)(5)(7), 

(14), and 57-12-3;

ee. Nevada Deceptive Trade Practices Act, Nev. Rev. Stat. Ann. 

§ 598.0915(5) and (7);

ff. New York Business Law, N.Y. Gen. Bus. Law § 349(A);

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 74 of 87
PAGE 71 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

gg. North Carolina Unfair Trade Practices Act, N.C. Gen. Stat. Ann. § 75-

1.1(A);

hh. North Dakota Unlawful Sales or Advertising Practices Law, N.D. Cent. 

Code § 51-15-02;

ii. Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. § 1345.02(A) 

and (B)(1) and (2);

jj. Oklahoma Consumer Protection Act, Okla. Stat. Ann. § 753(5), (7), and 

(20);

kk. Oklahoma Deceptive Trade Practices Act, Okla. Stat. Ann. tit. 78, 

§ 53(A)(5) and (7); 

ll. Oregon Unfair Trade Practices Act, Or. Rev. Stat. § 646.608(1)(E), (G), 

and (U);

mm. Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 

Pa. Stat. Ann. §§ 201-2(4)(V), (VII), (XXI), and 201-3;

nn. Rhode Island Deceptive Trade Practices Act, R.I. Gen. Laws § 6-13.1-

1(6)(V), (VII), (XII), (XIII), and (XIV);

oo. South Dakota Deceptive Trade Practices Act and Consumer Protection 

Act, S.D. Codified Laws § 37-24-6(1);

pp. Texas Deceptive Trade Practices-Consumer Protection Act, Tex. Bus. & 

Com. Code Ann. § 17.46(A), (B)(5) and (7);

qq. Utah Consumer Sales Practices Act, Utah Code Ann. § 13-11-4(1) and 

(2)(A), (B), and (I);

rr. Vermont Consumer Fraud Act, 9 Vt. Stat. Ann. Tit. 9, § 2453(A);

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 75 of 87
PAGE 72 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

ss. Washington Consumer Protection Act, Wash. Rev. Code RCW 

§§ 19.86.010, et seq.;

tt. West Virginia Consumer Credit and Protection Act, W. Va. Code Ann. 

§ 46A-6-104; and

uu. Wyoming Consumer Protection Act, Wyo. Stat. Ann. § 40-12-105(a), (i), 

(iii), and (xv).

235. As a result of Defendant’s conduct, Plaintiffs and members of the Statewide 

Statutory Classes have suffered actual damages, including from the lost value of their privacy, 

the lost value of their personal data and lost property in the form of their breached and 

compromised Sensitive Information (which is of great value to third parties); ongoing, imminent, 

certainly impending threat of identity theft crimes, fraud, and abuse, resulting in monetary loss 

and economic harm; actual identity theft crimes, fraud, and abuse, resulting in monetary loss and 

economic harm; loss of the confidentiality of the stolen confidential data; the illegal sale of the 

compromised data on the deep web black market; expenses and/or time spent on credit 

monitoring and identity theft insurance; time spent scrutinizing bank statements, credit card 

statements, and credit reports; expenses and/or time spent initiating fraud alerts; decreased credit 

scores and ratings; lost work time; and other economic and non-economic harm. Plaintiffs also 

suffered damages because, among other things, Premera promised them one thing (health care 

with adequate identity protection), but provided them a different, less valuable thing (health care 

without it).

236. Accordingly, Plaintiffs, on behalf of themselves and members of the Statewide 

Statutory Classes, seek to enjoin further violation and recover actual damages (and treble 

damages where applicable).

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 76 of 87
PAGE 73 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

237. With respect to injunctive relief, Plaintiffs, on behalf of themselves and members 

of the Statewide Statutory Classes, seek an Order requiring Premera to: (1) engage third-party 

security auditors/penetration testers as well as internal security personnel to conduct testing, 

including simulated attacks, penetration tests, and audits on Premera’s systems on a periodic 

basis, and ordering Premera to promptly correct any problems or issues detected by such thirdparty security auditors; (2) engage third-party security auditors and internal personnel to run 

automated security monitoring; (3) audit, test, and train its security personnel regarding any new 

or modified procedures; (4) segment data by, among other things, creating firewalls and access 

controls so that if one area of Premera’s network is compromised, hackers cannot gain access to 

other portions of Premera’s systems; (5) purge, delete, and destroy in a reasonably secure manner 

Sensitive Information not necessary for its provisions of services; (6) conduct regular database 

scanning and securing checks; (7) routinely and continually conduct internal training and 

education to inform internal security personnel how to identify and contain a breach when it 

occurs and what to do in response to a breach; and (8) meaningfully educate all class members 

about the threats they face as a result of the loss of their confidential financial, personal, and 

health information to third parties, as well as the steps affected individuals must take to protect 

themselves.

EIGHTH CLAIM FOR RELIEF

Violation of State Data Breach Notification Laws

(In the alternative to Second Claim for Relief)

(On behalf of Plaintiffs and the Statewide Statutory Classes)

238. Plaintiffs incorporate all the foregoing factual allegations as if fully set forth 

herein.

239. Plaintiffs allege additionally and alternatively that the data breach notification 

laws listed below were enacted to protect (or at least mitigate damage for) consumers from the 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 77 of 87
PAGE 74 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

consequences associated with data breaches. In relevant part, those laws require that businesses 

that maintain consumer data (including Sensitive Information) notify the owner of any breach of 

that data in the most expedient time and manner possible and without unreasonable delay. 

240. The data breach described in Section II resulted in a breach of Plaintiffs’ and the 

Statewide Statutory Class Members’ Sensitive Information.

241. Defendant failed to disclose the breach of Plaintiffs’ and the Statewide Statutory 

Class members’ Sensitive Information in the most expedient time possible inasmuch as, after 

discovering the breach, it waited months before notifying all affected individuals. Defendant 

unreasonably delayed informing Plaintiffs and members of the Statewide Statutory Class about 

the data breach after it knew or should have known that the data breach had occurred. 

242. Defendant’s failure to provide timely notice of the data breach violated the 

following State-specific data breach notification laws:

a. Cal. Civ. Code § 1798.80, et seq.;

b. Ill. Comp. Stat. Ann. 530/10, et seq.;

c. Iowa Code Ann. § 715C.2, et seq.; 

d. La. Rev. Stat. Ann. § 51:3074, et seq.;

e. Md. Code Ann., Commercial Law § 14-3504, et seq.;

f. N.H. Rev. Stat. Ann. § 359-C:20, et seq.;

g. N.J. Stat. Ann. § 56:8-163, et seq.;

h. N.C. Gen. Stat. Ann. § 75-65, et seq.;

i. S.C. Code § 39-1-90, et seq.;

j. Tenn. Code Ann. § 47-18-2107, et seq.;

k. Tex. Bus. & Com. Code Ann. § 521.053, et seq.; and

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 78 of 87
PAGE 75 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

l. Va. Code Ann. § 18.2-186.6, et seq.;

243. As a result of Defendant’s conduct, Plaintiffs and members of the Statewide 

Statutory Class have suffered actual damages, including from the lost value of their personal data 

and lost property in the form of their breached and compromised Sensitive Information (which is 

of great value to third parties); ongoing, imminent, certainly impending threat of identity theft 

crimes, fraud, and abuse, resulting in monetary loss and economic harm; actual identity theft 

crimes, fraud, and abuse, resulting in monetary loss and economic harm; loss of the value of their 

privacy and loss of the confidentiality of the stolen confidential data; the illegal sale of the 

compromised data on the deep web black market; expenses and/or time spent on credit 

monitoring and identity theft insurance; time spent scrutinizing bank statements, credit card 

statements, and credit reports; expenses and/or time spent initiating fraud alerts; decreased credit 

scores and ratings; lost work time; and other economic and non-economic harm. 

244. Accordingly, Plaintiffs, on behalf of themselves and members of the Statewide 

Statutory Class, seek all remedies available under their state data breach statute, including but 

not limited to (a) damages suffered by Plaintiffs and the Statewide Statutory Class members as 

alleged above, (b) equitable relief, including injunctive relief, and (c) reasonable attorney fees 

and costs, as provided by law.

NINTH CLAIM FOR RELIEF

Violation of the California Confidential Medical Information Act

(On behalf of Plaintiff Hansen-Bosse and the Statewide California Statutory Class)

245. Plaintiffs incorporate all foregoing factual allegations as if fully set forth herein.

246. Plaintiffs allege additionally and alternatively that California’s Confidential 

Medical Information Act was enacted to protect, among other things, the release of confidential 

medical information without proper authorization. See Confidential Medical Information Act, 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 79 of 87
PAGE 76 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Cal. Civ. Code §§ 56, et seq. (“CMIA”). To that end, the CMIA prohibits entities from 

negligently disclosing or releasing any person’s confidential medical information. See Cal. Civ. 

Code § 56.36 (2013). The CMIA also requires that an entity, such as Defendant, that “creates, 

maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so 

in a manner that preserves the confidentiality of the information contained therein.” Civ. Code 

§ 56.101(a).

247. As described throughout this Complaint, Defendant negligently disclosed and 

released Plaintiffs’ and the Statewide California Subclass members’ Sensitive Information 

inasmuch as it did not implement adequate security protocols to prevent unauthorized access to 

Sensitive Information, maintain an adequate electronic security system to prevent data breaches, 

or employ industry standard and commercially viable measures to mitigate the risks of any data 

breach or otherwise comply with HIPAA data security requirements.

248. As a direct and proximate result of Defendant’s negligence, it disclosed and 

released Plaintiffs’ and the Statewide California Statutory Class members’ Sensitive Information 

to hackers. 

249. Accordingly, Plaintiffs, on behalf of themselves and members of the Statewide 

California Statutory Class, seek to recover actual, nominal (including $1000 nominal damages 

per disclosure under § 56.36(b)), and statutory damages (including under § 56.36(c)) where 

applicable, together with reasonable attorneys’ fees and costs.

TENTH CLAIM FOR RELIEF

Misrepresentation by Omission

(On behalf of Plaintiffs and the Nationwide Data Breach Class or, alternatively, the 

Statewide Common Law Classes)

250. Plaintiffs incorporate all foregoing factual allegations as if fully set forth herein.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 80 of 87
PAGE 77 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

251. Premera knew or should have known that it failed to use sufficient measures to 

protect consumers’ confidential data from hackers as described above.

252. Premera fraudulently, negligently, or recklessly concealed from, or failed to 

disclose to, the Nationwide Data Breach Class or alternatively, members of the Statewide 

Common Law Classes, the fact that the measures it employed to protect consumers’ confidential 

data from hackers were insufficient because they did not comport with its affirmative 

representations and other legal obligations (specifically set out in ¶¶ 40-45) in the manner set 

forth above (specifically set out in ¶¶ 67-69).

253. Premera was under a duty to the Nationwide Data Breach Class or alternatively, 

members of the Statewide Common Law Classes, to disclose the insufficient nature of its 

security measures because: Premera was in a superior position to know the true state of the facts 

about the design of its security measures because the design of such security measures is not 

public and Premera made partial representations and disclosures about maintaining the 

confidentiality of confidential data without revealing that it had taken insufficient and incomplete 

measures to protect that information from hackers.

254. The facts not disclosed to the Nationwide Data Breach Class or alternatively, 

members of the Statewide Common Law Classes, are material facts in that a reasonable person 

would have considered those facts to be important in deciding whether or not to purchase 

insurance through Premera or otherwise allow Premera access to their Sensitive Information. 

Had the Nationwide Data Breach Class or alternatively, members of the Statewide Common Law 

Classes, known the insufficient nature of Premera’s security measures, they would not have 

purchased insurance through Premera, would have paid less for it, or would not have permitted 

Premera to access their Sensitive Information in the first instance.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 81 of 87
PAGE 78 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

255. Premera intentionally, recklessly, or negligently concealed or failed to disclose 

the insufficient nature of its security measures for the purpose of inducing the Nationwide Data 

Breach Class or alternatively, members of the Statewide Common Law Classes, to act thereon, 

and the Nationwide Data Breach Class or alternatively, members of the Statewide Common Law 

Classes, justifiably relied to their detriment upon the truth and completeness of Premera’s 

representations, including those set forth above in paragraphs 40-45. This is evidenced by the 

Nationwide Data Breach Class or alternatively, members of the Statewide Common Law 

Classes, purchase of insurance through Premera and their willingness to let their Sensitive 

Information enter Premera’s systems.

256. In order to prevent its statements from being misleading or from being a halftruth, Defendant should have disclosed its true practices with regard to storing and safeguarding 

the Sensitive Information in its control. Specifically, Premera should have disclosed that it did 

not implement industry-standard access controls, that it did not fix known vulnerabilities in its 

electronic security protocols, failed to protect against reasonably anticipated threats, and 

otherwise did not comport with its public-facing representations and legal obligations as set forth 

above in paragraphs 67-69. Thus, even if Premera was in compliance with certain HIPAA 

regulations; applicable state, federal, and local laws; or representations it made to consumers and 

customers, including those described above in paragraphs 40-45, it still should have disclosed to 

consumers those regulations, laws, and representations that it did not follow or comply with, 

whether in whole or in part.

257. As a direct and proximate cause of Premera’s misconduct, the Nationwide Data 

Breach Class or alternatively, members of the Statewide Common Law Classes, have suffered 

and will continue to suffer actual damages in ongoing, imminent, certainly impending threat of 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 82 of 87
PAGE 79 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

identity theft crimes, fraud, and abuse, resulting in monetary loss and economic harm; actual 

identity theft crimes, fraud, and abuse, resulting in monetary loss and economic harm; loss of the 

value of their privacy and loss of the confidentiality of the stolen confidential data; the illegal 

sale of the compromised data on the deep web black market; expenses and/or time spent on 

credit monitoring and identity theft insurance; time spent scrutinizing bank statements, credit 

card statements, and credit reports; expenses and/or time spent initiating fraud alerts; decreased 

credit scores and ratings; lost work time; and the difference in the free-market value of the secure 

healthcare benefits for which they paid and the insecure healthcare benefits they received.

258. Accordingly, Plaintiffs, on behalf of themselves and members of the Nationwide 

Data Breach Class or alternatively, members of the Statewide Common Law Classes, seek an 

order declaring that Defendant’s conduct constitutes a misrepresentation, and awarding them 

damages in an amount to be determined at trial.

259. Washington law should apply to the misrepresentation claim of the Nationwide 

Class, or, alternatively, the claims of the Statewide Common Law Classes should be governed by 

the law of each state in which such state specific claims are brought.

III. REQUEST FOR RELIEF

Plaintiffs, on behalf of themselves and the Classes, respectfully request that this Court 

enter an Order:

1. Certifying this case as a class action on behalf of Plaintiffs and the Classes 

defined above, appointing Plaintiffs as representatives of their respective Classes, and appointing 

Interim Lead Counsel as Class Counsel;

2. Declaring that Premera’s actions, as described above, constitute violations of the 

Washington Consumer Protection Act and the Washington Data Breach Disclosure law; 

Negligence; Breach of Express Contract; Breach of Implied Contract; Restitution/Unjust 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 83 of 87
PAGE 80 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Enrichment; violations of the consumer protection laws of Arizona, Arkansas, California, 

Connecticut, Idaho, Illinois, Kansas, Kentucky, Maryland, Massachusetts, New Jersey, Oregon, 

and Texas; violations of the data breach notification laws of California, Illinois, Maryland, New 

Jersey, Tennessee, and Texas; and violations of the California Confidential Medical Information 

Act.

3. Awarding injunctive and other equitable relief as is necessary to protect the 

interests of the Classes, including an order (i) prohibiting Premera from engaging in the wrongful 

and unlawful acts described herein, and (ii) requiring Premera to protect all data collected 

through the course of its business in accordance with HIPAA regulations, federal, state and local 

laws, and industry standards; (iii) requiring Premera to engage third-party security 

auditors/penetration testers as well as internal security personnel to conduct testing, including 

simulated attacks, penetration tests, and audits on Premera’s systems on a periodic basis, and 

ordering Premera to promptly correct any problems or issues detected by such third-party

security auditors; (iv) requiring Premera to engage third-party security auditors and internal 

personnel to run automated security monitoring; (v) requiring Premera to audit, test, and train its 

security personnel regarding any new or modified procedures; (vi) requiring Premera to segment 

data by, among other things, creating firewalls and access controls so that if one area of 

Premera’s network is compromised, hackers cannot gain access to other portions of Premera’s 

systems; (vii) requiring Premera to purge, delete, and destroy in a reasonably secure manner 

Sensitive Information not necessary for its provisions of services; (viii) requiring Premera to 

conduct regular database scanning and securing checks; (ix) requiring Premera to routinely and 

continually conduct internal training and education to inform internal security personnel how to 

identify and contain a breach when it occurs and what to do in response to a breach; and 

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 84 of 87
PAGE 81 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

(x) requiring Premera to meaningfully educate all class members about the threats they face as a 

result of the loss of their confidential financial, personal, and health information to third parties, 

as well as the steps affected individuals must take to protect themselves.

4. Awarding actual, statutory, exemplary and punitive damages to Plaintiffs and the 

Classes, where applicable, in an amount to be determined at trial;

5. Awarding restitution to Plaintiffs and the Classes in an amount to be determined 

at trial;

6. Awarding Plaintiffs and the Classes their reasonable litigation expenses and 

attorneys’ fees;

7. Awarding Plaintiffs and the Classes pre- and post-judgment interest, to the extent 

allowable;

8. Permitting Plaintiffs and the Classes to amend their pleadings to conform to the 

evidence produced at trial; and

9. Awarding such other and further relief as equity and justice may require.

IV. JURY DEMAND

Plaintiffs request a trial by jury.

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 85 of 87
PAGE 82 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Dated: September 30, 2016 Respectfully submitted,

TOUSLEY BRAIN STEPHENS, PLLC

By: s/ Kim D. Stephens

Kim D. Stephens, OSB No. 030635

Christopher I. Brain, admitted pro hac vice

Chase C. Alvord, OSB No. 070590

Jason T. Dennett, admitted pro hac vice

1700 Seventh Avenue, Suite 2200 

Seattle, WA 98101 

Tel: (206) 682-5600 

Fax: (206) 682-2992

Email: cbrain@tousley.com

kstephens@tousley.com

calvord@tousley.com

jdennett@tousley.com

Interim Lead Plaintiffs’ Counsel

STOLL STOLL BERNE LOKTING &

SHLACHTER P.C.

By: s/ Keith S. Dubanevich

Keith S. Dubanevich, OSB No. 975200

Steve D. Larson, OSB No. 863540

209 SW Oak Street, Suite 500

Portland, OR 97204

Tel: (503) 227-1600

Fax: (503) 227-6840

Email: kdubanevich@stollberne.com

slarson@stollberne.com

Interim Liaison Plaintiffs’ Counsel

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 86 of 87
PAGE 83 - PLAINTIFFS’ FIRST AMENDED CONSOLIDATED CLASS ACTION

ALLEGATION COMPLAINT

Ari J. Scharg

ascharg@edelson.com

EDELSON PC

350 North LaSalle Street, Suite 1300

Chicago, Illinois 60654

Tel: 312.589.6370

Fax: 312.589.6378

Tina Wolfson

twolfson@ahdootwolfson.com

AHDOOT AND WOLFSON, PC

1016 Palm Avenue

West Hollywood, CA 90069

Tel: 310.474.9111

Fax: 310.474.8585

James Pizzirusso

jpizzirusso@hausfeld.com

HAUSFELD LLP 

1700 K. Street NW, Suite 650

Washington, DC 20006

Tel: 202.540.7200

Fax: 202.540.7201

Plaintiffs’ Executive Leadership Committee

Case 3:15-cv-01154-SI Document 77 Filed 09/30/16 Page 87 of 87