19.  PDQ failed to adequately secure its POS systems, placing the purchasing  information of its customers at risk and resulting in the Data Breach.    21.  At all relevant times, PDQ was well-aware, or reasonably should have been  aware, that the Customer Data collected, maintained, and stored in the POS systems is highly  sensitive, susceptible to attack, and could be used for wrongful purposes by third parties, such as  identity theft and fraud.   22.  It is well known and the subject of many media reports that Customer Data is  highly coveted and a frequent target of hackers. Despite the frequent public announcements of  data breaches at retailers and restaurant chains, PDQ maintained an insufficient and inadequate  system to protect the Customer Data of Plaintiff and the Class members.   23.  Customer Data is a valuable commodity because it contains not only payment card  numbers but PII as well. A “cyber blackmarket” exists in which criminals openly post stolen  payment card numbers, social security numbers, and other personal information on multiple  underground Internet websites. Customer Data is valuable to identity thieves because they can use  victims’ personal data to open new financial accounts and take out loans in another person’s  name, incur charges on existing accounts, or clone ATM, debit, or credit cards.   24.  Legitimate organizations and the criminal underground alike recognize the value  of Consumer Data contained in a merchant’s data systems; otherwise, they would not  aggressively seek or pay for it. For example, in “one of 2013’s largest breaches . . . not only did  hackers compromise the [card holder data] of three million customers, they also took registration  data [containing PII] from 38 million users.”8   26.  PDQ was, or should have been, fully aware of the significant volume of daily  credit and debit card transactions at PDQ restaurants, amounting to tens of thousands of daily  payment card transactions, and thus, the significant number of individuals who would be harmed  by a breach of PDQ’s systems.    27.  Unfortunately, and as alleged below, despite all of this publicly available  knowledge of the continued compromises of Customer Data in the hands of other third parties,  such as retailers and restaurant chains, PDQ’s approach to maintaining the privacy and security  of the Customer Data of Plaintiff and Class members was lackadaisical, cavalier, reckless, or at  the very least, negligent.   C.  PDQ Had Notice of Data Breaches Involving Malware on POS Systems   28.  In 2017, PDQ officials declined to disclose average store or companywide revenue  figures in an interview with Jax Daily Record; however, industry consulting firm Technomic  projects the firm grossed about $100 million in sales in 2015, up 250 percent from $28.5 million  in 2013.6   28.  A wave of data breaches causing the theft of retail payment card information has  hit the United States in the last several years.9 In 2016, the number of U.S. data breaches  surpassed 1,000, a record high and a forty percent increase in the number of data breaches from  the previous year.10 The amount of payment card data compromised by data breaches is massive.  For example, it is estimated that over 100 million cards were compromised in 2013 and 2014.11   28.  On October 8, 2017, Plaintiff purchased food at an affected PDQ restaurant in  Pinellas Park, Florida, using his payment card.    29.  PDQ operates PDQ restaurants, a restaurant chain, which is “a hybrid of fast  casual, with fresh and daily made food and sauces and no walk-in freezers, and fast food — but  without burgers. The menu focuses on fried and grilled chicken tenders and sandwiches, fries and  hand spun milkshakes.”7   29.  On October 31, 2017, Plaintiff purchased food again at an affected PDQ  restaurant in Pinellas Park, Florida, using his payment card.   30.  Before transmitting customer data over the merchant’s network, POS systems  typically, and very briefly, store the data in plain text within the system’s memory.14 The stored  information includes “Track 1” and “Track 2” data from the magnetic strip on the payment card,  such as the cardholder’s first and last name, the expiration date of the card, and the CVV (three  number security code on the card).15 This information is unencrypted on the card and, at least  briefly, will be unencrypted in the POS terminal’s temporary memory as it processes the data. 16   30.  Plaintiff paid for one of the aforementioned purchases with his Wells Fargo reward  Visa, and paid for the other with his Chase reward Visa.   32.  The two payment cards Plaintiff used and which were compromised in the Data  Breach were connected to a Visa rewards program. When Plaintiff learned of the breach, Plaintiff  notified Wells Fargo and Chase. As a result, Plaintiff's cards were canceled. While Plaintiff is  awaiting Plaintiff’s new rewards credit cards, Plaintiff has to use alternative methods of payment  and, thus, has lost the opportunity to accrue those rewards. Additionally, Plaintiff has several  accounts set to autopay using these cards that will need to be reset, in addition to the hassle of  having to replace cards.  B.  PDQ and Its Customer Data Collection Practices    32.  A 2016 report by Verizon confirmed the vast majority of successful breaches  leverage legitimate credentials to gain access to the POS environment. Once attackers gain access  to the POS devices, they install malware, usually a RAM scraper, to capture payment card data.21    33.  Intruders with access to unencrypted Track 1 and Track 2 payment card data can  physically replicate the card or use it online. Unsurprisingly, theft of payment card information  via POS systems is now “one of the biggest sources of stolen payment cards.”22 For example, in  2013, hackers infiltrated Target, Inc.’s POS system, stealing information from an estimated 40  million payment cards in the United States. In 2014, over 7,500 self-checkout POS terminals at  Home Depots throughout the United States were hacked, compromising roughly 56 million debit  and credit cards.23    34.  Likewise, POS systems at more than 1,000 Wendy’s restaurants were infiltrated  with malware, resulting in the theft of payment cards data for approximately six months.24    35.  Given the numerous reports indicating the susceptibility of POS systems and  consequences of a breach, PDQ was well aware or should have been aware of the need to  safeguard its POS systems.  D.  PDQ Failed to Comply with Industry Standards   37.  The payment card networks (MasterCard, Visa, Discover, and American Express),  data security organizations, state governments, and federal agencies have all implemented various  standards and guidance on security measures designed to prevent these types of intrusions into  POS systems. However, despite PDQ’s understanding of the risk of data theft via malware  installed on POS systems, and the widely available resources to prevent intrusion into POS data  systems, PDQ failed to adhere to these guidelines and failed to take reasonable and sufficient  protective measures to prevent the Data Breach.    38.  Security experts have recommended specific steps that retailers should take to  protect their POS systems. For example, four years ago, Symantec recommended “point to point  encryption” implemented through secure card readers, which encrypt credit card information in  the POS system, preventing malware that extracts card information through the POS memory  while it processes the transaction.25 Moreover, Symantec emphasized the importance of adopting  EMV chip technology. Datacap Systems, a developer of POS systems, recommended similar  preventative measures.26   39.  The major payment card industry brands set forth specific security measures in  their Card (or sometimes, Merchant) Operating Regulations. Card Operating Regulations are  binding on merchants and require merchants to: (1) protect cardholder data and prevent its  unauthorized disclosure; (2) store data, even in encrypted form, no longer than necessary to  process the transaction; and (3) comply with all industry standards.   41.  The PCI DSS “was developed to encourage and enhance cardholder data security”  by providing “a baseline of technical and operational requirements designed to protect account  data.”28 PCI DSS sets the minimum level of what must be done, not the maximum.   42.  PCI DSS 3.2, the version of the standards in effect at the time of the Data Breach,  impose the following mandates on PDQ: 29   43.  Among other things, PCI DSS required PDQ to properly secure and protect  payment card data; not store cardholder data beyond the time necessary to authorize a  transaction; maintain up-to-date antivirus software and a proper firewall; protect systems against  malware; regularly test security systems; establish a process to identify and timely fix security  vulnerabilities; and encrypt payment card data at the point of sale.    45.  Despite PDQ’s awareness of its data security obligations, PDQ’s treatment of  PCD and PII entrusted to it by its customers fell far short of satisfying PDQ’s legal duties and  obligations, and included violations of the PCI DSS. PDQ failed to ensure that access to its data  systems was reasonably safeguarded, failed to acknowledge and act upon industry warnings, and  failed to use proper security systems to detect and deter the type of attack that occurred and is at  issue here.  E.  PDQ Failed to Comply With FTC Requirements   46.  Federal and State governments have likewise established security standards and  issued recommendations to temper data breaches and the resulting harm to consumers and  financial institutions. The Federal Trade Commission (“FTC”) has issued numerous guides for  business highlighting the importance of reasonable data security practices. According to the FTC,  the need for data security should be factored into all business decision-making.31   48.  The FTC recommends that companies not maintain cardholder information longer  than is needed for authorization of a transaction; limit access to sensitive data; require complex  passwords to be used on networks; use industry-tested methods for security; monitor for  suspicious activity on the network; and verify that third-party service providers have  implemented reasonable security measures.33   49.  The FTC has brought enforcement actions against businesses for failing to  adequately and reasonably protect customer data, treating the failure to employ reasonable and  appropriate measures to protect against unauthorized access to confidential consumer data as an  unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”), 15  U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses must take  to meet their data security obligations.   50.  PDQ’s failure to employ reasonable and appropriate measures to protect against  unauthorized access to confidential consumer data constitutes an unfair act or practice prohibited  by Section 5 of the FTC Act, 15 U.S.C. § 45.   52.  Despite understanding the consequences of inadequate data security, PDQ failed to  comply with PCI DSS requirements and failed to take additional protective measures beyond  those required by PCI DSS.    53.  Despite understanding the consequences of inadequate data security, PDQ  operated POS systems with outdated operating systems and software; failed to enable point-to- point and end-to-end encryption; and, failed to take other measures necessary to protect its data  network.  F.  The PDQ Data Breach   54.  PDQ understands the importance of protecting personal information: “PDQ values  the relationship we have with our guests and understands the importance of protecting personal  information.”34   55.  Further, massive data breaches have plagued the restaurant industry, including  national restaurant chains such as Wendy’s, Arby’s, Chipotle, Popeye’s, Noodles & Co., and P.F.  Chang’s.    56.  Based on the data breaches within the restaurant industry, and PDQ’s own  acknowledgment of the importance of protecting personal information as stated above, PDQ  knew or should have known that its systems were at risk for a similar malware data breach.   58.  PDQ believes “the attacker gained entry through an outside technology vendor’s  remote connection tool.”36    59.  The malware allowed the thieves to download and steal copies of PDQ customers’  Customer Data.   60.  The breach became public on June 22, 2018, through PDQ’s announcement. The  announcement came almost one year after the Data Breach began, and two months after the Data  Breach was detected. PDQ provided only the following information about the breach. The  announcement in full37 was:   Important Information for our Guests On Data Breach  83.  Plaintiff seeks relief on behalf of Plaintiff’s self and as a representative of all  others who are similarly situated. Pursuant to Rule 23(a), (b)(2), (b)(3) and (c)(4), Fed. R. Civ.  P., Plaintiff seeks certification of a Nationwide class defined as follows:  All persons residing in the United States who made a credit or debit card purchase  at any affected PDQ location during the period of the Data Breach (the  “Nationwide Class”).   85.  Excluded from each of the above Classes are PDQ and any of its affiliates,  parents or subsidiaries; all employees of PDQ; all persons who make a timely election to be  excluded from the Class; government entities; and the judges to whom this case is assigned and  their immediate family and court staff.   86.   Plaintiff hereby reserves the right to amend or modify the class definition with  greater specificity or division after having had an opportunity to conduct discovery.   87.  Each of the proposed Classes meets the criteria for certification under Rule 23(a),  (b)(2), (b)(3) and (c)(4).   88.  Numerosity. Fed. R. Civ. P. 23(a)(1). Consistent with Rule 23(a)(1), the  members of the Class are so numerous and geographically dispersed that the joinder of all  members is impractical. While the exact number of Class members is unknown to Plaintiff at this  time, the proposed Class includes potentially millions of customers whose data was  compromised in the Data Breach. Class members may be identified through objective means.  Class members may be notified of the pendency of this action by recognized, Court-approved  notice dissemination methods, which may include U.S. mail, electronic mail, internet postings,  and/or published notice.   90.  Typicality. Fed. R. Civ. P. 23(a)(3). Consistent with Rule 23(a)(3), Plaintiff’s  claims are typical of those of other Class members. Plaintiff is a consumer who used Plaintiff’s  payment cards at an affected PDQ location and had Plaintiff’s card compromised as a result of  the Data Breach. Plaintiff’s damages and injuries are akin to other Class members and Plaintiff  seeks relief consistent with the relief of the Class.    92.  Superiority. Fed. R. Civ. P. 23(b)(3). Consistent with Rule 23(b)(3), a class  action is superior to any other available means for the fair and efficient adjudication of this  controversy, and no unusual difficulties are likely to be encountered in the management of this  class action. The quintessential purpose of the class action mechanism is to permit litigation  against wrongdoers even when damages to individual plaintiffs may not be sufficient to justify  individual litigation. Here, the damages suffered by Plaintiff and the Class are relatively small  compared to the burden and expense required to individually litigate their claims against PDQ,  and thus, individual litigation to redress PDQ’s wrongful conduct would be impracticable.  Individual litigation by each Class member would also strain the court system. Individual  litigation creates the potential for inconsistent or contradictory judgments, and increases the delay  and expense to all parties and the court system. By contrast, the class action device presents far  fewer management difficulties and provides the benefits of a single adjudication, economies of  scale, and comprehensive supervision by a single court.    93.  Injunctive and Declaratory Relief. Class certification is also appropriate under  Rule 23(b)(2) and (c). Defendant, through its uniform conduct, acted or refused to act on grounds  generally applicable to the Class as a whole, making injunctive and declaratory relief appropriate  to the Class as a whole.    95.  Finally, all members of the proposed Classes are readily ascertainable. PDQ has  access to information regarding which of its restaurants were affected by the Data Breach, the  time period of the Data Breach, and which customers were potentially affected. Using this  information, the members of the Class can be identified and their contact information ascertained  for purposes of providing notice to the Class.  A.  Consumer Plaintiff’s Transactions   BREACH OF IMPLIED CONTRACT  (ON BEHALF OF CONSUMER PLAINTIFF AND   THE NATIONWIDE CLASS, OR, ALTERNATIVELY, CONSUMER PLAINTIFF AND  DECLARATORY JUDGMENT  (ON BEHALF OF CONSUMER PLAINTIFF AND  THE NATIONWIDE CLASS, OR, ALTERNATIVELY, CONSUMER PLAINTIFF AND  NEGLIGENCE PER SE  (ON BEHALF OF CONSUMER PLAINTIFF AND   THE NATIONWIDE CLASS, OR, ALTERNATIVELY, CONSUMER PLAINTIFF AND  NEGLIGENCE  (ON BEHALF OF CONSUMER PLAINTIFF AND   THE NATIONWIDE CLASS, OR, ALTERNATIVELY, CONSUMER PLAINTIFF AND  UNJUST ENRICHMENT  (ON BEHALF OF CONSUMER PLAINTIFF AND   THE NATIONWIDE CLASS, OR, ALTERNATIVELY, CONSUMER PLAINTIFF AND  VIOLATIONS OF THE OF THE FLORIDA UNFAIR AND DECEPTIVE TRADE  PRACTICES ACT, FLA. STAT. §§ 501.201, et seq.  (ON BEHALF OF THE NATIONWIDE OR, ALTERNATIVELY, PLAINTIFF AND THE 