UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen...

24
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION LATOSHA GREEN and MARTIN WILLIAMS, Plaintiffs, v. EQUIFAX, INC., Defendant. Case No. CLASS ACTION COMPLAINT JURY TRIAL DEMANDED Plaintiffs Latosha Green and Martin Williams (“Plaintiffs”), individually, and on behalf of the Class defined below of similarly situated persons, file this Class Action Complaint, against Equifax, Inc. (“Equifax”). INTRODUCTION 1. From May through July of 2017, Equifax experienced one of the largest data security breaches in history (the “Data Breach”). Cyber attackers stole the personally identifiable information (“PII”) of approximately 143 million Americans from Equifax’s files. (“Class Members”). 2. In the face of this extraordinary event which caused so much harm to so many innocent Americans, three key executives of Equifax decided that this was the time to extract an extraordinary profit based on their inside information, before information about the breach became public. These executives dumped nearly $1.8 million in stock holdings shortly after July 29. On August 1, Chief Financial Officer John Gamble sold shares worth $946,374 and another executive, Joseph Loughran, exercised $584,099 in stock options. The following day, Rodolfo Ploder sold $250,458 in Equifax stock. Following Equifax’s September 7 data-breach Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 1 of 22

Transcript of UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen...

Page 1: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF GEORGIA

ATLANTA DIVISION

LATOSHA GREEN and MARTIN WILLIAMS, Plaintiffs, v. EQUIFAX, INC., Defendant.

Case No. CLASS ACTION COMPLAINT JURY TRIAL DEMANDED

Plaintiffs Latosha Green and Martin Williams (“Plaintiffs”), individually, and

on behalf of the Class defined below of similarly situated persons, file this Class

Action Complaint, against Equifax, Inc. (“Equifax”).

INTRODUCTION

1. From May through July of 2017, Equifax experienced one of the

largest data security breaches in history (the “Data Breach”). Cyber attackers stole

the personally identifiable information (“PII”) of approximately 143 million

Americans from Equifax’s files. (“Class Members”).

2. In the face of this extraordinary event which caused so much harm to

so many innocent Americans, three key executives of Equifax decided that this was

the time to extract an extraordinary profit based on their inside information, before

information about the breach became public. These executives dumped nearly

$1.8 million in stock holdings shortly after July 29. On August 1, Chief Financial

Officer John Gamble sold shares worth $946,374 and another executive, Joseph

Loughran, exercised $584,099 in stock options. The following day, Rodolfo Ploder

sold $250,458 in Equifax stock. Following Equifax’s September 7 data-breach

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 1 of 22

Page 2: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

2

announcement, shares plummeted more than 13%, wiping out more than $2 billion

in investors’ assets.

3. Equifax is one of the three major consumer credit reporting agencies

in the United States. As such, it gathers sensitive financial data on consumers’

payment history, then sells data to banks, insurance companies, potential

employers, landlords, and government agencies in the form of a Consumer Credit

Report (“Credit Report”).

4. For millions of consumers, Credit Reports have become a ubiquitous

element of everyday life. Whether applying for a credit card, a mortgage, a car

loan, a job, or a residential lease, consumers, financial institutions, employers, and

landlords rely upon Credit Reports. As a practical matter, it would be nearly

impossible for consumers to conduct business without their PII ending up in the

possession of Equifax and other consumer credit agencies.

5. Numerous entities, including the IRS, rely upon Credit Report data to

verify an individual’s identity. For example, individuals may be asked to choose a

street where they lived or the name of their student loan lender from a list. The

ability to correctly answer these questions verifies an individual’s identity. With

access to Credit Report data, criminals can now correctly respond to these

verification questions, a process known as “pretexting.”1

6. This is the third data breach at Equifax since 2015. Despite two prior

incidents and the fact that it was storing sensitive personal information that it knew

was valuable to, and vulnerable to, cyber attackers, Equifax failed to take security

precautions that could have protected Class Members’ data. Instead, Equifax used

1 Equifax itself uses this verification process as part of its TrustedID Premier signup process.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 2 of 22

Page 3: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

3

grossly inadequate computer systems and data security practices that allowed the

hackers to easily make off with Class Members’ PII.

7. The Equifax database included the types of information that federal

and state law requires companies to take security measures to protect: names, dates

of birth, Social Security numbers, driver’s license numbers, employment

information, and credit card numbers. These data should have received extra

protection, not substandard protection.

8. Defendant made repeated promises and representations to Class

Members that it was protecting this sensitive information.

9. Since the Data Breach, Class Members have been repeatedly harmed,

and all of them are at risk for future identity theft given the loss of privacy of their

Social Security numbers. Class members have spent countless hours filing police

reports and poring over credit reports to combat identity theft, but new fraud is still

being perpetrated against them using the sensitive information taken during the

Data Breach. Many are now paying monthly or annual fees for identity theft and

credit monitoring services that they trust, and others have had to place credit

freezes on their accounts, which greatly hinders their ability to transact business

and apply for credit as they could before the breach. Now that their sensitive

personal information (e.g., their Social Security numbers, dates of birth, and home

addresses) has been released, Class Members must worry about being victimized

throughout the rest of their lives.

10. Following the Data Breach, Defendant set up a website whereby

consumers could enter their last names and the last six digits of their Social

Security numbers to determine if their PII has been compromised.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 3 of 22

Page 4: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

4

11. Consumers are then offered free enrollment in TrustedID Premier

credit monitoring service for one year.

12. TrustedID is a credit monitoring service offered by Equifax. This

service is inadequate to make Class Members whole. It lasts one year; yet, Class

Members will be at risk for identity theft for the remainder of their lives, as some

PII, such as a Social Security number, remains the same over the course of a

consumer’s lifetime.

13. Because Defendant failed to provide even minimally adequate

computer systems and data security practices, Class Members are forced to suffer

the consequences. This Court must hold Defendant accountable.

JURISDICTION AND VENUE

14. This Court has subject matter jurisdiction over this action under 28

U.S.C. § 1332(d)(2) because this is a class action wherein the amount in

controversy exceeds the sum or value of $5,000,000, exclusive of interest and

costs, there are more than 100 members in the proposed class, and at least one

member of the class of Plaintiffs is a citizen of a state different from a Defendant.

15. This Court has personal jurisdiction over Defendant because

Defendant has a principal place of business in Georgia and conducts business in

the state of Georgia.

16. Venue is proper in this Court pursuant to 28 U.S.C. § 1391(b) because

a substantial part of the events or omissions giving rise to the claims occurred in,

was directed to, and/or emanated from this District.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 4 of 22

Page 5: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

5

PARTIES

A. Plaintiffs

17. Plaintiff Latosha Green is a citizen and resident of the state of

Oklahoma. Equifax collected her Personal Information, which Equifax maintained

in its database. Ms. Green checked the Equifax website to determine and confirm

that her Personal Information may have been or was compromised as a result of the

Data Breach. In addition, Ms. Green's private information was in fact compromised

in connection with the Equifax breach. On Ms. Green's 2017 credit report, a

fraudulent credit account appeared for the first time. In response to the appearance

of the fraudulent account, Ms. Green placed a freeze on her accounts with the

credit bureaus. Ms. Green must now engage in regular monitoring of her credit

and her bank accounts. As a result of the Data Breach, Ms. Green has spent

numerous hours addressing issues arising from the Data Breach and will have to

continue dealing with the effect of the freeze on her credit.

18. Plaintiff Martin Williams is a citizen and resident of the state of Ohio.

Equifax collected his Personal Information, which Equifax maintained in its

database. Mr. Williams checked the Equifax website to determine and confirm

that his Personal Information may have been or was compromised as a result of the

Data Breach. Mr. Williams must now engage in regular monitoring of his credit

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 5 of 22

Page 6: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

6

and his bank accounts. As a result of the Data Breach, Mr. Williams has spent

numerous hours signing up for credit monitoring and identity theft protection, and

must continue to monitor his accounts with great vigilance to watch out for the

presence of fraudulent charges or the creation of fraudulent new accounts.

B. Defendant

19. Defendant Equifax, Inc. is incorporated and headquartered in Georgia.

Defendant is one of the three major consumer credit reporting agencies in the

United States. Defendant operates through subsidiaries, including Equifax

Information Services, LLC and Equifax Consumer Services, LLC.

CLASS ALLEGATIONS

20. Plaintiffs bring all claims as class claims under Federal Rule of Civil

Procedure 23. The requirements of FED. R. CIV. P. 23(a), 23(b)(2), and 23(b)(3) are

met with respect to the Class defined below.

21. Plaintiffs bring this action as a national class action for themselves

and all members of the following Class of similarly situated persons:

All persons who reside in the United States whose PII was compromised as a result of the data breach occurring at Equifax between May and August of 2017. 22. Excluded from the Class are Defendant, officers, directors, and

employees of Defendant, any entity in which Defendant has a controlling interest,

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 6 of 22

Page 7: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

7

is a parent or subsidiary, or which is controlled by Defendant, and the affiliates,

legal representatives, attorneys, heirs, predecessors, successors, and assigns of

Defendant. Also excluded are the Court and its employees, officers, and relatives.

23. Certification of Plaintiffs’ claims for class-wide treatment is

appropriate because Plaintiffs can prove the elements of their claims on a class-

wide basis using the same evidence as would be used to prove those elements in

individual actions alleging the same claims.

24. All members of the proposed Class are readily ascertainable, as

Equifax has access to addresses and other contact information for all Class

Members, which can be used for providing notice to Class Members.

25. Numerosity. The Class is so numerous that joinder of all members is

impracticable. Equifax announced 143 million consumers may be affected by the

Data Breach. Accordingly, the Class likely includes many millions of members.

26. Commonality. There are numerous questions of law and fact common

to Plaintiffs and the Class, including the following:

a) whether Defendant engaged in the wrongful conduct alleged in this

Complaint;

b) whether Defendant’s conduct was unlawful;

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 7 of 22

Page 8: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

8

c) whether Defendant failed to implement and maintain reasonable

systems and security procedures and practices to protect Class

Members’ PII;

d) whether Defendant unlawfully used, maintained, lost, or disclosed

Class members’ PII;

e) whether Defendant unreasonably delayed in notifying affected

customers of the security breach;

f) whether Defendant owed Plaintiffs and other Class Members a duty to

exercise reasonable care in the keeping of their PII;

g) whether Defendant undertook a duty to safely store PII;

h) whether Plaintiffs and other Class Members were injured as a result;

i) whether Defendant knew or should have known that its computer

systems were vulnerable to attack;

j) whether Plaintiffs and members of the Class suffered injury, including

ascertainable losses, as a result of Defendant’s conduct (or failure to

act);

k) whether Defendant breached duties to Plaintiffs and the Class as a

bailee of PII entrusted to it and for which Defendant owed a duty to

safeguard and of safekeeping;

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 8 of 22

Page 9: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

9

l) whether Plaintiffs and other Class Members are entitled to recover

damages; and

m) whether Plaintiffs and other Class Members are entitled to equitable

relief, including injunctive relief, restitution, disgorgement, and/or

other equitable relief.

27. Typicality. Plaintiffs’ claims are typical of the claims of the Class in

that the representative Plaintiffs, like all Class Members, had their PII

compromised and stolen. Plaintiffs and all Class Members were injured through

the uniform misconduct of Defendants described in this Complaint and assert the

same claims for relief.

28. Adequacy. Plaintiffs and their counsel will fairly and adequately

protect the interests of the Class. Plaintiffs have retained counsel who are

experienced in class action and complex litigation, including in data breach

litigation. Plaintiffs have no interests that are antagonistic to, or in conflict with,

the interests of the Class.

29. Predominance. The questions of law and fact common to Class

Members predominate over any questions which may affect only individual

members.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 9 of 22

Page 10: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

10

30. Superiority. A class action is superior to other available methods for

the fair and efficient adjudication of the controversy. Class treatment of common

questions of law and fact is superior to multiple individual actions or piecemeal

litigation. Moreover, absent a class action, most Class Members would find the

cost of litigating their claims prohibitively high and would therefore have no

effective remedy, so that in the absence of class treatment, Defendant’s violations

of law inflicting substantial damages in the aggregate would go un-remedied.

Plaintiffs and other Class Members have been harmed by Defendant’s wrongful

conduct and/or action. Litigating this action as a class action will reduce the

possibility of repetitious litigation arising from the same data breaches. Plaintiffs

know of no difficulties that would be encountered in this litigation that would

preclude its maintenance as a class action.

31. Class certification, therefore, is appropriate under FED. R. CIV. P.

23(b)(3), because the above common questions of law or fact predominate over

any questions affecting individual Class Members, and a class action is superior to

other available methods for the fair and efficient adjudication of this controversy.

32. Class certification is appropriate under FED. R. CIV. P. 23(b)(2), in that

Defendant has acted in a manner that applies generally to the Class, so that final

injunctive relief or corresponding declaratory relief is appropriate for the Class.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 10 of 22

Page 11: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

11

COUNTS

COUNT I – VIOLATION OF GEORGIA’S UNIFORM DECEPTIVE TRADE PRACTICES ACT

O.C.G.A. §10-1-370 ET SEQ.

33. Plaintiffs incorporate the foregoing allegations as if fully set forth

herein.

34. Plaintiffs and Class Members are “persons” as defined by the Georgia

Uniform Deceptive Trade Practices Act (“Georgia UDTPA”), O.C.G.A. §10-1-

371(5).

35. Defendant violated and continues to violate the Georgia UDTPA by

engaging in the unconscionable, deceptive, or unfair acts or practices as described

herein. This conduct includes, inter alia, breaching duties Defendant owes to

Plaintiffs and the Class pursuant to O.C.G.A. §10-1-370, et seq., by failing to

provide fair, reasonable, or adequate computer systems and data security practices

to safeguard Plaintiffs’ and Class Members’ PII.

36. By omitting the fact that Defendant could not provide fair, reasonable,

or adequate computer systems and data security practices to safeguard Plaintiffs’

and Class Members’ PII, it violated the Georgia UDTPA.

37. Plaintiffs and Class Members reasonably relied upon Defendant’s

omissions in turning over their PII to financial institutions and other entities that

report PII to Defendant. Had Plaintiffs and other Class Members known Equifax

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 11 of 22

Page 12: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

12

would not secure their PII, they could have attempted prophylactic measures, such

as placing credit freezes on their accounts or signing up for more extensive identity

theft protection.

38. Defendant’s omissions regarding its ability to provide fair, reasonable,

or adequate computer systems and data security practices to safeguard Plaintiffs’

and Class Members’ PII was an act likely to mislead Plaintiffs and the members of

the Class acting reasonably under the circumstances, and constitutes an unfair and

deceptive trade practice in violation of the Georgia UDTPA.

39. Defendant knew or should have known that it had kept highly relevant

and material information from consumers—namely information regarding its

inability to provide fair, reasonable, or adequate computer systems and data

security practices to safeguard Plaintiffs’ and Class Members’ PII—and therefore

violated the Georgia UDTPA.

40. As a direct and proximate result of Defendant’s violation of the

Georgia UDTPA, Plaintiffs and Class Members are at great risk going forward of

experiencing identity theft.

41. Plaintiffs and the Class also seek equitable relief and to enjoin

Defendant on the terms that the Court considers reasonable.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 12 of 22

Page 13: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

13

42. In addition, Plaintiffs and the Class seek reasonable attorneys’ fees

and costs incurred in bringing this action.

COUNT II – NEGLIGENCE

43. Plaintiffs incorporate the foregoing allegations as if fully set forth

herein.

44. Defendant owed consumers a duty of reasonable care in the handling

and safeguarding of their PII.

45. Defendant also had a duty to timely inform Plaintiffs and other Class

Members that their PII been compromised or improperly furnished to unauthorized

third parties.

46. Defendant, through the acts described herein, breached its duty of care

by, inter alia,:

a) failing to properly implement and maintain adequate security measures to protect customer PII from being accessed, disseminated, or misused by unauthorized third parties;

b) failing to adequately store Plaintiffs’ and other Class Members’ PII; and

c) failing to timely and sufficiently notify Plaintiffs and other Class Members that their PII had been compromised or improperly accessed by unauthorized third parties.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 13 of 22

Page 14: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

14

47. As a direct and proximate result of Defendant’s negligence, Plaintiffs

and other Class Members have suffered, or will suffer, damages, including the

costs associated with fraudulent purchases, identity theft, theft of funds, fees paid

for credit freezes and other banking fees, fees paid for account freezes and stop

payments, damage to credit scores, the cost of identity theft protection and/or

credit monitoring services, and the diminution of the value of their PII, as they

have lost the ability to control possession thereof.

COUNT III – NEGLIGENT PERFORMANCE OF AN UNDERTAKING

48. Plaintiffs incorporate the foregoing allegations as if fully set forth

herein.

49. Financial institutions provided Defendant with Class Members’ PII

for the purposes of reporting payment history.

50. Equifax was aware that data security is necessary for the protection of

Plaintiffs’ and other Class Members’ PII.

51. Financial institutions owed Plaintiffs and other Class Members a duty

to adequately secure their PII.

52. Equifax failed to exercise reasonable care in providing data storage

and security services for the protection of Plaintiffs’ and other Class Members’ PII,

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 14 of 22

Page 15: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

15

increasing the risk that their PII would be accessed and/or stolen by unauthorized

third parties.

53. Plaintiffs and other Class Members relied upon whomever would be

storing their PII to provide adequate security to protect their PII.

54. Upon turning over their PII, Plaintiffs and other Class Members lost

any ability to control or protect their PII stored on Equifax’s servers.

55. As a result of Defendant’s negligence, Plaintiffs’ and other Class

Members’ PII have been damaged. They have lost the ability to control who has

possession of their property, thus diminishing its value.

56. As a result of this loss of control, Plaintiffs and other Class Members

have been forced to expend resources to mitigate their losses and suffered damages

arising from thieves’ access to and usage of their PII.

COUNT IV – BAILMENT

57. Plaintiffs incorporate the foregoing allegations as if fully set forth

herein.

58. Plaintiffs and Class Members submitted their PII to Defendant via

various financial institutions.

59. PII constitutes a form of intangible personal property, as

demonstrated, in part, by the resources and effort people expend to protect their PII

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 15 of 22

Page 16: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

16

and control who has possession thereof. Moreover, markets exist for both the

lawful and unlawful transacting of PII.

60. Plaintiffs’ and Class Members’ property rights encompass the

fundamental right to control who possesses their PII.

61. In delivering their PII, Plaintiffs and Class Members intended and

understood that Defendant would adequately safeguard their PII.

62. Defendant accepted possession of Plaintiffs’ and Class Members’ PII.

63. By accepting possession of Plaintiffs’ and Class Members’ PII,

Defendant understood that Plaintiffs and other Class Members expected it to

adequately safeguard their PII. Accordingly, a bailment was established for the

mutual benefit of the parties.

64. Plaintiffs, other Class Members, and Defendant expected PII would be

returned or otherwise duly accounted for at the end of the bailment.

65. Since PII is a form of intangible personal property, Plaintiffs’ and

other Class Members’ exclusive possession can be restored by the deletion of their

PII once financial institutions and other entities that purchase Credit Reports no

longer need these data.2

2 Another example of when Plaintiffs and other Class Members would expect Defendant to return or duly account for their PII would be if Equifax were to exit the consumer credit reporting business. Plaintiffs and other Class

Members would not expect Defendant to retain possession of their PII in such a circumstance.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 16 of 22

Page 17: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

17

66. During the bailment, Defendant owed a duty to Plaintiffs and other

Class Members to exercise reasonable care, diligence, and prudence in protecting

their PII and to maintain reasonable security procedures and practices to protect

their PII.

67. Before the bailment relationship ended and prior to Defendant

returning or duly accounting for Plaintiffs’ and other Class Members’ PII,

Defendant breached this duty.

68. Defendant breached its duty of care by failing to take appropriate

measures to safeguard and protect Plaintiffs’ and other Class Members’ PII,

resulting in the unlawful and unauthorized access to and misuse of Plaintiffs’ and

other Class Members’ PII.

69. By failing to adequately secure Plaintiffs’ and other Class Members’

PII, Plaintiffs and other Class Members have lost exclusive possession of their PII

and their ability to determine whom may possess their PII and for what purposes.

70. To date, Defendant has not returned or duly accounted for Plaintiffs’

and other Class Members’ PII. Because Plaintiffs’ and other Class Members’ PII

remains available to thieves in a dispersed, worldwide network of computers,

Defendant will not, at some future date, return or duly account for Plaintiffs’ and

other Class Members’ PII.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 17 of 22

Page 18: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

18

71. As a result of Defendant’s breach of bailment, Plaintiffs and other

Class Members have suffered or will suffer damages, including the costs

associated with fraudulent purchases, identity theft, theft of funds, fees paid for

credit freezes, damage to credit scores, the cost of identity theft protection and/or

credit monitoring services, and the diminution of the value of their PII as they have

lost the ability to control possession thereof.

COUNT V – DECLARATORY JUDGMENT

72. Plaintiffs incorporate the foregoing allegations as if fully set forth

herein.

73. Plaintiffs and Class Members have stated claims against Equifax

based on negligence, negligent performance of an undertaking, breach of bailment,

and violation of the Georgia UDTPA.

74. Defendant has failed to live up to its obligations to provide reasonable

security measures for the PII of Plaintiffs and Class Members, as indicated by the

Data Breach that precipitated this lawsuit.

75. In addition, the Data Breach has rendered Defendant’s system(s) even

more vulnerable to unauthorized access and requires that Defendant immediately

take even more stringent measures to currently safeguard the PII of Plaintiffs and

Class Members going forward.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 18 of 22

Page 19: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

19

76. An actual controversy has arisen in the wake of Defendant’s Data

Breach regarding its current obligations to provide reasonable data security

measures to protect the PII of Plaintiffs and the Class.

77. Plaintiffs and Class Members thus seek a declaration that Defendant

in not in compliance with its existing obligations, and that Defendant must

implement specific additional, prudent security practices, as outlined below, to

provide reasonable protection of Plaintiffs’ and the Class Member’s PII.

78. Specifically, Plaintiffs and the Class seek a declaration that Defendant

must implement and maintain reasonable security measures on behalf of Plaintiffs

and the Class, including, but not limited to: (1) engaging third-party security

auditors/penetration testers, as well as internal security personnel to conduct testing

consistent with prudent data-security industry practices, including simulated

attacks, penetration tests, and audits on Defendant’s systems on a periodic basis;

(2) engaging third-party security auditors and internal personnel to run automated

security monitoring consistent with prudent industry practices; (3) auditing, testing,

and training its security personnel regarding any new or modified procedures; (4)

purging, deleting and destroying, in a secure manner, PII not necessary for its

business operations; (5) conducting regular database scanning and securing checks

consistent with prudent industry practices; (6) periodically conducting internal

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 19 of 22

Page 20: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

20

training and education to inform internal security personnel how to identify and

contain a breach when it occurs and what to do in response to a breach consistent

with prudent industry practices; (7) receiving periodic compliance audits by a third

party regarding the security of the computer systems Equifax uses to store PII; and

(8) meaningfully educating Data Breach victims about the threats they face as a

result of the loss of their PII to third parties, as well as the steps they must take to

protect themselves.

79. In addition, Plaintiffs and Class Members seek a declaration that to

comply with its existing obligations, Defendant must provide credit monitoring and

identity theft protection to Plaintiffs and Members of the Class.

PRAYER FOR RELIEF WHEREFORE, Plaintiffs respectfully request the following relief:

A. That the Court certify this case as a class action and appoint the

named Plaintiffs to be Class representatives and their counsel to be Class counsel;

B. That the Court award Plaintiffs appropriate relief, to include actual

and statutory damages, disgorgement, and restitution;

C. That the Court award Plaintiffs preliminary or other equitable or

declaratory relief as may be appropriate by way of applicable law, including but

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 20 of 22

Page 21: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

21

not limited to the provision of credit and identity theft protection for the life of the

victim;

D. That the Court enter such additional orders or judgments as may be

necessary to prevent these practices and to restore to any person in interest any

money or property which may have been acquired by means of the violations

alleged herein;

E. That the Court award Plaintiffs such other, favorable relief as may be

available and appropriate under law or at equity;

F. That the Court award costs and reasonable attorneys’ fees; and

G. That the Court enter such other and further relief as the Court may

deem just and proper.

JURY DEMAND

Plaintiffs demand a trial by jury of all issues so triable.

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 21 of 22

Page 22: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

22

Respectfully submitted this 12th day of September, 2017.

Law Offices of David A. Bain, LLC

/s/ David A. Bain

David A. Bain

Georgia Bar No. 032449

1230 Peachtree Street, NE

Suite 1050

Atlanta, GA 30309

Tel: (404) 724-9990

Fax: (404) 724-9986

[email protected]

Mark S. Goldman

Douglas J. Bench

GOLDMAN SCARLATO & PENNY, PC

Eight Tower Bridge, Ste. 1025

161 Washington Street

Conshohocken, PA 19428

Telephone: (484) 342-0700

[email protected]

[email protected]

EDELSON & ASSOCIATES, LLC MARC H. EDELSON 3 Terry Drive, Suite 205 Newtown, PA 18940 Tel: (215) 867-2200 Fax: (267) 685-0676 [email protected]

Counsel for Plaintiffs and the Proposed

Class

Case 1:17-cv-03487-ELR Document 1 Filed 09/12/17 Page 22 of 22

Page 23: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

JS44 (Rev. NDGA) CIVIL COVER SHEET

The JS44 civil cover sheet and the information contained herein neither replace nor supplement the filing and service of pleadings or other papers as required by law, except as provided by

local rules of court. This form is required for the use of the Clerk of Court for the purpose of initiating the civil docket record. (SEE INSTRUCTIONS ATTACHED)

I. (a) PLAINTIFF(S) DEFENDANT(S)

(b) COUNTY OF RESIDENCE OF FIRST LISTED COUNTY OF RESIDENCE OF FIRST LISTED

PLAINTIFF DEFENDANT

(EXCEPT IN U.S. PLAINTIFF CASES) (IN U.S. PLAINTIFF CASES ONLY)

NOTE: IN LAND CONDEMNATION CASES, USE THE LOCATION OF THE TRACT OF LAND

INVOLVED

(c) ATTORNEYS (FIRM NAME, ADDRESS, TELEPHONE NUMBER, AND ATTORNEYS (IF KNOWN)

E-MAIL ADDRESS)

II. BASIS OF JURISDICTION III. CITIZENSHIP OF PRINCIPAL PARTIES (PLACE AN “X” IN ONE BOX ONLY) (PLACE AN “X” IN ONE BOX FOR PLAINTIFF AND ONE BOX FOR DEFENDANT)

(FOR DIVERSITY CASES ONLY)

PLF DEF PLF DEF

1 U.S. GOVERNMENT 3 FEDERAL QUESTION 1 1 CITIZEN OF THIS STATE 4 4 INCORPORATED OR PRINCIPAL

PLAINTIFF (U.S. GOVERNMENT NOT A PARTY) PLACE OF BUSINESS IN THIS STATE

2 U.S. GOVERNMENT 4 DIVERSITY 2 2 CITIZEN OF ANOTHER STATE 5 5 INCORPORATED AND PRINCIPAL

DEFENDANT (INDICATE CITIZENSHIP OF PARTIES PLACE OF BUSINESS IN ANOTHER STATE

IN ITEM III)

3 3 CITIZEN OR SUBJECT OF A 6 6 FOREIGN NATION

FOREIGN COUNTRY

IV. ORIGIN (PLACE AN “X “IN ONE BOX ONLY)

TRANSFERRED FROM MULTIDISTRICT APPEAL TO DISTRICT JUDGE 1 ORIGINAL 2 REMOVED FROM 3 REMANDED FROM 4 REINSTATED OR 5 ANOTHER DISTRICT 6 LITIGATION - 7 FROM MAGISTRATE JUDGE

PROCEEDING STATE COURT APPELLATE COURT REOPENED (Specify District) TRANSFER JUDGMENT

MULTIDISTRICT 8 LITIGATION -

DIRECT FILE

V. CAUSE OF ACTION (CITE THE U.S. CIVIL STATUTE UNDER WHICH YOU ARE FILING AND WRITE A BRIEF STATEMENT OF CAUSE - DO NOT CITEJURISDICTIONAL STATUTES UNLESS DIVERSITY)

(IF COMPLEX, CHECK REASON BELOW)

1. Unusually large number of parties. 6. Problems locating or preserving evidence

2. Unusually large number of claims or defenses. 7. Pending parallel investigations or actions by government.

3. Factual issues are exceptionally complex 8. Multiple use of experts.

4. Greater than normal volume of evidence. 9. Need for discovery outside United States boundaries.

5. Extended discovery period is needed. 10. Existence of highly technical issues and proof.

CONTINUED ON REVERSEFOR OFFICE USE ONLY

RECEIPT # AMOUNT $ APPLYING IFP MAG. JUDGE (IFP) ______________________

JUDGE MAG. JUDGE NATURE OF SUIT CAUSE OF ACTION______________________

(Referral)

LATOSHA GREEN and MARTIN WILLIAMS, EQUIFAX, INC.

Oklahoma County, OK

Law Offices of David A. Bain, LLC1230 Peachtree St., NE, Suite 1050Atlanta, GA [email protected]

✔ ✔

Consumer class action brought under 28 U.S.C. § 1332(d)(2) seeking legal and equitable relief in connection with a databreach.

Case 1:17-cv-03487-ELR Document 1-1 Filed 09/12/17 Page 1 of 2

Page 24: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF … · 17. Plaintiff Latosha Green is a citizen and resident of the state of Oklahoma. Equifax collected her Personal Information,

VI. NATURE OF SUIT (PLACE AN “X” IN ONE BOX ONLY)

CONTRACT - "0" MONTHS DISCOVERY TRACK150 RECOVERY OF OVERPAYMENT &

ENFORCEMENT OF JUDGMENT

152 RECOVERY OF DEFAULTED STUDENT

LOANS (Excl. Veterans)

153 RECOVERY OF OVERPAYMENT OF

VETERAN'S BENEFITS

CONTRACT - "4" MONTHS DISCOVERY TRACK110 INSURANCE

120 MARINE

130 MILLER ACT

140 NEGOTIABLE INSTRUMENT

151 MEDICARE ACT

160 STOCKHOLDERS' SUITS

190 OTHER CONTRACT

195 CONTRACT PRODUCT LIABILITY

196 FRANCHISE

REAL PROPERTY - "4" MONTHS DISCOVERYTRACK

210 LAND CONDEMNATION

220 FORECLOSURE

230 RENT LEASE & EJECTMENT

240 TORTS TO LAND

245 TORT PRODUCT LIABILITY

290 ALL OTHER REAL PROPERTY

TORTS - PERSONAL INJURY - "4" MONTHSDISCOVERY TRACK

310 AIRPLANE

315 AIRPLANE PRODUCT LIABILITY

320 ASSAULT, LIBEL & SLANDER

330 FEDERAL EMPLOYERS' LIABILITY

340 MARINE

345 MARINE PRODUCT LIABILITY

350 MOTOR VEHICLE

355 MOTOR VEHICLE PRODUCT LIABILITY

360 OTHER PERSONAL INJURY

362 PERSONAL INJURY - MEDICAL

MALPRACTICE

365 PERSONAL INJURY - PRODUCT LIABILITY

367 PERSONAL INJURY - HEALTH CARE/

PHARMACEUTICAL PRODUCT LIABILITY

368 ASBESTOS PERSONAL INJURY PRODUCT

LIABILITY

TORTS - PERSONAL PROPERTY - "4" MONTHSDISCOVERY TRACK

370 OTHER FRAUD

371 TRUTH IN LENDING

380 OTHER PERSONAL PROPERTY DAMAGE

385 PROPERTY DAMAGE PRODUCT LIABILITY

BANKRUPTCY - "0" MONTHS DISCOVERY TRACK422 APPEAL 28 USC 158

423 WITHDRAWAL 28 USC 157

CIVIL RIGHTS - "4" MONTHS DISCOVERY TRACK440 OTHER CIVIL RIGHTS

441 VOTING

442 EMPLOYMENT

443 HOUSING/ ACCOMMODATIONS

445 AMERICANS with DISABILITIES - Employment

446 AMERICANS with DISABILITIES - Other

448 EDUCATION

IMMIGRATION - "0" MONTHS DISCOVERY TRACK462 NATURALIZATION APPLICATION

465 OTHER IMMIGRATION ACTIONS

PRISONER PETITIONS - "0" MONTHS DISCOVERYTRACK

463 HABEAS CORPUS- Alien Detainee

510 MOTIONS TO VACATE SENTENCE

530 HABEAS CORPUS

535 HABEAS CORPUS DEATH PENALTY

540 MANDAMUS & OTHER

550 CIVIL RIGHTS - Filed Pro se

555 PRISON CONDITION(S) - Filed Pro se

560 CIVIL DETAINEE: CONDITIONS OF

CONFINEMENT

PRISONER PETITIONS - "4" MONTHS DISCOVERYTRACK

550 CIVIL RIGHTS - Filed by Counsel

555 PRISON CONDITION(S) - Filed by Counsel

FORFEITURE/PENALTY - "4" MONTHS DISCOVERYTRACK

625 DRUG RELATED SEIZURE OF PROPERTY

21 USC 881

690 OTHER

LABOR - "4" MONTHS DISCOVERY TRACK710 FAIR LABOR STANDARDS ACT

720 LABOR/MGMT. RELATIONS

740 RAILWAY LABOR ACT

751 FAMILY and MEDICAL LEAVE ACT

790 OTHER LABOR LITIGATION

791 EMPL. RET. INC. SECURITY ACT

PROPERTY RIGHTS - "4" MONTHS DISCOVERYTRACK

820 COPYRIGHTS

840 TRADEMARK

PROPERTY RIGHTS - "8" MONTHS DISCOVERYTRACK

SOCIAL SECURITY - "0" MONTHS DISCOVERYTRACK

861 HIA (1395ff)

862 BLACK LUNG (923)

863 DIWC (405(g))

863 DIWW (405(g))

864 SSID TITLE XVI

865 RSI (405(g))

FEDERAL TAX SUITS - "4" MONTHS DISCOVERYTRACK

870 TAXES (U.S. Plaintiff or Defendant)

871 IRS - THIRD PARTY 26 USC 7609

OTHER STATUTES - "4" MONTHS DISCOVERYTRACK

375 FALSE CLAIMS ACT

376 Qui Tam 31 USC 3729(a)

400 STATE REAPPORTIONMENT

430 BANKS AND BANKING

450 COMMERCE/ICC RATES/ETC.

460 DEPORTATION

470 RACKETEER INFLUENCED AND CORRUPT

ORGANIZATIONS

480 CONSUMER CREDIT

490 CABLE/SATELLITE TV

890 OTHER STATUTORY ACTIONS

891 AGRICULTURAL ACTS

893 ENVIRONMENTAL MATTERS

895 FREEDOM OF INFORMATION ACT

899 ADMINISTRATIVE PROCEDURES ACT /

REVIEW OR APPEAL OF AGENCY DECISION

950 CONSTITUTIONALITY OF STATE STATUTES

OTHER STATUTES - "8" MONTHS DISCOVERYTRACK

410 ANTITRUST

850 SECURITIES / COMMODITIES / EXCHANGE

OTHER STATUTES - “0" MONTHS DISCOVERYTRACK

896 ARBITRATION

(Confirm / Vacate / Order / Modify)

* PLEASE NOTE DISCOVERYTRACK FOR EACH CASE TYPE.SEE LOCAL RULE 26.3

VII. REQUESTED IN COMPLAINT:

CHECK IF CLASS ACTION UNDER F.R.Civ.P. 23 DEMAND $_____________________________

JURY DEMAND YES NO (CHECK YES ONLY IF DEMANDED IN COMPLAINT)

VIII. RELATED/REFILED CASE(S) IF ANY JUDGE_______________________________ DOCKET NO._______________________

CIVIL CASES ARE DEEMED RELATED IF THE PENDING CASE INVOLVES: (CHECK APPROPRIATE BOX)

1. PROPERTY INCLUDED IN AN EARLIER NUMBERED PENDING SUIT.

2. SAME ISSUE OF FACT OR ARISES OUT OF THE SAME EVENT OR TRANSACTION INCLUDED IN AN EARLIER NUMBERED PENDING SUIT.

3. VALIDITY OR INFRINGEMENT OF THE SAME PATENT, COPYRIGHT OR TRADEMARK INCLUDED IN AN EARLIER NUMBERED PENDING SUIT.

4. APPEALS ARISING OUT OF THE SAME BANKRUPTCY CASE AND ANY CASE RELATED THERETO WHICH HAVE BEEN DECIDED BY THE SAME

BANKRUPTCY JUDGE.

5. REPETITIVE CASES FILED BY PRO SE LITIGANTS.

6. COMPANION OR RELATED CASE TO CASE(S) BEING SIMULTANEOUSLY FILED (INCLUDE ABBREVIATED STYLE OF OTHER CASE(S)):

7. EITHER SAME OR ALL OF THE PARTIES AND ISSUES IN THIS CASE WERE PREVIOUSLY INVOLVED IN CASE NO. , WHICH WAS

DISMISSED. This case IS IS NOT (check one box) SUBSTANTIALLY THE SAME CASE.

SIGNATURE OF ATTORNEY OF RECORD DATE

830 PATENT83 PATENT

David A. Bain

Case 1:17-cv-03487-ELR Document 1-1 Filed 09/12/17 Page 2 of 2