19.  On or about July 7, 2019, an unauthorized individual gained access to MGM Resorts  International’s computer network system, exfiltrated customer data, and then disclosed a subset of  that data on a closed internet forum.    20.  The data consisted of a treasure trove of MGM customer PII including: names,  addresses, driver’s license numbers, passport numbers, military identification numbers, phone  numbers, emails and dates of birth.   21.  Although the PII was subsequently removed from the closed internet site, in mid- February 2020 the seemingly full set of data containing the PII of more than 10.6 million MGM  guests was published on a well-known hacking forum, visible to any number of dark web  miscreants.   61.  Plaintiff seeks relief on behalf of himself and as a representative of all others who are  similarly situated. Pursuant to Fed. R. Civ. P. Rule 23(a), (b)(2), (b)(3) and (c)(4), Plaintiff seeks  certification of a Nationwide class defined as follows:  All persons whose PII was compromised as a result of the Data Breach announced by MGM  on or about September 5, 2019 (the “Class”).  21 Identity Fraud Hits Record High with 15.4 Million U.S. Victims in 2016, Up 16 Percent According  to New Javelin Strategy & Research Study, Business Wire¸  https://www.businesswire.com/news/home/20170201005166/en/Identity-Fraud-Hits-Record-High-  74.  Plaintiff restates and realleges paragraphs 1 through 73 above as if fully set forth  herein.   75.  As a condition of receiving services, Plaintiff and Class Members were obligated to  provide MGM with their PII.   76.  Plaintiff and the Class Members entrusted their PII to MGM with the understanding  that MGM would safeguard their information.     77.  Defendant had full knowledge of the sensitivity of the PII and the types of harm that  Plaintiff and Class Members could and would suffer if the PII were wrongfully disclosed.   78.  Defendant had a duty to exercise reasonable care in safeguarding, securing and  protecting such information from being compromised, lost, stolen, misused, and/or disclosed to  unauthorized parties.  This duty includes, among other things, designing, maintaining and testing the  Defendant’s security protocols to ensure that PII in its possession was adequately secured and  protected and that employees tasked with maintaining such information were adequately training on  cyber security measures regarding the security of such information.   79.  Plaintiff and the Class Members were the foreseeable and probable victims of any  inadequate security practices and procedures. Defendant knew of or should have known of the  inherent risks in collecting and storing the PII of Plaintiff and the Class, the critical importance of  providing adequate security of that PII, the current cyber scams being perpetrated and that it had  inadequate employee training and education and IT security protocols in place to secure the PII of  Plaintiff and the Class.   92.  Plaintiff restates and realleges Paragraphs 1 through 73 as if fully set forth herein.   93.  Section 5 of the FTC Act prohibits “unfair . . . practices in or affecting commerce,”  including, as interpreted and enforced by the FTC, the unfair act or practice by businesses, such as  MGM, of failing to use reasonable measures to protect PII.  The FTC publications and orders  described above also form part of the basis of Defendant’s duty in this regard.   94.  MGM violated Section 5 of the FTC Act by failing to use reasonable measures to  protect customer PII and not complying with applicable industry standards, as described in detail  herein.  MGM’s conduct was particularly unreasonable given the nature and amount of PII it  obtained and stored, and the foreseeable consequences of a data breach including, specifically, the  damages that would result to Plaintiff and Class Members.     95.  MGM’s violation of Section 5 of the FTC Act constitutes negligence per se as  MGM’s violation of the FTC Act establishes the duty and breach elements of negligence.   96.  Plaintiff and Class Members are within the class of persons that the FTC Act was  intended to protect.   97.  The harm that occurred as a result of the Data Breach is the type of harm the FTC Act  was intended to guard against.  The FTC has pursued enforcement actions against businesses, which,  as a result of their failure to employ reasonable data security measures and avoid unfair and  deceptive practices, caused the same harm as that suffered by Plaintiff and the Class.   A. The MGM Data Breach   NEGLIGENCE PER SE   NEGLIGENCE  