COMPLAINT 

No. C15-429 - 1 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

UNITED STATES DISTRICT COURT 

WESTERN DISTRICT OF WASHINGTON 

AT SEATTLE 

ANN MICHELLE BLACKWOLFE and 

JONATHAN BLACKWOLFE, individually 

and on behalf of all others similarly situated, 

Plaintiffs, 

v. 

PREMERA BLUE CROSS, a Washington 

company, 

Defendant. 

No. C15-429 

COMPLAINT – CLASS ACTION 

JURY DEMAND

Ann Michelle Blackwolfe and Jonathan Blackwolfe, on behalf of themselves and all 

others similarly situated, by their attorneys, make the following allegations and claims for their 

complaint against Premera Blue Cross (“Premera”). The following allegations are made upon 

information and belief, except as to allegations specifically pertaining to Plaintiffs, which are 

made upon knowledge. 

NATURE OF THE ACTION 

1. This is a class action brought on behalf of Plaintiffs, individually and on behalf of 

all those similarly situated, against Premera Blue Cross to recover for Premera’s failure to secure 

Plaintiffs’ and class members’ medical records containing sensitive and confidential medical inCase 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 1 of 12
COMPLAINT 

No. C15-429 - 2 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

formation, as well as personally identifiable information (“PII”) such as names, dates of birth, 

billing information, and social security numbers. 

PARTIES 

1. Plaintiffs Ann Michelle Blackwolfe and Jonathan Blackwolfe are individuals residing in Shrewsbury, Massachusetts. 

2. Defendant Premera Blue Cross is a Washington corporation with its headquarters 

located at 7001 220th Street SW, Building 1, Mountlake Terrace, Washington 98043. 

JURISDICTION AND VENUE 

3. This Court has subject matter jurisdiction over this action under the Class Action 

Fairness Act, 28 U.S.C. § 1332(d)(2). Plaintiffs’ claims and the claims of the other members of 

the class exceed $5,000,000, and at least one class member is a citizen of a state other than 

Washington. 

4. This Court has personal jurisdiction over Premera because Premera is headquartered in Washington and conducts business in Washington. 

5. Venue is proper in this Court pursuant to 28 U.S.C. § 1391(a) because Premera’s 

principal place of business is in this District and a substantial part of the events, acts, and omissions giving rise to Plaintiffs’ claims occurred in this District. 

COMMON FACTUAL ALLEGATIONS 

6. Premera is one of the largest health care insurance companies in the Pacific 

Northwest and primarily serves customers in Washington, Oregon, and Alaska. 

7. On March 17, 2015, Premera announced that it discovered a cyberattack on its information technology systems that compromised the confidential health information and PII of 

approximately 11 million insureds. Premera discovered the attack on January 29, 2015 and its 

investigation revealed that the initial attack occurred on May 5, 2014. 

8. The cyberattack affected customers of Premera Blue Cross, Premera Blue Cross 

Blue Shield of Alaska, and its affiliate brands Vivacity and Connexion Insurance Solutions, Inc. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 2 of 12
COMPLAINT 

No. C15-429 - 3 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

9. The breach involves the theft of information stored on various computers and data 

storage devices. Upon information and belief, Premera did not encrypt the PII in its possession, 

including Social Security numbers and birth dates. 

10. According to Dave Kennedy, an expert in healthcare security who is chief executive of TrustedSEC, LLC, the Premera data breach is the largest breach reported to date involving patient medical information. 

11. The information stolen from Premera, including Plaintiff’s and Class members’ 

PII, is extremely valuable to thieves. As the FTC recognizes, once identity thieves have personal 

information, “they can drain your bank account, run up your credit cards, open new utility accounts, or get medical treatment on your health insurance.” 

12. PII such as that stolen in the Premera data breach is highly coveted by and a frequent target of hackers. Legitimate organizations and the criminal underground alike recognize 

the value of such data. Otherwise, they would not pay for or maintain it, or aggressively seek it. 

Criminals seek personal and financial information of consumers because they can use biographical data to perpetuate more and larger thefts. 

13. The ramifications of Premera’s failure to keep Plaintiffs’ and class members’ personal and financial information secure are severe. Identity thieves can use PII such as that pertaining to Plaintiffs and the class members, which Premera failed to keep secure, to perpetuate a 

variety of crimes that harm the victims. For instance, identity thieves may commit various types 

of crimes such as immigration fraud, obtaining a driver’s license or identification card in the victim’s name but with another’s picture, using the victim’s information to obtain government benefits, or filing a fraudulent tax return using the victim’s information to obtain a fraudulent refund. 

The United States government and privacy experts acknowledge that it may take years for identity theft to come to light and be detected. 

14. In addition, identity thieves may get medical services using Plaintiffs’ confidential health information and PII, or commit any number of frauds, such as obtaining a job or procuring housing. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 3 of 12
COMPLAINT 

No. C15-429 - 4 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

15. The data breach at issue in this case occurred despite the fact that Premera was on 

notice of its security problems. According to The Seattle Times, federal auditors warned Premera 

that its network-security procedures were inadequate three weeks before hackers breached the 

information-technology systems of Premera. Government officials gave Premera ten recommendations to fix the problems and warned that the vulnerabilities in its systems could be 

breached by hackers and expose customer information. Premera received these recommendations on April 18, 2014. 

16. Plaintiff and the class members had a reasonable expectation that their confidential health information and PII would remain private and confidential. As a result of Premera’s 

deficient practices, Plaintiffs and the class members have been damaged, and have lost or are 

subject to losing money and property as a result of Premera’s substandard security practices. 

PLAINTIFF’S FACTUAL ALLEGATIONS

17. Plaintiffs Ann Michelle Blackwolfe and Jonathan Blackwolfe have health insurance with Premera through Plaintiff Ann Michelle Blackwolfe’s employment with Starbucks 

Coffee. Plaintiffs have had health insurance through Premera since approximately 2007. Plaintiffs did not receive notice of the breach and learned of it through the media. 

18. Premera required Plaintiffs to provide confidential health information and PII to 

Premera. 

19. Plaintiffs’ confidential health information and PII was compromised in and as a 

result of the Premera data breach. Plaintiffs were harmed by having their financial and personal 

information compromised and faces the imminent and certainly impending threat of future additional harm from the increased threat of identity theft and fraud due to their financial and personal information being sold on the Internet black market and/or misused by criminals. 

CLASS ACTION ALLEGATIONS 

20. Plaintiffs bring this action on behalf of themselves and all others similarly situated 

pursuant to Fed. R. Civ. P. 23. Plaintiffs seek to represent a class (the “Class”) described as follows: 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 4 of 12
COMPLAINT 

No. C15-429 - 5 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

All individuals and entities in the United States whose personal and confidential 

health information and/or personal identification information was compromised as 

a result of the Premera data breach announced on March 17, 2015.

21. The members of the Class are so numerous that the joinder of all members is impractical. While the exact numbers of Class members is unknown to Plaintiffs at this time, it is 

believed to be in the millions. 

22. There is a well-defined community of interest among the members of the Class 

because common questions of law and fact predominate. Plaintiffs’ claims are also typical of 

members of the Class and Plaintiffs can fairly and adequately represent the interests of the Class. 

23. This action satisfies the requirements of Fed. R. Civ. P. 23(b)(3) because it involves questions of law and fact common to the members of the Class that predominate over any 

questions affecting only individual members, including but not limited to: 

 (a) Whether Premera unlawfully used, maintained or disclosed Class members’ confidential health information and PII; 

 (b) Whether Premera unreasonably delayed notifying affected customers of 

the data breach; 

 (c) Whether Premera failed to implement and maintain reasonable security 

procedures and practices appropriate to the sensitive nature of the information compromised in 

the data breach, including but not limited to Premera’s failure to encrypt the sensitive and confidential information; 

 (d) Whether Premera’s conduct was negligent and/or grossly negligent; 

 (e) Whether Premera’s conduct was reckless; 

 (f) Whether Premera acted willfully and/or with oppression, fraud or malice; 

 (g) Whether Premera’s conduct constitutes breach of contract; 

 (h) Whether Plaintiff and the Class are entitled to damages, civil penalties, 

punitive damages and/or equitable and injunctive relief. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 5 of 12
COMPLAINT 

No. C15-429 - 6 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

24. Plaintiffs’ claims are typical of those of other Class members because Plaintiffs’ 

confidential health information and PII, like that of every Class member, was disclosed by 

Premera. 

25. Plaintiffs will fairly and adequately represent and protect the interests of the 

Class. 

26. Plaintiffs’ counsel is competent and experienced in class action litigation. 

27. A class action is superior to other available means for the fair and efficient adjudication of this controversy. Individual joinder of all Class members is not practicable, and 

questions of law and fact common to the proposed Class predominate over any questions affecting only individual members of the proposed Class. 

28. The prosecution of separate actions by individual members of the Class would 

create a risk of inconsistent or varying adjudications with respect to individual members of the 

Class, which would establish incompatible standards of conduct for Premera and would lead to 

repetitive adjudication of common questions of law and fact. 

29. Damages for any individual Class member are likely insufficient to justify the 

cost of individual litigation, so that in the absence of class certification, Premera’s violations of 

the law would go unremedied and Premera will retain the benefits of its wrongdoing. 

30. Class certification, therefore, is appropriate under Fed. R. Civ. P. 23(a) and (b)(3). 

The above common questions of law or fact predominate over any questions affecting individual 

members of the Class, and a class action is superior to other available methods for the fair and 

efficient adjudication of the controversy. 

31. Class certification is also appropriate under Fed. R. Civ. P. 23(a) and (b)(2), because Premera has acted or has refused to act on grounds generally applicable to the Class, so 

that final injunctive relief or corresponding declaratory relief is appropriate as to the Class as a 

whole. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 6 of 12
COMPLAINT 

No. C15-429 - 7 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

COUNT I 

Negligence 

32. Plaintiffs reallege and incorporate by reference every allegation set forth in the 

preceding paragraphs as though alleged in this Count. 

33. Premera came into possession, custody, and/or control of confidential health information and/or PII of Plaintiffs and Class members. 

34. Premera owed a duty to Plaintiffs and Class members to exercise reasonable care 

in safeguarding and securing the confidential health information and/or PII of Plaintiff and Class 

members in its possession, custody, and/or control. 

35. Premera had a duty to exercise reasonable care in implementing and maintaining 

reasonable procedures and practices appropriate for maintaining the safety and security of Plaintiffs and Class members’ confidential health information and/or PII in its possession, custody, 

and/or control. 

36. Premera had a duty to exercise reasonable care in timely notifying Plaintiffs and 

Class members of an unauthorized disclosure of Plaintiffs and Class members’ confidential 

health information and/or PII in its possession, custody, and/or control. 

37. Premera, through its actions and/or omissions, unlawfully breached its duty to 

Plaintiffs and Class members by failing to exercise reasonable care in safeguarding and securing 

the confidential health information and/or PII of Plaintiffs and Class members in its possession, 

custody, and/or control. 

38. Premera, through its actions and/or omissions, unlawfully breached its duty to 

Plaintiffs and Class members by failing to exercise reasonable care in implementing and maintaining reasonable procedures and practices appropriate for maintaining the safety and security of 

Plaintiffs and Class members’ confidential heath information and/or PII in its possession, custody, and/or control. 

39. Premera, through its actions and/or omissions, unlawfully breached its duty to 

Plaintiffs and Class members by failing to exercise reasonable care in timely notifying Plaintiffs 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 7 of 12
COMPLAINT 

No. C15-429 - 8 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

and Class members of an unauthorized disclosure of Plaintiffs’ and Class members’ confidential 

heath information and/or PII in its possession, custody, and/or control. 

40. Premera’s negligent and wrongful breach of duties it owed to Plaintiffs and Class 

members proximately caused an unauthorized disclosure of Plaintiffs and Class members’ confidential health information and/or PII in its possession, custody, and/or control. 

41. As a direct and proximate result of Premera’s negligent conduct, Plaintiffs and the 

Class have suffered injury and are entitled to damages in an amount to be proven at trial. 

COUNT II 

Breach of Contract 

42. Plaintiffs reallege and incorporate by reference every allegation set forth in the 

preceding paragraphs as though alleged in this Count. 

43. Plaintiffs and the Class members relied upon Premera’s representations regarding 

privacy and security before purchasing health services and products. 

44. By entering into agreements with Plaintiffs and Class members, Premera imposed 

upon itself an obligation to use reasonable and industry-standard security practices and procedures to protect Plaintiffs’ and Class members’ data and personal information. 

45. Plaintiffs and the Class members performed their obligations. 

46. Plaintiffs and the Class members paid for, but never received, the security protections to which they were entitled. 

47. As a direct and proximate result of Premera’s negligent conduct, Plaintiffs and the 

Class have suffered injury and are entitled to damages in an amount to be proven at trial. 

COUNT III 

Bailment 

48. Plaintiffs reallege and incorporate by reference every allegation set forth in the 

preceding paragraphs as though alleged in this Count. 

49. Plaintiffs and Class members delivered and entrusted their confidential health information and PII to Premera for the sole purpose of receiving services from Premera. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 8 of 12
COMPLAINT 

No. C15-429 - 9 - 

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

50. In delivering their confidential health information and/or PII to Premera, Plaintiffs 

and Class members intended and understood that Premera would adequately safeguard their personal and financial information. 

51. Premera accepted possession of Plaintiffs’ and Class members’ confidential 

health information and PII. By accepting possession, Premera understood that Plaintiffs and 

Class members expected Premera to adequately safeguard their personal and financial information. Accordingly, a bailment was established for the mutual benefit of the parties. 

52. During the bailment, Premera owed a duty to Plaintiffs and Class members to exercise reasonable care, diligence and prudence in protecting their confidential health information 

and/or PII. 

53. Premera breached its duty of care by failing to take appropriate measures to safeguard and protect Plaintiffs’ and Class members’ confidential health information and/or PII, resulting in the unlawful and unauthorized access to and misuse of such information. 

54. Premera further breached its duty to safeguard Plaintiffs’ and Class members’ 

confidential health information and/or PII by failing to timely and accurately notify them that 

their information had been compromised. 

55. As a direct and proximate result of Premera’s breach of its duty, Plaintiffs and 

Class members suffered consequential damages that were reasonably foreseeable to Premera, 

including but not limited to the damages set forth above. 

COUNT IV 

Unjust Enrichment 

56. Plaintiffs reallege and incorporate by reference every allegation set forth in the 

preceding paragraphs as though alleged in this Count. 

57. Plaintiffs and Class members conferred a monetary benefit on Premera in the 

form of monies paid for the purchase of health services from Premera during the period of the 

data breach. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 9 of 12
COMPLAINT 

No. C15-429 - 10 -

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

58. Premera appreciates or has knowledge of the benefits conferred directly upon it 

by Plaintiffs and members of the Class. 

59. The monies paid for the purchase of health services by Plaintiffs and members of 

the Class to Premera during the period of the data breach were supposed to be used by Premera, 

in part, to pay for the administrative and other costs of providing reasonable data security and 

protection to Plaintiffs and members of the Class. 

60. Premera failed to provide reasonable security, safeguards and protection to the 

confidential health information and/or PII of Plaintiffs and Class members and as a result, Plaintiffs and Class members overpaid Premera for the services purchased. 

61. Under principles of equity and good conscience, Premera should not be permitted 

to retain the money belonging to Plaintiffs and members of the Class, because Premera failed to 

provide adequate safeguards and security measures to protect Plaintiffs’ and Class members’ 

confidential heath information and PII that they paid for but did not receive. 

62. Plaintiffs and the Class have conferred directly upon Premera an economic benefit 

in the nature of monies received and profits resulting from sales and unlawful overcharges to the 

economic detriment of Plaintiffs and the Class members. 

63. The economic benefit, including the monies paid and the overcharges and profits 

derived by Premera and paid by Plaintiffs and members of the Class, is a direct and proximate 

result of Premera’s unlawful practices as set forth in this Complaint. 

64. The financial benefits derived by Premera rightfully belong to Plaintiffs and 

members of the Class. 

65. A constructive trust should be imposed upon all unlawful or inequitable sums received by Premera traceable to Plaintiffs and the Class. 

66. Plaintiff sand the Class have no adequate remedy at law. 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 10 of 12
COMPLAINT 

No. C15-429 - 11 -

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

COUNT V

Violation of RCW § 19.255.010 et seq. 

67. Plaintiffs reallege and incorporate by reference every allegation set forth in the 

preceding paragraphs as though alleged in this Count. 

68. The data breach constituted a “breach of the security of the system” within the 

meaning of RCW §§ 19.255.010(1)(4). 

69. Premera negligently and recklessly failed to provide reasonable and adequate security measures. Premera also unreasonably delayed informing the Plaintiffs and Class members 

about the security breach of Plaintiffs’ and Class members’ confidential health information and 

PII after Premera knew the data breach had occurred. 

70. As a result of Premera’s conduct, Plaintiffs and the Class members will incur economic damages related to the expenses for the losses associated with paying for health services 

they believed were purchased through secure transactions. Plaintiffs and the Class members 

would not have purchased the health services had they known that their PII would be compromised. 

71. As a direct and proximate result of Premera’s breach of its duty, Plaintiffs and 

Class members suffered consequential damages that were reasonably foreseeable to Premera and 

which they are entitled to recover. 

REQUEST FOR RELIEF 

On behalf of themselves and the Class set forth, Plaintiffs request that the Court enter 

judgment against Defendant and enter one or more orders: 

A. Certifying this case as a class action pursuant to Fed. R. Civ. P. 23(a), (b)(2) and 

(b)(3), and, pursuant to Fed. R. Civ. P. 23(g), appoint the named Plaintiffs to be Class representatives and their undersigned counsel to be Class counsel; 

B. Requiring Premera to make whole any losses suffered by Plaintiffs and Class 

members; 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 11 of 12
COMPLAINT 

No. C15-429 - 12 -

LAW OFFICES OF

CLIFFORD A. CANTOR, P.C. 

627 208th Avenue SE

Sammamish, Washington 98074

Tel: 425.868.7813  •  Fax: 425.732.3752

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

C. Enjoining Premera from further engaging in the unlawful conduct complained of 

herein; 

D. Awarding Plaintiffs and the Class appropriate relief, including actual and statutory damages, restitution and disgorgement; 

E. Awarding pre-judgment and post-judgment interest; 

F. Requiring Premera to pay for notifying the Class of the pendency of this action; 

G. Requiring Premera to pay Plaintiffs and Class members reasonable attorneys’ 

fees, expenses, prejudgment interest and the costs of this action; and 

I. Providing all other and further relief as this Court deems necessary, just, and 

proper. 

DEMAND FOR TRIAL BY JURY 

Plaintiffs demand a trial by jury on all issues so triable. 

Dated: March 19, 2015 Respectfully submitted, 

s/ Cliff Cantor 

By: Cliff Cantor, WSBA # 17893 

LAW OFFICES OF CLIFFORD A. CANTOR, P.C. 

627 208th Ave. SE 

Sammamish, WA 98074 

Tel: 425.868.7813 

Fax: 425.732.3752 

Email: cliff.cantor@outlook.com 

William B. Federman* 

FEDERMAN & SHERWOOD

10205 N. Pennsylvania Ave. 

Oklahoma City, OK 73120 

Tel: (405) 235-1560 

Fax: (405) 239-2112 

Email: wbf@federmanlaw.com 

* Admission pro hac vice to be sought 

Attorneys for Plaintiffs 

Case 3:15-cv-01102-SI Document 1 Filed 03/19/15 Page 12 of 12