15.  Defendant Shady Grove Fertility describes itself in various media as “the largest  physician-owned, physician-led partnership of top-tier fertility practices in the U.S.”, with  fertility clinics in Maryland, Pennsylvania, New York, Virginia, Georgia and Washington, D.C.   16.  As part of its duties, US Fertility was formed by Defendant Shady Grove Fertility  and Defendant Amulet for the purpose of, inter alia, providing IT services to Shady Grove Fertility  and to manage, store and safeguard PI relating to Shady Grove Fertility patients.   17.  As part of its services, Shady Grove Fertility collected and electronically stored   confidential PPI relating to patients, including names, social security numbers, patient numbers,  dates of birth and information which forms the “Master Patient Index,” or MPI, which is an  electronic database that holds demographic information on every patient which allows users to  match and link medical records by unique identifying characteristics of patients, including race  and ethnicity, current address, contact information, insurance information, and other similar  identifying elements.   19.  On or about January 8, 2021, Defendants sent out a form notice to current and  former patients at Shady Grove Fertility clinics in various states, including Plaintiff, stating that in  or around sometime September 14, 2020, Defendants had discovered that US Fertility had been  the victim of a data breach and ransomware attack at some point between August 12, 2020 and  September 12, 2020 and that electronically stored Patient Personal Information and information  from the Master Patient Index, held by US Fertility relating to Shady Grove Fertility patients had  been accessed and “acquired” by unauthorized and unidentified users. See Attachment A.    20.  That form notice did not provide other information about the breach, including why  it took Defendants as long a month – between August 12, 2020 and September 12, 2020 – to even  realize that patient PPI and MPI information had been improperly accessed and acquired. Id.    21.  Nor did the form notice indicate why Defendants waited from September 14, 2020  until January 2021 to notify Plaintiff and the class of the breach and theft of their data. Id.   22.  The packet included with this form notice also offered recipients twelve months of  free credit monitoring by Trans Union. Id.    24.  Indeed, it is not clear how credit monitoring by Trans Union, a credit reporting  agency, will benefit or make whole class members who have had information relating to them  previously held in the Master Patient Index stolen.    25.  At all times relevant hereto, Defendants were aware of the need to safeguard patient  PPI and information contained in the Master Patient Index, a duty which is especially strong given  HIPAA mandates.    26.  Defendants had obligations created by contract, statute, industry standards,  common law, and representations made to Plaintiff and class members to keep their PPI and MPI  information confidential and to protect it from unauthorized access and disclosure.   27.  The potential for improper disclosure of Plaintiff’s and Class Members’ PPI and  Master Patient Index information was a risk well known to Defendants, and thus Defendants were  on notice that the failure to take steps necessary to secure the PPI and MPI information from those  risks left that information in a dangerous and vulnerable condition.   28.  Despite the fact that the threat of a data breach had been a well-known risk to  Defendants, especially due to the valuable and sensitive nature of the data Defendants collect, store  and maintain on medical patients, Defendants failed to take reasonable steps to adequately protect  the PPI and MPI information of current and former patients of Shady Grove Fertility.    29.  The data breach described herein was a direct result of Defendants’ failure to  implement adequate and reasonable cyber-security procedures and protocols necessary to protect  PPI and MPI information.   31.  Defendants had the resources necessary to prevent a data breach of the type which  occurred but neglected to adequately invest in security measures, despite its obligation to protect  such information.    32.  Moreover, Defendants had the resources necessary to immediately detect a data  incursion and theft in real time, and to give immediate notice to the class of such a breach, but  Defendants neglected to adequately invest in security measures which would have immediately  detected the breach and theft, despite their obligation to do so.    33.  Accordingly, Defendants breached their common law, statutory, and other duties  owed to Plaintiff and class.    34.  Defendants’ duty to use reasonable security measures also arose under Section 5 of  the Federal Trade Commission Act, 15 U.S.C. § 45, which prohibits “unfair . . . practices in or  affecting commerce”, including, as interpreted and enforced by the FTC, the unfair practice of  failing to use reasonable measures to protect confidential data by entities like Defendants.   35.  The Federal Trade Commission (FTC) has established data security principles and  practices for businesses as set forth in its publication, Protecting Personal Information: A Guide  for Business.   36.  Among other things, the FTC states that companies should encrypt information  stored on computer networks and dispose of consumer information that is no longer needed.   37.  The FTC also says to implement policies for installing vendor-approved patches to  correct problems, and to identify operating systems.   39.  Further, the FTC recommends that companies utilize an intrusion detection system  to expose a data breach as soon as it occurs; monitor all incoming traffic for activity that might  indicate unauthorized access into the system; monitor large amounts of data transmitted from the  system; and have a response plan ready in the event of a data breach.   40.  In another FTC publication, Start with Security: A Guide for Business, the FTC  recommends, among other things, that companies “make sure [third-party] service providers  implement reasonable security measures.”   41.  The FTC has prosecuted a number of enforcement actions against companies for  failing to take measures to protect consumer data adequately and reasonably. The FTC has viewed  and treated such security lapses as an unfair act or practice prohibited by Section 5 of the Federal  Trade Commission Act (“FTCA”), 15 U.S.C. § 45.   42.  The data breach and theft of PPI and Master Patient Index information in this case  was a direct and proximate result of Defendants’ failure to:  (a) properly safeguard and protect  Plaintiff’s and class members’ personal patient information from unauthorized access, use, and  disclosure, as required by various state and federal regulations, industry practices, and common  law; (b) establish and implement reasonable and appropriate safeguards to immediately detect a  data incursion and theft of said information; (c) establish and implement reasonable and  appropriate safeguards to immediately notify Plaintiff and the class of such an incursion and theft,  and (d) protect against reasonably foreseeable threats to the security or integrity of such  information.   43.  Defendants failed to maintain reasonable data security procedures and practices.   45.  Defendants’ failure to maintain and implement reasonable and appropriate  measures to detect and protect against unauthorized access to consumer PI constitutes an unfair  act or practice prohibited by Section 5 of the FTC Act, 15 U.S.C. § 45.   46.  Accordingly, Defendants did not comply with legal state and federal law  requirements, as discussed herein.    47.  Moreover, effective and economically practical methods exist for detecting cyber  incursions in real time, including computer malware detection software, safety protocols and other  cyber security techniques, which make it perfectly feasible to detect such a serious data breach of  patient PI/PPI in real time, or at least in far less than 30 days.    48.  Indeed, as noted previously, the FTC has specifically advised those who hold  customer data to implement software and other measures that detect cyber intrusions in real time.   49.  Such adequate malware detection software, safety protocols and techniques which  were not employed by Defendants and thus it took as long as 30 days for Defendants to even  recognize that a breach had occurred.    50.  Further, even after the breach was detected, Defendants failed to take adequate and  reasonable steps to notify the class of the breach in a timely fashion. The notice sent by Defendants  to the class states expressly that Defendants knew by September 14, 2020 of the cyber breach and  the theft of data. Yet Defendants failed to notify Plaintiff and the class that there PPI and Master  Patient Index information had been stolen until January 2021; three months after Defendants knew  it had been stolen.    52.  As a result of all of these failures, the PPI of Plaintiff and class members, including  the data relating to them stored in the Master Patient Index, is now in the hands of unknown persons  and can be used for unknown purposes for the foreseeable future.   53.  Such persons may be cyber thieves, who now hold PPI and information from the  Master Patient Index which can now be sold on the Dark Web and used to commit identity theft  and fraud for the foreseeable future.   54.  Armed with the PPI and Master Patient Index information accessed and acquired,  data thieves can commit a variety of crimes including, e.g., opening new financial accounts in class  members’ names, taking out loans in class members’ names, using class members’ information to  obtain government benefits (such as filing for unemployment benefits), filing fraudulent tax  returns using class members’ information, obtaining driver’s licenses in class members’ names but  with another person’s photograph, and giving false information to police during an arrest.   55.  Defendants’ failure to implement and follow proper security procedures has  resulted in ongoing harm to Plaintiff and class members who will continue to experience a lack of  data security for the indefinite future and remain at serious risk of identity theft and fraud that  would result in significant monetary loss.   56.  Plaintiff and class members may also incur out of pocket costs for, e.g., purchasing  credit monitoring services, credit freezes, credit reports, or other protective measures to deter and  detect identity theft.   58.  Yet, Defendants’ offer of 12 months of credit monitoring is an inadequate remedy  for the breach and theft.   59.  Altering a birthdate is not possible. Altering a social security number is extremely  difficult, and even where it is possible, it is very expensive and time-consuming. Changing one’s  name and address is also burdensome and expensive.     60.  Given these facts, while credit monitoring might be part of a remedy for a data  breach, an offer of only 12 months of free credit monitoring is not in any way adequate.    61.  The names, addresses, birth dates and social security numbers stolen do not expire  in 12 months.    62.  There is no guarantee that the stolen PPI and Master Patient Index information will  be used by the miscreants in the next 12 months.    63.  Unless changed, this stolen PPI will continue to exist forever and allow for identity  theft 13 months from now, or 18 months from now, or 24 months from now.     64.  Indeed, a GAO Report GAO-07-737 notes with regard to stolen personal data:  “once posted on the Web, fraudulent use of that information may continue for years.”    65.  Furthermore, Defendants’ offer of 12 months of credit monitoring squarely places  the burden on Plaintiff and class members, rather than on the Defendants, to investigate and protect  themselves from Defendants’ tortious acts which resulted in the data breach.    66.  Rather than automatically and immediately enrolling Plaintiff and class members  in identity theft and credit monitoring services upon discovery of the breach in September 2020,  Defendants waited until January 2021 to notify Plaintiff and the class, and even then the notice  merely sent merely states that Plaintiff and the class can sign up for the services.   68.  No one really cares if cyber thieves or hackers find out that a customer bought a  sweater at a department store. Many patients, however, care a great deal about the confidentiality  of their medical treatment, including the decision to seek fertility treatment in the first place.    69.  Defendants themselves recognize this, with the Shady Grove Fertility website being  festooned with statements like “privacy is often a primary concern” and “Shady Grove  Fertility can ensure there are no leaks in the identity of donor or recipient identifiable  information,” and “Shady Grove Fertility has designed our anonymous Egg Donation  Program (for donors) and Donor Egg Program (for donor egg recipients) with a multitude  of safeguards to protect our patients’ privacy.”    70.  These statements show that Defendants were fully aware of the fact that medical  patient information, particularly information relating to fertility treatment, were to be treated as  especially private and entitled to adequate protections.    71.  This complaint aims at making sure that an adequate remedy is provided to Plaintiff  and the class by Defendants arising from the data breach and theft of PPI and Medical Patient  Index information relating to Shady Grove Fertility patients, one which places the burden on  Defendants, who are the parties whose failure to take reasonable safeguards and precautions  allowed the breach to happen in the first place, who failed to detect that breach for a month, and  then delayed notifying Plaintiff and the class of that breach for another three months.   73.  Plaintiff also brings this action as a class action pursuant to Fed.R.Civ.P. 23 on  behalf of a proposed sub-class (hereafter the “Pennsylvania Sub-Class”) defined as:  All persons to whom US Fertility sent a form notice which was identical  or substantially similar to Attachment A and who were patients at a  Shady Grove Fertility clinic located in Pennsylvania.    74.  Plaintiff also brings this action as a class action pursuant to Fed.R.Civ.P. 23 on  behalf of a proposed sub-class (hereafter the “New Jersey Sub-Class”) defined as:  All persons to whom US Fertility sent a form notice which was identical  or substantially similar to Attachment A and who were New Jersey  residents at the time they were treated at a Shady Grove Fertility clinic.     75.  Each class and sub-class is so numerous that joinder of all members is  impracticable.   76.  The exact number and identities of the persons who fit within the proposed classes  are either contained in Defendants’ records or can be ascertained from those records. It is alleged  that each proposed class or sub-class contains several thousand persons.   78.  Plaintiff is a member of each class and sub-class he seeks to represent.   79.  The claims of Plaintiff are not only typical of all class members, they are identical.     80.  All claims of Plaintiff and the class arise from the same common course of conduct  and event and all claims are based on the exact same legal theories.     81.  Plaintiff seeks the same relief for himself as for every other class member.   82.  Plaintiff has no interest antagonistic to or in conflict with the classes.   84.  Defendants have acted and/or refused to act on grounds generally applicable to the  class, thereby making appropriate injunctive relief for each class as a whole.   85.  The prosecution of separate actions by individual class members will create a risk  of inconsistent or varying adjudications, would as a practical matter be dispositive of the interests  of other members not parties to the adjudications, and would substantially impair or impede their  ability to protect their interests.   86.  A class action is superior to other available methods for the fair and efficient  adjudication of the controversy.   87.  Common questions will predominate, and there will be no unusual manageability  issues.   88.  Plaintiff incorporates all prior paragraphs as if fully set forth herein.   89.  Defendant required Plaintiff and the class to submit PPI and information for the  Master Patient Index in order to receive treatment at Shady Grove Fertility clinics located in, inter  alia, Maryland.   90.  Regardless of whether the Shady Grove Fertility clinic in question was located in  Maryland or not, all such PPI and MPI information gathered at all Shady Grove Fertility clinics  was stored by Defendants in Rockville, Maryland at a US Fertility facility.   92.  Under Maryland law, Defendants had (and continue to have) a duty to Plaintiff and  the class to exercise reasonable care in safeguarding and protecting their PPI and MPI information.   93.  Defendants also had (and continue to have) a duty to use ordinary care in activities  from which harm might be reasonably anticipated (such as in the storage and protection of PPI and  MPI information within their possession, custody and control).   94.  Defendants’ duty to use reasonable security measures arose as a result of the special  relationship that existed between Defendant Shady Grove Fertility and its patients, and from the  knowledge that the data involved information about highly confidential fertility treatments which  patients had been promised strict confidentiality.   95.  Only Defendants were in a position to ensure that their systems were sufficient to  protect against the harm to Plaintiff and the class members from a data breach.   96.  Pursuant to the Federal Trade Commission Act (“FTCA”), 15 U.S.C. § 45,  Defendants had a duty to provide fair and adequate computer systems and data security to safeguard  the personal and financial information of Plaintiff and Class Members.   97.  The FTCA prohibits “unfair . . . practices in or affecting commerce,” including,  as interpreted and enforced by the FTC, the unfair act or practice by businesses, such as Defendant,  of failing to use reasonable measures to protect the personal and financial information of Plaintiff  and Class Members. The FTC publications and orders described above also form part of the basis  of Defendants’ duty in this regard.   NEGLIGENCE UNDER MARYLAND COMMON LAW  On Behalf of the Main Class and the Maryland Sub-Class  