13.  Recently, financial institutions have experienced an unprecedented  number of Compromised Account Management System (“CAMS”) alerts on their  members’ accounts from VISA and Account Data Compromise Alerts (“ADC  alerts”) on their members’ accounts from MasterCard.  CAMS and ADC alerts  typically are issued by VISA and MasterCard when there is some event that  jeopardizes the security of a financial institution’s customers’  accounts.     14.  Numerous financial institutions have traced the large number of alerts  issued for their customers’ accounts and discovered a common thread—Defendant.   15.  The number of CAMS and ADC alerts received by many financial  institutions have been among the largest (meaning most cards compromised)  CAMS  or ADC alerts they have ever received for a single event.   16.  The alert Plaintiff received estimates the “exposure window” for the  breach of Defendant’s computer systems runs from October 25, 2016 to January 19,  2017, meaning Defendant failed to prevent or stop hackers from accessing its system  and stealing cardholder data for almost three months.   18.   Defendant still has not made an offical public announcement regarding  the breach of its data processing systems approximately four months since the breach  began and one month after it ended.   19.  The breach of Defendant’s data systems occurred through Defendant’s  POS network, where hackers installed malware that allowed them to steal payment  card data from remote locations as a card was swiped for payment.   20.  The breach was made possible because Defendant disregarded the  security of its POS network and the potential danger of a data breach, and failed to  put in place reasonable systems and procedures to prevent the harm that its actions  have caused.   21.  Defendant knew the danger of not safeguarding its POS network as  various high profile data breaches have occurred in the same way, including data  breaches of Target, Home Depot, and, most recently, Wendy’s.   23.  Defendant’s failure is particularly egregious because various state and  federal statutes obligate Defendant to act reasonably in protecting the data of the  members of Plaintiff and the Class.   24.  First, the payment card industry (MasterCard, VISA, Discover, and  American Express), long before the beach of Defendant’s data systems, issued Card  Operating Regulations that: (1) are binding on Defendant;   (2) required Defendant  to protect cardholder data and prevent its unauthorized disclosure; (3)  prohibited  Defendant from storing such data, even in encrypted form, longer than necessary to  process the transaction; and (4) mandated Defendant comply with industry  standards.   26.  The set deadline for businesses to transition their systems from  magnetic-stripe to EMV technology was October 1, 2015, a deadline Defendant, on  information and belief, did not meet.   27.  Under the Card Operating Regulations that are binding on Defendant,  businesses accepting payment cards but not meeting the October 1, 2015 deadline  agree to be liable for damages resulting from any data breaches.   28.  Third, the Payment Card Industry Security Standards Council  promulgates minimum standards, which apply to all organizations that store,  process, or transmit payment card data. These standards are known as the Payment  Card Data Security Standard (“PCI DSS”). PCI DSS is the industry standard  governing the security of payment card data, although it sets the minimum level of  what must be done, not the maximum.    30.  Among other things, PCI DSS required Defendant to: properly secure  payment card data; not store cardholder data beyond the time necessary to authorize  a transaction; maintain up-to-date antivirus software and a proper firewall; restrict  access to payment card data on a need-to-know basis; establish a process to identify  and timely fix security vulnerabilities; assign unique identification numbers to each  individual with access to its systems; and encrypt payment card data at the point of  sale.   32.  In 2007, the FTC published guidelines that establish reasonable data  security practices for businesses. The guidelines note businesses should protect the  personal customer information that they keep; properly dispose of personal  information that is no longer needed; encrypt information stored on computer  networks; understand their network’s vulnerabilities; and implement policies for  installing vendor-approved patches to correct security problems. The guidelines also  recommend that businesses consider using an intrusion detection system to expose  a breach as soon as it occurs; monitor all incoming traffic for activity indicating  someone may be trying to hack the system; watch for large amounts of data being  transmitted from the system; and have a response plan ready in the event of a breach.   33.  The FTC also has published a document entitled “FTC Facts for  Business,” which highlights the importance of having a data security plan, regularly  assessing risks to computer systems, and implementing safeguards to control such  risks.    34.  The FTC has issued orders against businesses that failed to employ  reasonable measures to secure customer data. These orders provide further guidance  to businesses with regard to their data security obligations.   36.  Defendant’s failure to employ practices and procedures reasonably  capable of securing the cardholder data of the members of Plaintiff and the Class  violated all of these statutory- and industry-imposed obligations and caused  substantial damage to Plaintiff and the Class.   37.  Indeed, the fact that cardholder data was left exposed for close to three  months and the fact that Defendant continuously failed to detect this vulnerability  demonstrates its complete lack of procedural and other safeguards with respect to its  customers’ data.   39.  As a result of the Defendant’s data breach, Plaintiff and class members  have been forced to cancel and reissue payment cards, change or close accounts,  notify members that their cards were compromised, investigate claims of fraudulent  activity, refund fraudulent charges, increase fraud monitoring on potentially  impacted accounts, and take other steps to protect themselves and their members.  They also lost interest and transaction fees due to reduced card usage. Furthermore,  debit and credit cards belonging to class members and Plaintiff—as well as the  account numbers on the face of the cards—were devalued.   40.  The financial damages suffered by Plaintiff and members of the class  are massive and continue to increase.   42.  Plaintiff brings this action on behalf of herself and all other similarly  situated Class members pursuant to Rule 23(a), (b)(2) and (b)(3) of the Federal Rules  of Civil Procedure and seeks certification of the following Class:  All banks, credit unions, financial institutions, and other entities in the  United States (including its Territories and the District of Columbia)  that issued payment cards (including debit or credit cards) used by  consumers to make purchases from Defendant while malware was  installed on its payment card systems.      43.  Excluded from the Class are Defendant and its subsidiaries and  affiliates; all employees of Defendant; all persons who make a timely election to be  excluded from the Class; government entities; and the judge to whom this case is  assigned and his/her immediate family and his/her court staff.    45.  Commonality and Predominance: All requirements of Fed. R. Civ. P.  23(a)(2) and 23(b)(3)’s predominance requirement are satisfied. This action involves  common questions of law and fact, which predominate over any questions affecting  individual Class members, including, without limitation:   a.  Whether Defendant engaged in the misconduct alleged;  b.  Whether Defendant owed a duty to Plaintiff and the class  members and whether Defendant violated that duty;  c.  Whether Plaintiff and the class members were injured and  suffered damages or other ascertainable loss as a result of  Defendant’s conduct; and  d.  Whether Plaintiff and the class members are entitled to relief and  the measure of such relief.   46.  Typicality: All requirements of Fed. R. Civ. P. 23(a)(3) are satisfied.  Plaintiff is a member of the Class, having issued payment cards that were  compromised in the data breach of Defendant’s data systems.  Plaintiff’s claims are  typical of the other Class members’ claims because, among other things, all Class  members were comparably injured through Defendant’s conduct.   49.  Injunctive and Declaratory Relief: All requirements of Fed. R. Civ.  P. 23(b)(2) are satisfied.  Defendant, through its uniform conduct, acted or refused  to act on grounds generally applicable to the class as a whole, making injunctive and  declaratory relief appropriate to the class as a whole.      50.  Plaintiff repeats and re-alleges the allegations contained in every  preceding paragraph as if fully set forth herein.   51.  Defendant owed a duty to Plaintiff and the members of the class to take  reasonable care in cardholder data, and to timely notify Plaintiffs in the case of a  data breach.  This duty arises from multiple sources.   53.  Defendant’s common law duty also arises from the special relationship  that existed between Defendant and the Class.  Plaintiff and the Class entrusted  Defendant with the cardholder data contained on the payment cards Plaintiff and the  Class issued to their members.  Defendant, as the holder and processor of that  information, was the only party who realistically could ensure that its data systems  were sufficient to protect the data it was entrusted to hold.   54.  In addition to the common law, Section 5 of the Federal Trade  Commission Act (“FTCA”), 15 U.S.C. § 45, further mandated Defendant to take  reasonable measures to protect the cardholder data.  Section 5 prohibits unfair  practices in or affecting commerce, which requires and obligates Defendant to take  reasonable measures to protect any cardholder data Defendant may hold or process.   The FTC publications and data security breach orders described above further form  the basis of Defendant’s duty.  In addition, individual states have enacted statutes  based upon the FTCA that also created a duty.   56.  Defendant, by its actions, has breached its duties to Plaintiff and the  class.  Specifically, Defendant failed to act reasonably in protecting the cardholder  data of the members of Plaintiff and the class members, and did not have reasonably  adequate systems, procedures and personnel in place to reasonably prevent the  disclosure and theft of the cardholder data of Plaintiff and the Class’s members.   58.  In connection with the conduct described above, Defendant acted  wantonly, recklessly, and with complete disregard for the consequences.   60.  Because no statutes of other states are implicated, Georgia common law  applies to Plaintiff and the Class’s negligence claim.  61.  Plaintiff repeats and re-alleges the allegations contained in every  preceding paragraph as if fully set forth herein.   62.  Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45,  prohibits “unfair…practices in or affecting commerce” including, as interpreted and  enforced by the FTC, the unfair act or practice by retailers, restaurants and other  businesses such as Defendant of failing to use reasonable measures to protect  cardholder data.  The FTC publications and orders described above also form the  basis of Defendant’s duty.   64.  Defendant’s violation of Section 5 of the FTCA (and similar state  statutes) constitutes negligence per se.   65.  Plaintiff and the class members are within the class of persons Section  5 of the FTCA (and similar state statutes) was intended to protect as they are engaged  in trade and commerce and bear primary responsibility for reimbursing consumers  for fraud losses. Moreover, Plaintiff and many class members are credit unions,  which are organized as cooperatives whose members are consumers.   66.  Moreover, the harm that has occurred is the type of harm the FTCA  (and similar state statutes) was intended to guard against. Indeed, the FTC has  pursued over fifty enforcement actions against businesses which, as a result of their  failure to employ reasonable data security measures and avoid unfair and deceptive  practices, caused the same harm suffered by Plaintiff and the class members.   68.  Because no statutes of other states are implicated, Georgia common law  applies to Plaintiff and the Class’s negligence per se claim.  69.  Plaintiff repeats and re-alleges the allegations contained in every  preceding paragraph as if fully set forth herein.   70.   Under the Declaratory Judgment Act, 28 U.S.C. §§ 2201, et seq., this  Court is authorized to enter a judgment declaring the rights and legal relations of the  parties and grant further necessary relief.  Furthermore, the Court has broad authority  to restrain acts, such as here, which are tortious and which violate the terms of the  federal and state statutes described herein.   74.  If an injunction is not issued, Plaintiff will suffer irreparable injury and  lack an adequate legal remedy in the event of another data breach of Defendant’s  data systems. The risk of another such breach is real, immediate, and substantial. If  another breach of Defendant’s data systems occurs, Plaintiff will not have an  adequate remedy at law because many of the resulting injuries are not readily  quantified and they will be forced to bring multiple lawsuits to rectify the same  conduct.   76.  Issuance of the requested injunction will not disserve the public interest.  To the contrary, such an injunction would benefit the public by preventing another  data breach, thus eliminating the injuries that would result to Plaintiff, the Class, and  the millions of consumers whose confidential information would be compromised.   Declaratory and Injunctive Relief   Negligence Per Se   Negligence    