IN THE UNITED STATES DISTRICT COURT 

FOR THE NORTHERN DISTRICT OF ILLINOIS 

EASTERN DIVISION

KRYSTAL KARNS, individually and on 

behalf of all others similarly situated, 

 

 Plaintiff, Case No. 

 

v. CLASS ACTION COMPLAINT 

 

DELOITTE CONSULTING LLP, JURY DEMANDED 

 

Defendant. 

 

 

Now comes the Plaintiff, KRYSTAL KARNS (“Plaintiff”), individually and on behalf of 

all others similarly situated, by and through her attorneys, and for her class action Complaint 

against the Defendant, DELOITTE CONSULTING LLP, (“Defendant”), Plaintiff alleges and 

states as follows: 

PRELIMINARY STATEMENTS 

1. This is an action for damages, injunctive relief, and any other available legal or 

equitable remedies, for violations of the Illinois Personal Information Protection Act (“PIPA”), 

815 ILCS 530/1, et seq., and the Illinois Consumer Fraud and Deceptive Businesses Practices Act 

(“CFA”), 815 ILCS 505/1, et seq., negligence, and breach of implied contract resulting from the 

illegal actions of Defendant, when it failed to properly secure and protect the personally 

identifiable information (“PII”) described herein. Plaintiff alleges as follows upon personal 

knowledge as to herself and her own acts and experiences, and, as to all other matters, upon 

information and belief, including investigation conducted by her attorneys. 

 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 1 of 15 PageID #:1
2 

JURISDICTION AND VENUE

2. This Court has jurisdiction pursuant to 28 U.S.C. § 1332(d), because the matter in 

controversy exceeds the sum or value of $5,000,000, exclusive of interest or costs, and is a class 

action in which members of the class are citizens of a State different from the Defendant. 

3. Venue is proper in this District pursuant to 28 U.S.C. § 1391(b) because Defendant 

resides in the Northern District of Illinois, does business within this District, and is subject to the 

court’s jurisdiction in this District. 

PARTIES 

4. Plaintiff is an individual who was at all relevant times residing in Kewanee, Illinois. 

5. On information and belief, Defendant is a Delaware limited liability partnership, 

whose principal place of business is located in New York, New York. 

6. At all times relevant hereto, Defendant was engaged in a contract with the Illinois 

Department of Employment Security (“IDES”) to assist in the administration of the Pandemic 

Unemployment Assistance (“PUA”) program relative to processing and payment of 

unemployment benefits. 

7. Defendant is a “Data Collector” as defined in PIPA, 815 ILCS 530/5, as it is a 

privately or publicly held corporation that for any purpose handles, collects, disseminates, or 

otherwise deals with nonpublic personal information. 

FACTS COMMON TO ALL COUNTS 

8. Defendant built and maintained website portals used by Illinois residents to apply 

for PUA benefits. 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 2 of 15 PageID #:2
3 

9. PUA was created as part of the Coronavirus Aid Care and Economic Security Act 

to expand unemployment benefit coverage to various categories of workers affected by the 

COVID-19 pandemic. 

10. Defendant entered into a contract with the State of Illinois to provide website 

services related to the PUA, knowing that the PII they would be given by Illinois residents was 

extremely sensitive and needed to be protected. 

11. Plaintiff applied for unemployment benefits under the PUA using the online system 

designed by Defendant for the Illinois Department of Employment Security. Pursuant to that 

application, Plaintiff was required to enter into the system her, and her minor daughter’s, names, 

social security numbers, and street address, as well as Plaintiff’s bank account number and copies 

of her driver’s license card and Social Security card. 

12. During or about May of 2020, Defendant failed to secure and protect the PII of 

Illinois residents who applied for PUA benefits. As a result of Defendant’s failure, Plaintiff and 

her minor daughter’s PII was exposed to unknown third parties, including but not limited to their 

names, social security numbers, and street address, as well as Plaintiff’s bank account number and 

driver’s license information. This incident is hereinafter referred to as the “Data Breach.” 

13. Plaintiff was notified of the Data Breach which exposed her PII through an email 

she received from the IDES, which did not identify Defendant. Plaintiff has not received any 

notification related to the Data Breach from Defendant. 

14. Plaintiff’s PII that was exposed by Defendant in the Data Breach is “Personal 

Information” as defined by PIPA, 815 ILCS 530/5, in that it included her name, social security 

number, driver’s license number, and bank account number. 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 3 of 15 PageID #:3
4 

15. Persons, like Plaintiff herein, have a strong interest in protecting their PII from 

falling into the wrong hands. 

16. By making failing to safeguard Plaintiff’s PII, Defendant impaired her ability to 

protect herself, her minor daughter, and her identities from theft, misuse, and abuse by nefarious 

third-party individuals. 

17. Therefore, Plaintiff has been deprived of her legally protected interest to safeguard 

her PII against third party individuals. 

18. As a result, Plaintiff has been exposed to untold risk of loss, identity theft, or other 

types of nefarious abuse at the hands of third-party individuals. 

19. As a result of the Data Breach, Plaintiff has expended time and suffered loss of 

productivity from taking time to address and attempt to ameliorate, mitigate, and deal with the 

future consequences of the Data Breach including investigating the information compromised and 

how best to ensure Plaintiff is protected from potential identity theft and fraud, which efforts are 

continuous and ongoing.

20. Defendant knew or should have known that the PII in its care was extremely 

important and would subject millions of Americans to abuse, theft, or fraud if it were exposed to 

third parties, and that Plaintiff would not be able to safeguard her, and he minor daughter’s, 

identities if Defendant failed to safeguard their PII. 

21. Defendant has not provided Plaintiff with notice or details regarding the Data 

Breach as is required by PIPA. 

22. A violation of PIPA constitutes an unlawful practice under the CFA, pursuant to 

815 ILCS 530/20.

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 4 of 15 PageID #:4
5 

23. As a result of Defendant’s acts and omissions outlined above, Plaintiff has suffered 

concrete and particularized injuries and harm, which include, but are not limited to, the following: 

(1) the loss of the opportunity and ability to control how their personal information is used; (2) the 

diminution in the value and/or use of their personal information entrusted to Defendant; (3) the 

compromise, publication, and/or theft of their personal information; (4) out-of-pocket expenses 

associated with the prevention, detection, monitoring, protection, and recovery of their personal 

information from identity theft and/or unauthorized use of their PII; (5) lost opportunity costs 

associated with effort expended and the loss of productivity addressing and attempting to mitigate 

the actual and future consequences of the data breach, including but not limited to efforts spent 

researching how to prevent, detect, and recover from identity theft and personal data misuse; (6) 

costs associated with the ability to freely utilize credit and assets frozen or flagged due to credit 

misuse, including denial of credit and/or increased costs to use credit, credit scores, credit reports, 

and assets; (7) unauthorized use of compromised PII; (8) tax fraud; (9) the continued risk to 

Plaintiff and the Class members’ PII, which remains in Defendant’s possession and are subject to 

further breaches so long as Defendant fails to undertake reasonable and appropriate measures to 

protect the PII in its possession; and (10) future costs in terms of time, effort, and expense that will 

be expended by Plaintiff and the Class to prevent, detect, contest, monitor, protect, and repair the 

impact of compromised PII as a result of the data breach for the remainder of the lives of Plaintiff 

and the Class.

CLASS ALLEGATIONS 

24. Plaintiff brings this action on behalf of herself and all others similarly situated, as 

a member of the proposed class (the “Class”), defined as follows: 

All persons within the United States whose PII was exposed as a 

result of the Data Breach. 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 5 of 15 PageID #:5
6 

25. Plaintiff also brings this action on behalf of herself and all others similarly situated, 

as a member of the proposed sub-class (the “Sub-Class”), defined as follows: 

All persons within the State of Illinois whose PII was exposed as a 

result of the Data Breach. 

26. Defendant, its employees and agents are excluded from the Class and Sub-Class. 

Plaintiff does not know the number of members in the Class and Sub-Class, but believes the 

members number in the thousands, if not more. Thus, this matter should be certified as a Class 

Action to assist in the expeditious litigation of the matter. 

27. The Class and Sub-Class are so numerous that the individual joinder of all of their 

members is impractical. While the exact number and identities of their members are unknown to 

Plaintiff at this time and can only be ascertained through appropriate discovery, Plaintiff is 

informed and believes and thereon alleges that the Class and Sub-Class include thousands, if not 

millions of members. Plaintiff alleges that the Class and Sub-Class members may be ascertained 

by the records maintained by Defendant and IDES. 

28. This suit is properly maintainable as a class action pursuant to Fed. R. Civ. P. 23(a) 

because the Class and Sub-Class are so numerous that joinder of their members is impractical and 

the disposition of their claims in the Class Action will provide substantial benefits both to the 

parties and the Court. 

29. There are questions of law and fact common to the Class and Sub-Class affecting 

the parties to be represented. The questions of law and fact common to the Class and Sub-Class 

predominate over questions which may affect individual Class and Sub-Class members and 

include, but are not necessarily limited to, the following: 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 6 of 15 PageID #:6
7 

a. Whether Defendant failed to use reasonable care to avoid exposing Plaintiff 

and the Class and Sub-Class members’ PII; 

b. Whether Defendant failed to give the Class and Sub-Class members notice 

pursuant to PIPA; 

c. Whether the Defendant’s conduct with respect to the data breach was unfair, 

unlawful, and or deceptive; 

d. Whether Defendant owed a legal duty to Plaintiff and the Class and SubClass members to protect their personal information, and whether 

Defendant breached this duty; 

e. Whether Defendant was negligent; 

f. Whether Plaintiff and the Class and Sub-Class members are at an increased 

risk of identity theft as a result of Defendant’s breach and failure to 

safeguard their PII; and 

g. Whether the Class and Sub-Class members are entitled to damages and the 

proper measure of those damages. 

30. As a resident of the United States and the State of Illinois whose PII was exposed 

in the Data Breach, Plaintiff is asserting claims that are typical of the Class and the Sub-Class. 

31. Plaintiff has no interests adverse or antagonistic to the interests of the other 

members of the Class and the Sub-Class. 

32. Plaintiff will fairly and adequately protect the interests of the members of the Class 

and the Sub-Class. Plaintiff has retained attorneys experienced in the prosecution of class actions. 

33. A class action is superior to other available methods of fair and efficient 

adjudication of this controversy, since individual litigation of the claims of all Class and Sub-Class 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 7 of 15 PageID #:7
8 

members is impracticable. Even if every Class and Sub-Class member could afford individual 

litigation, the court system could not. It would be unduly burdensome to the courts in which 

individual litigation of numerous issues would proceed. Individualized litigation would also 

present the potential for varying, inconsistent or contradictory judgments and would magnify the 

delay and expense to all parties, and to the court system, resulting from multiple trials of the same 

complex factual issues. By contrast, the conduct of this action as a class action presents fewer 

management difficulties, conserves the resources of the parties and of the court system and protects 

the rights of each class member. Class treatment will also permit the adjudication of relatively 

small claims by many Class and Sub-Class members who could not otherwise afford to seek legal 

redress for the wrongs complained of herein. 

34. The prosecution of separate actions by individual members of the Class and SubClass would create a risk of adjudications with respect to them that would, as a practical matter, 

be dispositive of the interests of the other Class and Sub-Class members not parties to such 

adjudications or that would substantially impair or impede the ability of such non-party Class and 

Sub-Class members to protect their interests. 

35. Plaintiff’s claims and injuries are identical to the claims and injuries of all Class 

and Sub-Class members, because all claims and injuries of all Class and Sub-Class members are 

based on the same Data Breach and same legal theories. 

36. Defendant has acted or refused to act in respect generally applicable to the Class 

and Sub-Class thereby making appropriate final and injunctive relief with regard to the members 

of the Class and Sub-Class as a whole. 

37. The size and definition of the Class and Sub-Class can be identified through records 

held by IDES, and by Defendant’s own records. 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 8 of 15 PageID #:8
9 

COUNT I 

VIOLATIONS OF THE ILLINOIS CONSUMER FRAUD AND 

DECEPTIVE BUSINESS PRACTICES ACT, 815 ILCS 505/1, et seq.

38. Plaintiff incorporates all of the allegations and statements made in paragraphs 1 

through 37 above as if fully reiterated herein. 

39. Plaintiff is a “person” as defined in 815 ILCS 505/1(c), as she is a natural person. 

40. Defendant is a “person” as defined in 815 ILCS 505/1(c), as it is a company and a 

business entity and/or association. 

41. 815 ILCS 505/2 states: 

Unfair methods of competition and unfair or deceptive acts or 

practices, including but not limited to the use or employment of any 

deception fraud, false pretense, false promise, misrepresentation or 

the concealment, suppression or omission of any material fact, with 

intent that others rely upon the concealment, suppression or 

omission of such material fact, or the use or employment of any 

practice described in Section 2 of the “Uniform Deceptive Trade 

Practices Act”, approved August 5, 1965, in the conduct of any trade 

or commerce are hereby declared unlawful whether any person has 

in fact been misled, deceived or damaged thereby. 

42. Through its failure to provide notice to Illinois consumers as required by PIPA, 

Defendant has committed unlawful business practices under the CFA. 

43. 815 ILCS 505/10a states: 

(a) Any person who suffers actual damage as a result of a violation 

of this Act committed by any other person may bring an action 

against such person. The court, in its discretion may award actual 

economic damages or any other relief which the court deems 

proper... 

(c) [T]he Court may grant injunctive relief where appropriate and 

may award, in addition to the relief provided in this Section, 

reasonable attorney’s fees and costs to the prevailing party. 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 9 of 15 PageID #:9
10 

44. In taking the actions and omissions set forth above, and failing to provide notice 

pursuant to PIPA as set forth above, Defendant violated the CFA, including, but not limited to, 

815 ILCS 505/2. 

45. Defendant failed to comply with the requirements of the CFA, including, but not 

limited to 815 ILCS 505/2, as to the Class and Sub-Class members with respect to the abovealleged transactions. 

46. By reason thereof, Plaintiff is entitled to a judgment against Defendant, declaring 

that Defendant’s conduct violated 815 ILCS 505/2, enjoining Defendant from engaging in similar 

conduct in the future, and awarding actual damages, punitive damages, injunctive relief, costs, and 

attorneys’ fees. 

COUNT II 

NEGLIGENCE

47. Plaintiff incorporates all of the allegations and statements made in paragraphs 1 

through 37 above as if fully reiterated herein. 

48. Defendant owed a duty to Plaintiff and the Class and Sub-Class members to 

exercise reasonable care in obtaining, securing, compiling, safeguarding, deleting and protecting 

Plaintiff and the Class and Sub-Class members’ bank account numbers, social security numbers, 

and other personal information. 

49. That duty included, among other things, designing, maintaining, and testing 

Defendant’s security systems and taking reasonable security measures to ensure that Plaintiff and 

the Class and Sub-Class members’ personal information in Defendant’s possession was adequately 

secured and protected. Defendant further owed Plaintiff and the Class and Sub-Class members a 

duty to implement measures that would detect a breach of its security system in a timely manner, 

and to expeditiously act upon learning of a breach of security or data breach. 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 10 of 15 PageID #:10
11 

50. Defendant owed a duty to Plaintiff and the Class to provide security measures, 

including security consistent with industry standards, to ensure that its systems and networks and 

Defendant’s personnel responsible for them, adequately protected the personal information of 

Plaintiff and the Class and Sub-Class members. 

51. Defendant owed a duty of care to Plaintiff and the Class and Sub-Class members 

because they were foreseeable victims of any inadequate security measures or practices. 

Defendant knew or should have known that it had inadequately safeguarded Plaintiff and the Class 

and Sub-Class members’ personal information and failed to implement adequate precautionary 

measures, including ample training, policies, and procedures to protect Plaintiff and the Class 

members’ bank account numbers, social security numbers, and other personal information. 

52. Plaintiff and the Class and Sub-Class members entrusted Defendant with their 

personal information and social security numbers, relying on the understanding that Defendant 

would implement policies and procedures, and take measures to protect their personal information 

and protect Plaintiff and the Class and Sub-Class members from harm in the event of a data breach. 

53. Defendant knew or should have known of the inherent risks of collecting and 

storing individuals’ personal information, including their private bank account numbers and social 

security numbers, and the critical importance and requirement to provide adequate security of that 

information for Plaintiff and the Class and Sub-Class members. 

54. Through its acts and omissions described herein, Defendant unlawfully breached 

its duty of reasonable care to implement security measures to protect the personal information of 

Plaintiff and the Class and Sub-Class members within Defendant’s possession and control. 

Defendant further breached its duty by failing to expeditiously notify and accurately disclose to 

Plaintiff and the Class and Sub-Class members that their personal information and social security 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 11 of 15 PageID #:11
12 

numbers compiled and maintained by Defendant were known or reasonably believed to have been 

stolen or compromised. 

55. As a direct and proximate result of Defendant’s breaches of its duties of care, 

Plaintiff and the Class and Sub-Class members have suffered and will suffer injury, including but 

not necessarily limited to those categories of injury, damages, and harm outlined above. 

COUNT III 

BREACH OF IMPLIED CONTRACT 

56. Plaintiff incorporates all of the allegations and statements made in paragraphs 1 

through 37 above as if fully reiterated herein. 

57. Defendant entered into a contract with the State of Illinois to help administer PUA 

to Illinois residents. As a result of that contract Defendant invited and induced Plaintiff and the 

Class and Sub-Class members to use its PUA portal to provide their personal information, 

including names, addresses, Social Security numbers, and other personal information. 

58. Defendant was required to reasonably safeguard and protect the PII of Plaintiff and 

the Class and Sub-Class members from unauthorized use, and to timely and accurately notify 

Plaintiff and the Class and Sub-Class members if their PII was compromised so that they act to 

mitigate the harm caused by the unauthorized disclosure or release of their personal information 

to unknown and unauthorized third parties. 

59. Based on this understanding, Plaintiff and Class members accepted Defendant’s 

offer and provided their PII to Defendant. 

60. Plaintiff and the Class and Sub-Class members would not have provided and 

entrusted their personal information to Defendant in the absence of their implied contract with 

Defendant, and would have instead retained the opportunity and ability to control their personal 

information rather than entrusting such personal information with Defendant 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 12 of 15 PageID #:12
13 

61. Defendant breached the implied contracts with Plaintiff and the Class and SubClass members by failing to reasonably safeguard and protect Plaintiff and the Class and SubClass members’ personal information as impliedly promised. 

62. As a proximate and direct result of Defendant’s breaches of its implied contracts, 

Plaintiff and the Class and Sub-Class members have suffered and will suffer injury, including but 

not necessarily limited to those categories of injury, damages, and harm outlined above. 

PRAYER FOR RELIEF 

Wherefore, Plaintiff prays for a judgment against Defendant as follows: 

a. An order certifying the Class and the Sub-Class and appointing Plaintiff as 

Representative of the Class and the Sub-Class; 

b. An order certifying the undersigned counsel as the Class and Sub-Class 

Counsel; 

c. An order requiring Defendant, at its own cost, to notify all members of the 

Class and the Sub-Class of the unlawful, unfair, deceptive, and 

unconscionable conduct herein; 

d. Judgment against Defendant in an amount to be determined at trial; 

e. An order for injunctive relief prohibiting such conduct by Defendant in the 

future; 

f. Judgment against Defendant for Plaintiff’s attorneys’ fees, court costs, and 

other litigation costs; and 

g. Any other relief deemed just and proper by this Court. 

 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 13 of 15 PageID #:13
14 

JURY DEMAND 

Plaintiff demands a trial by jury on all issues in this action so triable, except for any issues 

relating to the amount of attorneys’ fees and costs to be awarded should Plaintiff prevail on any of 

her claims in this action. 

 

RESPECFULLY SUBMITTED, 

 KRYSTAL KARNS 

   

By: /s/ Todd M. Friedman 

 Attorney for Plaintiff 

Illinois Attorney No. 6276496 

Law Offices of Todd M. Friedman, P.C. 

 21550 Oxnard Street, Suite 780 

 Woodland Hills, California 91367 

Phone: (877) 619-8966 

Fax: (866) 633-0228

tfriedman@toddflaw.com 

/s/ Abbas Kazerounian 

Attorney for Plaintiff 

Illinois Attorney No. 6316129 

Kazerouni Law Group, APC 

245 Fischer Avenue, Unit D1 

Costa Mesa, California 92626 

Phone: (800) 400-6808 

Fax: (800) 520-5523 

ak@kazlg.com 

/s/ Mona Amini 

Attorney for Plaintiff 

Pro Hac Vice Motion Forthcoming 

Kazerouni Law Group, APC 

245 Fischer Avenue, Unit D1 

Costa Mesa, California 92626 

Phone: (800) 400-6808 

Fax: (800) 520-5523 

mona@kazlg.com 

 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 14 of 15 PageID #:14
15 

/s/ David B. Levin 

 Attorney for Plaintiff 

Illinois Attorney No. 6212141 

Law Offices of Todd M. Friedman, P.C. 

333 Skokie Blvd., Suite 103 

Northbrook, Illinois 60062 

Phone: (224) 218-0882 

Fax: (866) 633-0228

dlevin@toddflaw.com 

/s/ Steven G. Perry 

 Attorney for Plaintiff 

Illinois Attorney No. 6330283 

Law Offices of Todd M. Friedman, P.C. 

333 Skokie Blvd., Suite 103 

Northbrook, Illinois 60062 

Phone: (224) 218-0875 

Fax: (866) 633-0228

steven.perry@toddflaw.com 

Case: 1:20-cv-04952 Document #: 1 Filed: 08/24/20 Page 15 of 15 PageID #:15