11.  On or around July 8, 2013, Defendant learned that for approximately 16 months,  from March 2012 until July 2013, Plaintiff’s and the other Class members’ PII had been stored  on an unsecure Internet server maintained by a third-party enrollment system vendor. See Exhibit  1: July 26, 2013 letter to Plaintiff from Combined Insurance (“Breach Notification Letter”).  During this period of time, anyone with an Internet connection was able to access Plaintiff’s and  Class members’ PII without their knowledge, authorization, or consent.     12.  Defendant is an insurance company that has provided and continues to provide  supplemental insurance to certain Dillard’s employees and their dependents.    13.  In a letter dated July 26, 2013, Defendant notified Plaintiff and the other Class  members that their PII was stored on an Internet server maintained by a third-party enrollment  system vendor from March 2012 until July 2013, without proper security measures. See Exhibit  1: Breach Notification Letter.     14.  The putative Class consists of persons who purchased certain policies, as  referenced in Exhibit 1, from Defendant between March 2010 and March 2012, and dependents  covered under such policies.     15.  As individuals who were covered by Defendant’s insurance policies, Plaintiff’s  and the other Class members’ PII was entrusted to Defendant.    16.  Despite knowing about the Security Breach since at least July 8, 2013, Defendant  did not begin to formally notify Plaintiff and Class members of the Security Breach until July 26,  2013—more than two weeks after learning of the Security Breach and more than 16 months after  the information was first stored on an Internet server without proper security measures.   4   17.  During the intervening period between the Security Breach and the date the first  wave of notification letters were sent to Plaintiff and Class members on July 26, 2013, the PII  was accessible for sale and misuse on the robust international cyber black market, while Plaintiff  and Class members had no chance whatsoever to take measures to protect their privacy.  Defendant’s willful and wanton conduct placed Plaintiff’s and the other Class members’ PII in  the well-known and well-recognized sphere of harm for such information.      18.  Defendant has admitted that the PII entrusted to it was improperly stored:    [O]n July 8th, 2013, we learned that two files containing the personal  information of certain Dillard’s associates and their dependents were  stored on an Internet server by a third party enrollment system vendor  since March 2012 without the proper security measures. The files  contained the Social Security numbers, names, addresses, dates of birth,  and enrollment and premium information for some associates and  dependents. The files did not, however, contain personal medical or claims  information.   See Exhibit 1: Breach Notification Letter. In the aftermath of the Security Breach, Defendant  represented to affected individuals that it took remedial steps, including removing the files from  all publicly-accessible online environments. Id.    19.  Notwithstanding Defendant’s wrongful actions and inaction and the resulting  Security Breach, Defendant offered a mere one year of credit monitoring services. Defendant’s  offer is plainly insufficient given the trove of PII that was made available to the world and the  well-documented manipulation and machinations of cyber-criminals.    20.  Defendant’s wrongful actions and inaction—to wit, failing to maintain reasonable  security measures to protect Plaintiff’s and Class members’ PII with which it was entrusted— caused the dissemination into the public domain of Plaintiff’s and Class members’ PII without  their knowledge, authorization, or consent.   5   21.  As a result of Defendant’s failure to properly safeguard and protect Plaintiff’s and  Class members’ PII entrusted to it, Plaintiff’s and Class Members’ privacy has been (and will  continue to be) invaded and their rights violated. Their compromised PII was private and  sensitive in nature, was disclosed to a third-party vendor, and was disseminated to the members  of the public who used it to harm Plaintiff and Class members.  Security Breaches Lead to Identity Theft   22.  Identity theft occurs when a person’s PII, such as the person’s name, e-mail  address, address, Social Security number, billing and shipping addresses, phone number and  credit card information, is used or attempted to be used without his or her permission to commit  fraud or other crimes.1    23.  According to the Federal Trade Commission (“FTC”), “the range of privacy- related harms is more expansive than economic or physical harm or unwarranted intrusions” and  “any privacy framework should recognize additional harms that might arise from unanticipated  uses of data.”2 Furthermore, “there is significant evidence demonstrating that technological  advances and the ability to combine disparate pieces of data can lead to identification of a  consumer, computer or device even if the individual pieces of data do not constitute [PII].”3  1 See FTC, Identity Theft, available at http://www.consumer.ftc.gov/features/feature-0014-identity-theft  (last visited May 8, 2014).  2 FTC Report, Protecting Consumer Privacy in an Era of Rapid Change, 8 (March 2012), available at  http://www.ftc.gov/os/2012/03/120326privacyreport.pdf (last visited May 8, 2014).  3 FTC Report, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for  Businesses and Policymakers, Preliminary FTC Staff Report, 35–38 (Dec. 2010), available at  http://www.ftc.gov/os/2010/12/101201privacyreport.pdf (last visited May 8, 2014); Comment of Center  for Democracy & Technology, cmt. #00469, at 3; Comment of Statz, Inc., cmt. #00377, at 11–12.   6   24.  The FTC estimates that the identities of as many as 9 million Americans are  stolen each year.4 Because Plaintiff’s and Class members’ Social Security numbers were made  publicly available, they face a significantly heightened risk of identity theft, identity fraud, and  medical fraud.  In fact, as detailed herein, Plaintiff has already been a victim of identity theft,  identity fraud, and medical fraud.    25.  Javelin Strategy & Research (“Javelin”), a leading provider of quantitative and  qualitative research, released a 2012 Identity Fraud Report (the “Javelin Report”), quantifying  the impact of security breaches.  According to the Javelin Report, individuals whose PII is  subject to a reported security breach—such as the Security Breach at issue here—are  approximately 9.5 times more likely than the general public to suffer identity fraud and/or  identity theft.    26.  According to the FTC, victims of identity theft are at serious risk of substantial  losses.  “Once identity thieves have your personal information, they can drain your bank account,  run up charges on your credit cards, open new utility accounts, or get medical treatment on your  health insurance. An identity thief can file a tax refund in your name and get your refund.  In  some extreme cases, a thief might even give your name to the police during an arrest.”5    27.  The FTC also warns consumers about medical identity theft. “A thief may use  your name or health insurance numbers to see a doctor, get prescription drugs, file claims with  your insurance provider, or get other care.  If the thief’s health information is mixed with yours,  your treatment, insurance and payment records, and credit report may be affected.”6  4 Id.   5 See FTC, Signs of Identity Theft, available at http://www.consumer.ftc.gov/articles/0271-signs-identity- theft (last visited May 8, 2014).  6 See FTC, Medical Identity Theft, available at http://www.consumer.ftc.gov/articles/0171-medical- identity-theft (last visited May 8, 2014).  7   28.  Identity thieves also use Social Security numbers to commit other types of fraud.  The Government Accounting Office (GAO) found that identity thieves use PII to open financial  accounts and payment card accounts and incur charges in a victim’s name.7 This type of identity  theft can be the most damaging because it may take some time for the victim to become aware of  the theft, while in the meantime causing significant harm to the victim’s credit rating and  finances. Moreover, unlike other PII, Social Security numbers are incredibly difficult to change  and their misuse can continue for years into the future.   29.  Identity thieves also use Social Security numbers to obtain false identification  cards, obtain government benefits in the victim’s name, commit crimes, and, as occurred here,  file fraudulent tax returns to pilfer the victims’ tax refunds. Identity thieves also obtain jobs using  stolen Social Security numbers, rent houses and apartments, and obtain medical services in the  victim’s name. Identity thieves also have been known to give a victim’s personal information to  police during an arrest, resulting in the issuance of an arrest warrant in the victim’s name and an  unwarranted criminal record. The GAO states that victims of identity theft face “substantial costs  and inconvenience repairing damage to their credit records,” as well the damage to their “good  name.”8     30.  The unauthorized disclosure of a person’s Social Security number can be  particularly damaging, because Social Security numbers cannot be easily replaced like a credit  card or debit card.  In order to obtain a new Social Security number, a person must show  evidence that someone is using the number fraudulently, as well as show that he has done all he  7 See http://www.gao.gov/new.items/d07737.pdf (last visited May 8, 2014).  8 See http://www.gao.gov/new.items/d09759t.pdf (last visited May 21, 2014).  8  can to fix the problems resulting from the misuse.9 Thus, individuals whose PII has been stolen  cannot obtain a new Social Security number until the damage has already been done and they  have shown they have done all they can to fix the problems.   31.  What is more, obtaining a new Social Security number is not an absolute  prevention against continued identity theft.  Government agencies, private businesses, and credit  reporting companies likely still have the person’s records under the old number, so the effects of  the identity theft may persist long after the incident. For some victims of identity theft, a new  number may actually create more problems. Because prior positive credit information is not  associated with the new Social Security number, it is more difficult to obtain credit due to the  absence of a credit history.   32.  Plaintiff’s and Class members’ PII is a valuable commodity to identity thieves.  Once personally identifiable information, such as Plaintiff’s and Class members’ PII, has been  compromised, criminals often trade the information on the “cyber black market” for a number of  years.10 Identity thieves and other cyber criminals openly post stolen credit card numbers, Social  Security numbers, and other personal financial information on various Internet websites, thereby  making the information publicly available.  In one study, researchers found hundreds of websites  displaying stolen personal financial information. Strikingly, none of these websites was blocked  by Google’s safeguard filtering mechanism—the “Safe Browsing list.”  The study concluded:   It is clear from the current state of the credit card black-market that cyber  criminals can operate much too easily on the Internet.  They are not afraid  to put out their email addresses, in some cases phone numbers and other  credentials in their advertisements. It seems that the black market for  9See Identity Theft and Your Social Security Number, SSA Publication No. 05-10064, October 2007, ICN  46327, available at http://www.ssa.gov/pubs/10064.html (last visited May 8, 2014).  10 Companies, in fact, also recognize PII as an extremely valuable commodity akin to a form of personal  property. See T. Soma, et al, Corporate Privacy Trend: The “Value” of Personally Identifiable  Information (“PII”) Equals the “Value” of Financial Assets, 15 Rich. J.L. & Tech. 11, 3–4 (2009).  9  cyber criminals is not underground at all.  In fact, it’s very “in your  face.”11  Damages Sustained by Plaintiff and Class Members   33.  The Security Breach was a direct and foreseeable result of Defendant’s failure to  adopt and maintain reasonable and industry-standard security measures to safeguard and protect  Plaintiff’s and Class members’ PII from unauthorized access, use, and disclosure, as required by  various state and federal regulations, industry practices, and common law duties.     34.  Defendant’s wrongful actions and inaction directly and foreseeably caused the  theft and dissemination into the public domain of Plaintiff’s and Class members’ PII without  their knowledge, authorization, and consent. As a direct and foreseeable result of Defendant’s  wrongful actions and inaction and the Security Breach, Plaintiff and Class members have  suffered, and will continue to suffer, economic damages and other actual harm including, without  limitation: (i) economic losses as a result of identity theft, identity fraud, and medical fraud; (ii)  improper disclosure of their PII; (iii) loss of privacy; (iv) reasonable out-of-pocket expenses  incurred to remedy identity theft, identity fraud, and medical fraud and to mitigate the increased  risk of identity theft, identity fraud, and medical fraud pressed upon them by the Security  Breach; (v) anxiety and emotional distress; and/or (vi) the value of their time spent mitigating the  effects of identity theft, identity fraud, and medical fraud and/or the increased risk of identity  theft, identity fraud, and medical fraud—for which they are entitled to compensation.    35.  As a result of the Security Breach, a thief or thieves submitted to the Internal  Revenue Service a fraudulent Income Tax Return for 2013 in Plaintiff’s name. Plaintiff has spent  time and has incurred, and likely will in the future incur additional, out-of-pocket expenses for  11  StopTheHacker,  The  “Underground”  Credit  Card  Blackmarket,  available  at  http://www.stopthehacker.com/2010/03/03/the-underground-credit-card-blackmarket/ (last visited May 8,  2014).   10  accountant/tax preparer services in order to challenge and remedy the fraudulent Income Tax  Return. Plaintiff has also been damaged financially by the related delay in receiving her tax  refund for 2013.    36.  Plaintiff has also been damaged by fraudulent T-Mobile charges and medical  charges in her name. Plaintiff had to take the time to file a police report, obtain a copy of her  Social Security card, and make calls in order to challenge the fraudulent charges.  37.  Pursuant to Rule 23 of the Federal Rules of Civil Procedure, Plaintiff brings this  action as a class action individually and on behalf of the following Class of similarly situated  individuals:  All persons whose personally identifiable information (“PII”) was provided to  Combined Insurance in connection with insurance policies purchased from  Combined Insurance during the period of time from March 2010 to March 2012  and whose PII was stored on an Internet server without proper security measures,  including each person to whom Combined Insurance sent a letter notifying them  of the security breach.  Excluded from the Class are (i) Defendant and its owners, officers, directors, employees, agents,  and representatives and its parent entities, subsidiaries, affiliates, successors, and assigns; and (ii)  the Court, Court personnel, and members of their immediate families.   38.  Numerosity—Federal Rule of Civil Procedure 23(a)(1).  The members of the  Class are so numerous that joinder of the Class members would be impracticable. Based upon the  two-year period of time when the relevant insurance policies were purchased, Class members are  believed to number in at least the hundreds or more. The precise number of Class members is  presently unknown to Plaintiff, but may be ascertained from Defendant’s records.  Disposition of  this matter as a class action will provide substantial benefits and efficiencies to the Parties and  the Court.  11   39.  Commonality and Predominance—Federal Rule of Civil Procedure 23(a)(2)  and 23(b)(3).  Common questions of law and fact exist as to all Class members and predominate  over any potential question that affects only individual Class members. Such common questions  of law or fact include, inter alia:   a) whether Defendant willfully or negligently violated FCRA by failing to adopt  and maintain reasonable security measures to limit the dissemination of  Plaintiff’s and Class members’ PII to permissible purposes under 15 U.S.C. §  1681b;   b) whether Defendant violated the Illinois Insurance Code by failing to properly  secure Plaintiff’s and Class members’ PII;  c) whether Defendant’s violation of the Illinois Insurance Code constitutes  negligence per se;  d) whether Defendant willfully, recklessly, and/or negligently failed to adopt and  maintain reasonable procedures designed to prevent unauthorized access to  Plaintiff’s and Class members’ PII;   e) whether Defendant owed a duty to Plaintiff and Class members to exercise  reasonable care in storing and maintaining their PII;  f) whether Defendant breached its duty to exercise reasonable care in storing and  maintaining Plaintiff’s and Class members’ PII;   g) whether Defendant owed a fiduciary duty to Plaintiff and Class members and  whether Defendant breached that duty;  h) whether Defendant breached its contract with Plaintiff and Class members;  i) whether Defendant breached an implied contract with Plaintiff and Class  members;  j) whether Defendant was unjustly enriched to the detriment of Plaintiff and  Class members;  k) whether by publicly disclosing Plaintiff’s and Class members’ PII without  authorization, Defendant invaded Plaintiff’s and Class members’ privacy; and  l) whether Plaintiff and the other members of the Class are entitled to damages,  injunctive relief, and other equitable relief, and the measure of such damages and  relief.   12  Defendant engaged in a common course of conduct giving rise to the legal rights sought to be  enforced by Plaintiff, individually and on behalf of the other Class members. Individual  questions, if any, pale by comparison, in both quality and quantity, to the numerous common  questions that dominate this action.   40.  Typicality—Federal Rule of Civil Procedure 23(a)(3). Plaintiff’s claims are  typical of Class members’ claims in that Plaintiff’s claims and Class members’ claims all arise  from Defendant’s failure to properly safeguard and protect Plaintiff’s and Class members’ PII  and the resulting Security Breach.  Further, there are no defenses available to Defendant unique  to Plaintiff.   41.  Adequacy of Representation—Federal Rule of Civil Procedure 23(a)(4).  Plaintiff and her counsel will fairly and adequately represent the interests of Class members.   Plaintiff has no interests antagonistic to, or in conflict with, Class members’ interests.   Additionally, Plaintiff’s attorneys are highly experienced in the prosecution of consumer class  actions, including security breach class actions, and intend to vigorously prosecute this action on  behalf of Plaintiff and Class members.    42.  Insufficiency of Separate Actions—Federal Rule of Civil Procedure 23(b)(1).  Absent a representative class action, members of the Class would continue to suffer the harm  described herein, for which they would have no remedy. Even if separate actions could be  brought by individual consumers, the resulting multiplicity of lawsuits would cause undue  hardship and expense for both the Court and the litigants, as well as create a risk of inconsistent  rulings that might be dispositive of the interests of similarly situated consumers, substantially  impeding their ability to protect their interests, while establishing incompatible standards of  conduct for Defendant. The Class thus satisfies the requirements of Fed. R. Civ. P. 23(b)(1).  13   43.  Declaratory and Injunctive Relief—Federal Rule of Civil Procedure 23(b)(2).  Defendant has acted or refused to act on grounds generally applicable to Plaintiff and the other  Class members, thereby making appropriate final injunctive relief and declaratory relief, as  described below, with respect to the members of the Class as a whole.   44.  Superiority—Federal Rule of Civil Procedure 23(b)(3).  A class action is  superior to other available means for fairly and efficiently adjudicating this controversy, and no  unusual difficulties are likely to be encountered in the management of this matter as a class  action.  Additionally, the damages and other detriment suffered by Plaintiff and the other Class  members are relatively small compared to the burden and expense that would be required to  individually litigate their claims against Defendant, so it would be impracticable for Class  members to individually seek redress for Defendant’s wrongful conduct. Even if Class members  could afford individual litigation, the court system should not be required to bear the burden and  expense of such inefficiency. Individualized litigation would also create the potential for  inconsistent or contradictory judgments and increase the delay and expense to all parties and the  court system. By contrast, the class action device provides the benefits of a single adjudication,  economy of scale, and comprehensive supervision by a single court.  45.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.    46.  FCRA defines a “consumer reporting agency” as:   [A]ny person which, for monetary fees, dues, or on a cooperative  nonprofit basis, regularly engages in whole or in part in the practice of  assembling or evaluating consumer credit information or other information  on consumers for the purpose of furnishing consumer reports to third  14  parties, and which uses any means or facility of interstate commerce for  the purpose of preparing or furnishing consumer reports.   15 U.S.C. § 1681a(f).     47.  FCRA defines a “consumer report” as:   [A]ny written, oral, or other communication of any information by a  consumer reporting agency bearing on a consumer’s credit worthiness,  credit standing, credit capacity, character, general reputation, personal  characteristics, or mode of living which is used or expected to be used or  collected in whole or in part for the purpose of establishing the consumer’s  eligibility for (A) credit or insurance to be used primarily for personal,  family, or household purposes; (B) employment purposes; or (C) any other  purpose authorized under [15 U.S.C. §] 1681(b).   15 U.S.C. § 1681a(d)(1).     48.  FCRA defines “medical information” as:   [I]nformation or data, whether oral or recorded, in any form or medium,  created by or derived from a health care provider or the consumer, that  relates to—(A) the past, present, or future physical, mental, or behavioral  health or condition of an individual; (B) the provision of health care to an  individual; or (C) the payment for the provision of health care to an  individual.   15 U.S.C. § 1681a(i).     49.  FCRA specifically protects medical information, restricting its dissemination to  limited instances. See, e.g., 15 U.S.C. §§ 1681a(d)(3); 1681b(g); 1681c(a)(6).   50.  Defendant is a Consumer Reporting Agency under FCRA. On a cooperative  nonprofit basis and/or for monetary fees, Defendant regularly assembles consumer information  including, among other things, insurance policy information, such as names, dates of birth, and  Social Security Numbers of those insured; claims information, such as the date of loss, type of  loss, and amount paid for claims submitted by an insured; and a description of insured items.  Defendant also regularly utilizes interstate commerce to furnish such information/PII on  consumers (consumer reports) to third parties, including the Medical Information Bureau.   15   51.  Plaintiff’s and the other Class members’ PII, including their enrollment and  premium information, constitute Consumer Reports under FCRA, because this information bears  on, among other things, their credit worthiness, credit standing, credit capacity, character,  general reputation, personal characteristics, physical/medical conditions, and mode of living, and  is used or collected, in whole or in part, for the purpose of establishing Plaintiff’s and the other  Class members’ eligibility for insurance to be used primarily for personal, family, or household  purposes.   52.  FCRA requires the adoption of reasonable procedures with regard to, inter alia,  the confidentiality and proper utilization of personal and insurance information. 15 U.S.C.  § 1681(b). FCRA also requires that: “Every consumer reporting agency shall maintain  reasonable procedures designed to . . . limit the furnishing of consumer reports to the purposes  listed under section 1681b of this title.” 15 U.S.C. § 1681e.   53.  Defendant failed to adopt and maintain reasonable procedures designed to limit  the furnishing of consumer reports to the purposes listed under 15 U.S.C. § 1681b.    54.  Plaintiff’s and Class members’ PII, in whole or in part, constitutes medical  information as defined by FCRA. The PII included enrollment and premium information, which  constitute data relating to the provision of, and payment for, health care under FCRA’s definition  of medical information. See 15 U.S.C. § 1681a(i). Defendant’s consumer reports provided to the  Medical Information Bureau also contained information regarding the past, present, or future  physical, mental, or behavioral health or condition of an individual.   55.  Defendant’s violation of FCRA, as set forth above, was willful or, at the very  least, reckless, constituting willfulness.    56.  As a result of Defendant’s willful and/or reckless failure to adopt and maintain  16  reasonable procedures to limit the furnishing of Plaintiff’s and Class members’ PII to the  purposes listed under 15 U.S.C. § 1681b, Plaintiff’s and the other Class members’ PII was made  accessible to unauthorized third parties in the public domain, compromised, and stolen. Plaintiff  suffered individual harm as a result of Defendant’s willful and/or reckless violations of FCRA.    57.  As a further direct and/or proximate result of Defendant’s willful and/or reckless  violations of FCRA, as described above, Plaintiff and the other Class members were (and  continue to be) injured and have suffered (and will continue to suffer) the damages described in  detail above.    58.  Plaintiff and the other Class members, therefore, are entitled to compensation for  their actual damages or statutory damages of not less than $100, and not more than $1,000, each,  as well as attorneys’ fees, litigation expenses and costs, pursuant to 15 U.S.C. § 1681n(a).  59.  Plaintiff repeats and re-alleges paragraphs 1 through 54 as if fully set forth herein.    60.  Defendant negligently failed to adopt and maintain reasonable procedures  designed to limit the furnishing of consumer reports to the purposes listed under 15 U.S.C. §  1681b.    61.  Plaintiff’s and the other Class members’ PII was wrongfully disseminated to the  public as a direct and foreseeable result of Defendant’s failure to adopt and maintain such  reasonable procedures.    62.  As a direct and/or proximate result of Defendant’s negligent violations of FCRA,  as described above, Plaintiff’s and the other Class members’ PII was made accessible to  unauthorized third parties in the public domain, compromised, and stolen. Plaintiff suffered  17  individual harm as a result of Defendant’s negligent violations of FCRA.    63.  As a further direct and/or proximate result of Defendant’s negligent violations of  FCRA, as described above, Plaintiff and the other Class members were (and continue to be)  injured and have suffered (and will continue to suffer) the damages described in detail above.    64.  Plaintiff and the other Class members, therefore, are entitled to compensation for  their actual damages, as well as attorneys’ fees, litigation expenses, and costs, pursuant to 15  U.S.C. § 1681o(a).   65.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.    66.  Pursuant to 215 Ill. Comp. Stat. 5/1002, the obligations imposed by Article XL of  the Insurance Information and Privacy Protection portion of the Illinois Insurance Code applies  to “insurance institutions . . .  [that] collect, receive or maintain information in connection with  insurance transactions.”  Defendant here is an “insurance institution” for purposes of the Code.   67.  Plaintiff’s and Class members’ PII made available to the public fall within the  definition of “Personal Information,” as defined in 215 Ill. Comp. Stat. 5/1003, and as used in  Article XL of the Insurance Information and Privacy Protection portion of the Illinois Insurance  Code.   68.  An insurance institution shall not disclose any personal information about an  individual collected or received in connection with an insurance transaction without a valid  written request submitted by an authorized individual and/or agency, subject to exceptions  inapplicable here.  215 Ill. Comp. Stat. 5/1014.  18   69.  Defendant, by allowing Plaintiff’s and Class members’ PII to become accessible  and available via the Internet, as described above, violated the Insurance Information and  Privacy Protection portion of the Illinois Insurance Code, because the Security Breach was not  pursuant to a valid, written request submitted by an authorized individual and/or agency and/or  in accordance with 215 Ill. Comp. Stat. 5/1014.     70.  As a result of Defendant’s violation of Article XL of the Insurance Information  and Privacy Protection portion of the Illinois Insurance Code (215 Ill. Comp. Stat. 5/Art. XL),  Plaintiff and the Class suffered and will continue to suffer actual damages.  71.  Plaintiff repeats and re-alleges paragraphs 1 through 44 and 65 through 70 as if  fully set forth herein.    72.  Defendant’s violation of Article XL of the Insurance Information and Privacy  Protection portion of the Illinois Insurance Code (215 Ill. Comp. Stat. 5/Art. XL), resulted in  injury to Plaintiff and the Class.   73.  Article XL of the Insurance Information and Privacy Protection portion of the  Illinois Insurance Code was enacted in order to, inter alia, limit the disclosure of information  collected in connection with insurance transactions. 215 Ill. Comp. Stat. 5/1001.    74.  The statute was designed to protect the class of persons to which Plaintiff and the  Class members belong against the unauthorized disclosure of their PII.    75.  As a result of Defendant’s violation of Article XL of the Insurance Information  and Privacy Protection portion of the Illinois Insurance Code (215 Ill. Comp. Stat. 5/Art. XL),  Plaintiff and the Class suffered and will continue to suffer actual damages.  19  76.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.    77.  Defendant had a duty to exercise reasonable care and caution in storing and  maintaining Plaintiff’s and Class members’ PII.    78.  Defendant violated its duty by failing to adopt and maintain reasonable and  appropriate safeguards and security protocols to ensure that Plaintiff’s and Class members’ PII  was not disclosed to unauthorized third parties.    79.  Defendant’s wrongful actions and inaction constituted negligence.   80.  It was reasonably foreseeable that Defendant’s failure to exercise reasonable care  and caution in safeguarding and protecting Plaintiff’s and Class members’ PII would result in an  unauthorized third party gaining access to such information for an unlawful purpose.    81.   Plaintiff and Class members were (and continue to be) damaged as a direct and  proximate result of Defendant’s failure to secure and protect their PII.   82.  But for Defendant’s failure to exercise reasonable care, Plaintiff’s and the other  Class members’ PII would not have been stored on an unsecure Internet server and made  publicly available for approximately 16 months, and Plaintiff and Class members would not have  suffered damages relating to same.   83.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.    84.  Plaintiff and Class members placed their trust and confidence upon Defendant  with regard to the handling, maintenance, and disposition of their confidential PII. Therefore,  20  Defendant owed a fiduciary duty to Plaintiff and Class members to secure and protect the PII  with which it was entrusted.    85.  Defendant breached its fiduciary duty to Plaintiff and Class members by failing to  safeguard and ensure the confidentiality and security of Plaintiff’s and Class members’ PII.   86.  As a proximate result of Defendant’s breach of fiduciary duty, Plaintiff and Class  members suffered and will continue to suffer actual damages.  87.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.    88.  Plaintiff and members of the Class entered into contracts with Combined  Insurance; Combined Insurance received insurance premiums in exchange for providing  insurance coverage and its promises to protect their PII.   89.  Combined Insurance promised to protect Plaintiff’s and Class members’ PII in its  written “Privacy Pledge” to its customers. In a document titled “Our Privacy Pledge to You,”  Combined Insurance states that “we maintain physical, electronic and procedural safeguards that  comply with federal regulations to guard your personal information.” It also states that “we  restrict access to your personal information to those employees who need to know such  information.”   90.  Combined Insurance did not maintain physical, electronic and procedural  safeguards in compliance with federal regulations, including FCRA, and it did not restrict access  to Plaintiff’s and Class members’ personal information to those employees who need to know  such information, as Plaintiff’s and Class members’ PII was left unsecured and unprotected for  approximately 16 months on a server accessible to anyone with an Internet connection.  21   91.  Defendant’s failure to meet these promises and obligations in its “Privacy Pledge”  constitutes a breach of contract.    92.  As a result of Defendant’s breach of contract, Plaintiff and the Class suffered and  will continue to suffer actual damages.  93.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.   94.  Plaintiff pleads this count in the alternative to the breach of contract count.    95.  In order to sign up for Defendant’s insurance, Plaintiff and Class members  provided their PII to Defendant.   96.  In exchange for insurance coverage for Plaintiff and Class members, Defendant  received insurance premiums.    97.  By Plaintiff and Class members providing their PII and Defendant accepting their  PII and insurance premiums, the parties entered into implied contracts that Defendant would  safeguard and protect Plaintiff’s and Class members’ PII.   98.  Defendant breached the implied contract, because it failed to safeguard and  protect Plaintiff’s and Class members’ PII, as the PII was left unsecured and unprotected for  approximately 16 months on a server accessible to anyone with an Internet connection.   99.  As a result of Defendant’s breach of implied contract, Plaintiff and Class  members suffered and will continue to suffer actual damages.  BREACH OF CONTRACT   BREACH OF IMPLIED CONTRACT   BREACH OF FIDUCIARY DUTY   INVASION OF PRIVACY BY PUBLIC DISCLOSURE OF PRIVATE FACTS  107.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.   108.  Defendant’s failure to secure and protect Plaintiff’s and Class members’ PII  directly resulted in the public disclosure of such private information. For approximately 16  months, Plaintiff’s and Class members’ PII was openly posted on the Internet or otherwise freely  available to the public over the Internet.  23  109.  Plaintiff’s and Class members’ PII is not of a legitimate public concern; publicity  of their PII would be, is, and will continue to be offensive to reasonable people.  110.  Plaintiff and Class members were (and continue to be) damaged as a direct and  proximate result of Defendant’s invasion of their privacy by publicly disclosing their PII.   Plaintiff and the Class members are entitled to actual damages directly and/or proximately  caused by the public disclosure of private information, and nominal damages.  111.  Defendant’s wrongful actions and inaction (as described above) constituted (and  continue to constitute) an invasion of Plaintiff’s and Class members’ privacy by publicly  disclosing their PII.  NEGLIGENCE PER SE   NEGLIGENT VIOLATION OF THE FAIR CREDIT REPORTING ACT   NEGLIGENCE   UNJUST ENRICHMENT  100.  Plaintiff repeats and re-alleges paragraphs 1 through 44 as if fully set forth herein.  22  101.  Plaintiff pleads this count in the alternative to the breach of contract and breach of  implied contract counts.   102.  A monetary benefit was conferred on Defendant in that it was paid premiums for  the insurance policies under which Plaintiff and Class members were, and in some cases still are,  covered. A portion of the insurance premiums paid was to fund adequate, reasonable, and proper  measures of PII protection, which Defendant had a duty to provide but failed to provide, to the  detriment of Plaintiff and Class members.  103.  Defendant has received, and in some cases continues to receive, the payment of  insurance premiums for insurance coverage for Plaintiff and Class members.   104.  A portion of the insurance premiums paid were for the costs of data security and  management in accordance with the law and industry standards.    105.  It would be unjust for Defendant to retain the portion of the insurance premiums  paid for the costs of data security and management, because Defendant failed to secure and  protect Plaintiff’s and Class members’ PII in accordance with the law and industry standards.  106.  As a result of Defendant’s unjust enrichment, Plaintiff and the Class suffered and  will continue to suffer actual damages.  VIOLATION OF THE ILLINOIS INSURANCE CODE   WILLFUL VIOLATION OF THE FAIR CREDIT REPORTING ACT  