18.  On or around February 17, 2019, Plaintiffs purchased food at a Buca di Beppo  located at 705 6th Avenue, San Diego, California, one of the affected locations, using their joint  credit card.   19.  Plaintiffs continue to monitor their accounts in an effort to detected and prevent  any further misuses.   20.  Since the announcement, Plaintiffs put a hold on their account, cancelled their  credit card, and as of the filing of this complaint, are awaiting the delivery of a new card.  Consequently, Plaintiffs have had to forgo using the cancelled credit card, including  accumulating credit card rewards points, and must now spend time and effort transferring over  automatic payments to the new credit card number after the new card is received.   22.  Consequently, Plaintiffs lost time dealing with the issues related to the Data  Breach in cancelling their credit card, communicating with their financial institution, and in  procuring credit freezes to mitigate potential future harm.   23.  Plaintiffs would not have used their credit cards to make purchases at Defendant’s  restaurants during the period of the Data Breach had Defendant disclosed that it lacked adequate  computer systems and data security practices to safeguard customers’ SPI from theft.   24.  Plaintiffs suffered actual injury from having their SPI stolen as a result of the Data  Breach.   25.  Plaintiffs suffered actual injury and damages in paying money to, and purchasing  products from, Defendant’s restaurants during the Data Breach, expenditures which they would  not have made had Defendant disclosed that it lacked computer systems and data security  practices adequate to safeguard customers’ SPI from theft.   26.  Plaintiffs suffered actual injury in the form of damages to and diminution in the  value of their SPI—a form of intangible property that Plaintiffs entrusted to Defendant for the  purpose of purchasing Defendant’s products and which was compromised in and as a result of  the Data Breach.   27.  Plaintiffs suffered lost time, annoyance, interference, and inconvenience as a  result of the Data Breach, and have concerns for the loss of their privacy.   28.  Plaintiffs have suffered imminent and impending injury arising from the  substantially increased risk of fraud, identity theft, and misuse resulting from their SPI being  placed in the hands of criminals.   30.  Defendant is a for-profit corporation that owns several large restaurant chains,  including Buca di Beppo, Planet Hollywood, Earl of Sandwich, as well as smaller restaurants,  such as Chicken Guy! and Café Hollywood.    31.  As part of the dining process, Defendant’s restaurants, like most restaurants,  accept payment cards through point-of-sale (“POS”) terminals, which accept customer payment  card data and process it for payment at the time for which a meal is paid. This data includes the  cardholder name, the account number, expiration date, card verification value (“CVV”), and PIN  data for debit cards . Defendant stores the SPI in its POS system and transmits this information to  a third party for processing and completion of the payment.   32.  At all relevant times, Defendant was well-aware, or reasonably should have been  aware, that the SPI collected, maintained, and stored in the POS systems is highly sensitive,  susceptible to attack, and could be used for wrongful purposes by third parties, such as identity  theft and fraud.   33.  POS systems and terminals, especially in the hospitality industry, are popular  targets for cyberattacks, often involving remote attacks which install malware which can spread  through an entire system. The frequency and prevalence of such attacks make it imperative that  companies in the hospitality industry (such as Defendant) routinely monitor for malware and  cyberattacks and regularly update their software and security procedures.   35.  SPI is a valuable commodity because it contains not only payment card numbers,  but also personally identifiable information (“PII”). A “cyber black market” exists in which  criminals openly post stolen payment card numbers, social security numbers, and other personal,  private information on multiple underground Internet websites. SPI is valuable to identity thieves  because they can use victims’ personal data—including SPI and PII—to open new financial  accounts and take out loans in another person’s name, incur charges on existing accounts, or  clone ATM, debit, and credit cards.   36.  Legitimate organizations and the criminal underground alike recognize the value  of SPI and PII contained in a merchant’s data systems; otherwise, the latter would not  aggressively seek or pay for it. For example, in “one of 2013’s largest breaches . . . not only did  hackers compromise the [card holder data] of three million customers, they also took registration  data [containing SPI and PII] from 38 million users.”5   38.  The SPI and PII of consumers remains of high value to identity criminals, as  evidenced by the prices criminals will pay through black-market sources, or what is often called  the dark web. Numerous sources cite dark web pricing for stolen identity credentials. For  example, a complete set of bank account credentials can fetch a thousand dollars or more  (depending on the associated credit score or balance available to criminals).8 Experian reports  that a stolen credit or debit card number can sell for $5–110 on the dark web. 9    39.  At all relevant times, Defendant knew, or reasonably should have known, of the  importance of safeguarding SPI and PII, and of the foreseeable consequences that would occur if  its data security system was breached, including, specifically, the significant costs that would be  imposed on its customers as a result of a breach.   40.  Defendant was, or should have been, fully aware of the significant volume of  daily credit and debit card transactions at its restaurants, amounting to tens of thousands of daily  payment card transactions, and thus, the significant number of individuals who would be harmed  by a breach of Defendant’s systems.    42.  A wave of data breaches causing the theft of retail payment card information has  hit the United States in the last several years.10 In 2016, the number of U.S. data breaches  surpassed 1,000, a record high and a forty percent increase in the number of data breaches from  the previous year.11 The amount of payment card data compromised by data breaches is massive.  For example, it is estimated that over 100 million cards were compromised in 2013 and 2014.12   44.  Before transmitting customer data over the merchant’s network, POS systems  typically, and very briefly, store the data in plain text within the system’s memory.15 The stored  information includes “Track 1” and “Track 2” data from the magnetic strip on the payment card,  such as the cardholder’s first and last name, the expiration date of the card, and the CVV (three  number security code on the card).16 This information is unencrypted on the card and, at least  briefly, will be unencrypted in the POS terminal’s temporary memory as it processes the data. 17   46.  A 2016 report by Verizon confirmed the vast majority of successful breaches  leverage legitimate credentials to gain access to the POS environment. Once attackers gain  access to the POS devices, they install malware, usually a RAM scraper, to capture payment card  data.22    47.  Intruders with access to unencrypted Track 1 and Track 2 payment card data can  physically replicate the card or use it online. Unsurprisingly, theft of payment card information  via POS systems is now “one of the biggest sources of stolen payment cards.”23 For example, in  2013, hackers infiltrated Target, Inc.’s POS system, stealing information from an estimated 40  million payment cards in the United States. In 2014, over 7,500 self-checkout POS terminals at  Home Depots throughout the United States were hacked, compromising roughly 56 million debit  and credit cards.24 Likewise, POS systems at more than 1,000 Wendy’s restaurants were  infiltrated with malware, resulting in the theft of payment cards data for approximately six- months.25 The same is true of Brinker, Chipotle, and numerous other retail restaurants.   49.  Despite the enumerated vulnerabilities of POS systems, available security  measures, and reasonable business practices would have significantly reduced or even eliminated  the likelihood that hackers could successfully infiltrate a business’ POS system.   50.  The payment card networks (MasterCard, Visa, Discover, and American  Express), data security organizations, state governments, and federal agencies have all  implemented various standards and guidance on security measures designed to prevent these  types of intrusions into POS systems. However, despite Defendant’s understanding of the risk of  data theft via malware installed on POS systems, and the widely available resources to prevent  intrusion into POS data systems, Defendant failed to adhere to these guidelines and failed to take  reasonable and sufficient protective measures to prevent the Data Breach.    51.  Security experts have recommended specific steps that retailers should take to  protect their POS systems. For example, a few years ago, Symantec recommended “point to  point encryption” implemented through secure card readers, which encrypt credit card  information in the POS system, preventing malware that extracts card information through the  POS memory while it processes the transaction.26 Moreover, Symantec emphasized the  importance of adopting EMV chip technology. Datacap Systems, a developer of POS systems,  recommended similar preventative measures.27   53.  The Payment Card Industry Data Security Standard (“PCI DSS”) is a set of  requirements designed to ensure that companies maintain consumer credit and debit card  information in a secure environment.28   54.  The PCI DSS “was developed to encourage and enhance cardholder data security”  by providing “a baseline of technical and operational requirements designed to protect account  data.”29 PCI DSS sets the minimum level of what must be done, not the maximum.   55.  PCI DSS 3.2, the version of the standards in effect at the time of the Data Breach,  imposes the following requirements on Defendant: 30   57.  PCI DSS also required Defendant not to store “the full contents of…the magnetic  stripe located on the back of a card” or “the card verification code or value” after authorization.31   58.  Despite Defendant’s awareness of its data security obligations, Defendant’s  treatment of SPI and PII entrusted to it by its customers fell far short of satisfying Defendant’s  legal duties and obligations, and included violations of the PCI DSS. Defendant failed to ensure  that access to its data systems was reasonably safeguarded, failed to acknowledge and act upon  industry warnings and failed to use proper security systems to detect and deter the type of attack  that occurred and is at issue here.  E.  Defendant Failed to Comply with FTC Requirements   59.  Federal and State governments have likewise established security standards and  issued recommendations to temper data breaches and the resulting harm to consumers and  financial institutions. The Federal Trade Commission (“FTC”) has issued numerous guides for  business highlighting the importance of reasonable data security practices. According to the  FTC, the need for data security should be factored into all business decision-making.32   61.  The FTC recommends that companies not maintain cardholder information longer  than is needed for authorization of a transaction; limit access to sensitive data; require complex  passwords to be used on networks; use industry-tested methods for security; monitor for  suspicious activity on the network; and verify that third-party service providers have  implemented reasonable security measures.34   62.  The FTC has brought enforcement actions against businesses for failing to  adequately and reasonably protect customer data, treating the failure to employ reasonable and  appropriate measures to protect against unauthorized access to confidential consumer data as an  unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”),  15 U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses must  take to meet their data security obligations.   64.  In this case, Defendant was at all times fully aware of its obligation to protect the  financial data—including SPI and PII—of Defendant’s customers because of its participation in  payment card processing networks. Defendant was also aware of the significant repercussions if  it failed to do so because Defendant collected payment card data from tens of thousands of  customers daily and they knew that this data, if hacked, would result in injury to consumers,  including Plaintiffs and Class members.    65.  Despite understanding the consequences of inadequate data security, Defendant  failed to comply with PCI DSS requirements and failed to take additional protective measures  beyond those required by PCI DSS.    66.  Despite understanding the consequences of inadequate data security, Defendant  operated POS systems with outdated operating systems and software; failed to enable point-to- point and end-to-end encryption; and, failed to take other measures necessary to protect its data  network.  F.  The Earl Enterprises Data Breach   68.  Joker’s Stash has been described as “the most notorious and well-known  underground marketplace for selling stolen credit card dumps.”36   69.  On March 29, 2019, Defendant publicly announced that a security breach had  occurred, confirming Krebs’ notification.37 Defendant did not publicly state how many people it  believed had been affected, merely stating that it believed a “limited number of guests” were  affected.38   70.  Further, the limited advice given to customers stated:  You can carefully review credit and debit card account statements  as soon as possible for suspicious charges or activity you do not  recognize. As a best practice, we urge you to remain vigilant and  continue to monitor statements for unusual activity going forward.  If you see anything you do not recognize, you should immediately  notify the issuer of the credit or debit card. In instances of payment  card fraud, it is important to note that cardholders are typically not  responsible for any fraudulent activity that is reported in a timely  fashion.   Guests can also review the “Information about Identity Theft  Protection” reference guide, included below which describes  additional steps that you can take to help protect yourself,  including recommendations by the Federal Trade Commission  regarding identity theft protection and details on placing a fraud  alert or a security freeze on your credit file.39   72.  The advertisement on “Joker’s Stash” for the payment card numbers specifically  stated that it included both Track 1 and Track 2 data.40 While cloned credit cards can be made  from Track 2 data, which is largely limited to account numbers and expiration dates, Track 1  data is more valuable because it also contains names and CVV or CVC codes (the three- or four- digit security codes commonly found on the signature stripe of a credit card).   73.  This SPI and PII was compromised due to Defendant’s acts and omissions and its  failure to properly protect the SPI and PII, despite being aware of recent data breaches impacting  other national restaurant chains, including P.F. Chang’s, Arby’s, Chipotle, Wendy’s, Chili’s, and  other prominent national restaurant chains.   74.  In addition to Defendant’s failure to prevent the Data Breach, Defendant also  failed to detect the breach for nearly ten months.   75.  Intruders, therefore, had months to collect SPI and PII unabated. During this time,  Defendant failed to recognize its systems had been breached and that intruders were stealing data  on millions of payment cards. Timely action by Defendant likely would have significantly  reduced the consequences of the breach. Instead, Defendant took more than ten months to realize  its systems had been breached, and thus contributed to the scale of the Data Breach and the  resulting damages to Plaintiffs and Class members.   77.  While many merchants and vendors have responded to recent data breaches by  adopting technology and security practices that help make transactions and stored data more  secure, Defendant failed to do so.   78.  The Data Breach was caused and enabled by Defendant’s knowing violation of its  obligations to abide by best practices and industry standards in protecting SPI and PII.  G.  The Data Breach Caused Harm and Will Result in Additional Fraud   79.  Without detailed disclosures to Defendant’s customers, Plaintiffs and Class  members were unknowingly and unwittingly left exposed to continued misuse and ongoing risk  of misuse of their SPI and PII for up to ten months without being able to take necessary  precautions to prevent imminent harm.   80.  Plaintiffs have employed extraordinary lengths to protect their identity and  maintain their privacy.   81.  Prior to the Data Breach, Plaintiffs routinely reviewed their financial statements,  and the credit card at issue had not been compromised.   82.  Plaintiffs routinely monitored their credit for unusual activity and had not  received any indication that their credit card was breached or otherwise compromised.   83.  Plaintiffs never transmit unencrypted SPI or PII over the internet or any other  unsecured source.   85.  Thus, given that before the Data Breach, Plaintiffs’ credit card had not  experienced any prior form of breach or compromise, and they undertook substantial efforts to  protect their financial information—including SPI and PII—Defendant’s Data Breach is the  source of Plaintiffs’ damages and injuries described in this Complaint.   86.  But for Defendant’s Data Breach, Plaintiffs’ credit cards would not have been  breached or compromised, and their damages would not have occurred.   87.  The ramifications of Defendant’s failure to keep Plaintiff’s and Class members’  data secure are severe and far reaching.   88.  Consumer victims of data breaches are more likely to become victims of identity  fraud. This conclusion is based on an analysis of four years of data that correlated each year’s  data breach victims with those who also reported being victims of identity fraud.41    89.  The FTC defines identity theft as “a fraud committed or attempted using the  identifying information of another person without authority.”42 The FTC describes “identifying  information” as “any name or number that may be used, alone or in conjunction with any other  information, to identify a specific person.”43   90.  SPI and PII are valuable commodities to identity thieves once the information has  been compromised. As the FTC recognizes, once identity thieves have SPI and PII, “they can  drain your bank account, run up your credit cards, open new utility accounts, or get medical  treatment on your health insurance.”44   41  2014 LexisNexis True Cost of Fraud Study,  https://www.lexisnexis.com/risk/downloads/assets/true-cost-fraud-2014.pdf.   A.  Plaintiffs’ Transactions  