16.  On May 5, 2016 Kroger announced that Equifax systems had been subject  to the Data Breach, and that an unknown number of current and former associates’ W-2s  had been obtained by unauthorized persons. The PII in employee’s W-2s includes  names, addresses, Social Security numbers, alternative identification numbers, wage  information, employment information, and other personal information.   17.  Defendant Equifax has yet to acknowledge the breach, or notify victims of  the Data Breach.     18.  According to a Kroger spokesman, other companies which rely upon  Equifax for W-2 services may have also been subject to the Data Breach, as the  inadequate security measures, discussed infra, were the standard Equifax operating  method.3   B.  Equifax Promised to Protect Its Customers’ Employees’ PII, but  Maintained Inadequate Data Security    20.  With Regard to W-2s in particular, prior to the Data Breach, Equifax  explained “[a]s W-2 data is sensitive and subject to federal regulations, every precaution  is taken to ensure both security and accuracy.  Equifax performs extensive testing and  reviews before distribution.”6  Equifax further reassured customers that “Equifax makes  it easy to manage administration related to W-2s through web Manager.  This user- friendly online tool is seamlessly integrated into all Equifax services, and can only be  accessed by authorized staff members with a valid user ID and PIN.”7 (emphasis  added)   21.  Prior to the Data Breach, Equifax promised its customers and everyone  about whom it collects PII that it would reasonably protect their PII.  Equifax’s privacy  policy stated, in relevant part: “We have built our reputation on our commitment to  deliver reliable information to our customers (both businesses and consumers) and to  protect the privacy and confidentiality of personal information about consumers.”8     23.  Despite that admonition, Defendant set default passwords and PIN numbers  for its W-2 services as the last four digits of individual’s social security numbers and the  four digit year of birth for those individuals.     24.  Plaintiff’s and Class Members’ PII (in the form of at a minimum their W- 2s) was disclosed to Equifax, and Equifax compiled, maintained, and furnished Class  Members’ PII, in connection with Class Members’ acquisition of services, through  Defendant’s “The Work Number” service.  Equifax is allowed to perform such services,  involving such sensitive information, only if it adheres to the requirements of laws  meant to protect the privacy of such information, such as the Gramm-Leach-Bliley Act  (“GLBA”).  Equifax’s maintenance, use, and furnishing of such PII is and was intended  to affect Plaintiff and other Class Members, and the harm caused by disclosure of that  PII in the Data Breach was entirely foreseeable to Equifax.    25.  Equifax touts itself as an industry leader in data breach security and often  promotes the importance of data breach prevention.  Equifax offers services directly  targeted to assisting businesses who have encountered a data breach.10     26.  Equifax expressly advises businesses which have lost customer data to  “Quickly Notify Those Affected”; “Provide Personalized Communication”; and “Offer  Credit Protection.”11  Despite those admonitions, to date, Equifax has not reached out to  affected employees, and has not provided personalized communications to those  affected, or offered credit protection to those whose W-2s were compromised by the  Data Breach.    C.  Impact of the Data Breach    28.  The exposure of Plaintiff’s and Class Members’ Social Security numbers in  particular poses serious problems.  Criminals frequently use Social Security numbers to  create false bank accounts, file fraudulent tax returns, and incur credit in the victim’s  name.  Neal O’Farrell, a security and identity theft expert for Credit Sesame calls a  Social Security number “your secret sauce,” that is “as good as your DNA to hackers.”13   Even where data breach victims obtain a new Social Security number, the Social  Security Administration warns “that a new number probably will not solve all []  problems . . . and will not guarantee [] a fresh start.”14  In fact, “[f]or some victims of  identity theft, a new number actually creates new problems.”  One of those new  problems is that a new Social Security number will have a completely blank credit  history, making it difficult to get credit for a few years unless it is linked to the old  compromised number.    30.  The risks that Plaintiff and Class Members bear as a result of the Data  Breach cannot be fully mitigated by credit monitoring because it can only help detect,  but will not prevent, the fraudulent use of Plaintiff’s and Class Members’ PII.  Instead,  Plaintiff and Class Members will need to spend time and money to protect themselves.   For instance, credit reporting agencies impose fees for credit freezes in certain states.  In  addition, while credit reporting agencies offer consumers one free credit report per year,  consumers who request more than one credit report per year from the same credit  reporting agency (such as Equifax) must pay a fee for the additional report.  Such fees  constitute out-of-pocket costs to Plaintiff and Class Members.  D.  Equifax Was Required to Investigate and Provide Timely and  Adequate Notification of the Data Breach under Federal Regulations   34.  Further, “[w]hen a financial institution becomes aware of an incident of  unauthorized access to sensitive customer information, the institution should conduct a  reasonable investigation to promptly determine the likelihood that the information has  been or will be misused.  If the institution determines that misuse of its information  about a customer has occurred or is reasonably possible, it should notify the affected  customer as soon as possible.” See id.   35.  Credit bureaus are “financial institutions” for purposes of the GLBA, and  are therefore subject to its provisions.  See TransUnion LLC v. F.T.C., 295 F.3d 42, 48  (D.C. Cir. 2002).  Under Regulation Y promulgated by the Federal Reserve Board, Bank  Holding Companies and Change in Bank Control, “credit bureau services15” are “so  closely related to banking or managing or controlling banks as to be a proper incident  thereto.”  Since Equifax is a credit bureau and performs credit bureau services, it  qualifies as a financial institution for purposes of the GLBA.   37.  Upon information and belief, Equifax failed to “develop, implement, and  maintain a comprehensive information security program” with “administrative,  technical, and physical safeguards” that were “appropriate to [its] size and complexity,  the nature and scope of [its] activities, and the sensitivity of any customer information at  issue.” This includes, but is not limited to, Equifax’s failure to implement and maintain  adequate data security practices to safeguard Class Members’ PII; (b) failing to detect  the Data Breach in a timely manner; and (c) failing to disclose that Defendants’ data  security practices were inadequate to safeguard Class Members’ PII.   38.  Upon information and belief, Equifax also failed to “develop and  implement a risk-based response program to address incidents of unauthorized access to  customer information in customer information systems” as mandated by the GLBA.   This includes, but is not limited to, Equifax’s failure to notify appropriate regulatory  agencies, law enforcement, and the affected individuals themselves of the Data Breach  in a timely and adequate manner.    39.  Equifax has also failed to notify affected customers as soon as possible  after it became aware of unauthorized access to sensitive customer information, and has  failed to communicate directly with Class Members to date.  E.  Equifax Failed to Comply with FTC Requirements   40.  According to the FTC, the failure to employ reasonable and appropriate  measures to protect against unauthorized access to confidential consumer data  constitutes an unfair act or practices prohibited by Section 5 of the FTC Act, 15 U.S.C.  § 45.   42.  The FTC also has published a document entitled “FTC Facts for  Business” which highlights the importance of having a data security plan, regularly  assessing risks to computer systems, and implementing safeguards to control such  risks.   43.  And the FTC has issued orders against businesses that failed to  employ reasonable measures to secure customer data. These orders provide further  guidance to businesses with regard to their data security obligations.   44.  By failing to have reasonable data security measures in place,  Equifax engaged in an unfair act or practice within the meaning of Section 5  of the FTC Act.  45.  Plaintiff brings all claims as class claims under Federal Rule of Civil  Procedure 23(b)(1), (b)(2), (b)(3), and (c)(4).  A.   Nationwide Class     46.  Plaintiff brings the negligence, negligence per se claims and Declaratory  and Injunctive Relief (Counts I, II and IV) on behalf of a proposed nationwide class  (“Nationwide Class”), defined as follows:  All natural persons and entities in the United States whose  personally identifiable information was acquired by unauthorized  persons in the data breach announced by Kroger on May 5, 2016.   B.  Georgia Subclass   48.  Plaintiff also brings the negligence and negligence per se claims (counts III  and IV) separately on behalf of the Georgia Subclass, in the alternative to bringing those  claims on behalf of the Nationwide Class.   49.  Except where otherwise noted, “Class Members” shall refer to members of  the Nationwide Class and the Georgia Subclass, collectively.   50.  Excluded from the Nationwide Class and the Statewide Subclass are  Defendants and their current employees, as well as the Court and its personnel presiding  over this action.   51.  The Nationwide and Statewide Subclass meet the requirements of Federal  Rules of Civil Procedure 23(a) and 23(b)(1), (b)(2), and (b)(3) for all of the reasons set  forth in Paragraphs 39-47:   52.  Numerosity: The Nationwide and Statewide Subclass are so numerous that  joinder of all members is impracticable. Kroger employees more than 431,000 people,  who may be subject to the Data Breach.16 The parties will be able to identify each  member of the Nationwide Class and Statewide Subclass after Defendants’ document  production and/or related discovery.   54. Typicality: All Plaintiff’s claims are typical of the claims of the  Nationwide Class, and each Plaintiff’s claims are typical of the claims of the Statewide  Subclass.    55. Adequacy: Plaintiff will fairly and adequately protect the interests  of the Nationwide Class and Statewide Subclasses.  Plaintiff has no interests that are  adverse to, or in conflict with, the Class Members. There are no claims or defenses that  are unique to Plaintiff. Likewise, Plaintiff has retained counsel experienced in class  action and complex litigation, including data breach litigation, that have sufficient  resources to prosecute this action vigorously.    56. Predominance: The proposed action meets the requirements of  Federal Rule of Civil Procedure 23(b)(3) because questions of law and fact common to  the Nationwide Class and Statewide Subclass predominate over any questions which  may affect only individual Class Members in any of the proposed classes, including  those listed in paragraph 40, supra.   58. Absent a class action, the majority of Class Members would find the  cost of litigating their claims prohibitively high and would have no effective remedy.   59. Risks of Prosecuting Separate Actions: Plaintiff’s claims also meet  the requirements of Federal Rule of Civil Procedure 23(b)(1) because prosecution of  separate actions by individual Class Members would create a risk of inconsistent or  varying adjudications that would establish incompatible standards for Equifax. Equifax  continues to maintain the PII of the Class Members and other individuals, and varying  adjudications could establish incompatible standards with respect to: Defendants’ duty  to protect individuals’ PII; and whether the injuries suffered by Class Members are  legally cognizable, among others. Prosecution of separate actions by individual Class  Members would also create a risk of individual adjudications that would be dispositive  of the interests of other Class Members not parties to the individual adjudications, or  substantially impair or impede the ability of Class Members to protect their interests.   60. Injunctive Relief: In addition, Defendants have acted and/or refused  to act on grounds that apply generally to the Nationwide and Statewide Subclass,  making injunctive and/or declaratory relief appropriate with respect to the classes under  Federal Rule of Civil Procedure 23(b)(2). Defendants continue to (1) maintain the PII of  Class Members, and (2) fail to adequately protect their PII.   61. Certification of Particular Issues:  In the alternative, the  Nationwide and Statewide Subclass may be maintained as class actions with respect to  particular issues, in accordance with Fed. R. Civ. P. 23(c)(4).  63.  Equifax owed a duty to Plaintiff and Class Members, arising from the  sensitivity of the information and the foreseeability of its data safety shortcomings  resulting in an intrusion, to exercise reasonable care in safeguarding their sensitive  personal information.  This duty included, among other things, designing, maintaining,  monitoring, and testing Equifax’s security systems, protocols, and practices to ensure  that Class Members’ information adequately secured from unauthorized access.   64.  Equifax’s privacy policy acknowledged Equifax’s duty to adequately  protect Class Member’s PII.   65.  Equifax owed a duty to Class Members to implement intrusion detection  processes that would detect a data breach in a timely manner.   66.  Equifax also had a duty to delete any PII that was no longer needed to  serve client needs.   67.  Equifax owed a duty to disclose the material fact that its data security  practices were inadequate to safeguard Class Member’s PII.   68.  Equifax also had independent duties under state laws that required Equifax  to reasonably safeguard Plaintiff’s and Class Members’ PII and promptly notify them  about the Data Breach.   69.  Equifax had a special relationship with Plaintiff and Class Members from  being entrusted with their PII, which provided an independent duty of care.  Plaintiff’s  and other Class Members’ willingness to entrust Equifax with their PII was predicated  on the understanding that Equifax would take adequate security precautions.  Moreover,  Equifax had the ability to protect its systems and the PII it stored on them from attack.   70.  Equifax’s role to utilize and purportedly safeguard Plaintiff’s and Class  Members’ PII presents unique circumstances requiring a reallocation of risk.   72.  But for Equifax’s breach of its duties, Class Member’s PII would not have  been accessed by unauthorized individuals.    73.  Plaintiff and Class Members were foreseeable victims of Equifax’s  inadequate data security practices.  Equifax knew or should have known that a breach of  its data security systems would cause damages to Class Members.    74.  Equifax’s negligent conduct provided a means for unauthorized intruders to  obtain Plaintiff’s and the Nationwide Class Member’s PII and consumer reports.   75.  As a result of Equifax’s willful failure to prevent the Data Breach, Plaintiff  and Class Members suffered injury, which includes but is not limited to exposure to a  heightened, imminent risk of fraud, identity theft, and financial harm.  Plaintiff and  Class Members must more closely monitor their financial accounts and credit histories  to guard against identity theft.  Class Members also have incurred, and will continue to  incur on an indefinite basis, out-of-pocket costs for obtaining credit reports, credit  freezes, credit monitoring services, and other protective measures to deter or detect  identity theft. The unauthorized acquisition of Plaintiff’s and Class Member’s PII has  also diminished the value of the PII.     76.  The damages to Plaintiff and the Class Members were a proximate,  reasonably foreseeable result of Equifax’s breaches of its duties.   77.  Therefore, Plaintiff and Class Members are entitled to damages in an  amount to be proven at trial.  78.  Plaintiff incorporates paragraphs 1-61 as if fully set forth herein.   80.  Equifax violated Section 5 of the FTC Act by failing to use reasonable  measures to protect PII and not complying with applicable industry standards.   Equifax’s conduct was particularly unreasonable given the nature and amount of PII it  obtained and stored and the foreseeable consequences of a data breach in their systems,  including specifically the immense damages that would result to consumers.     81.  Equifax’s violation of Section 5 of the FTC Act constitutes negligence per  se.   82.  Members of the Class and Subclass are within the class of persons Section  5 of the FTC Act was intended to protect as they are individuals engaged in trade and  commerce, and bear the risk associated with defendant’s failure to properly secure their  97.  Plaintiff incorporates paragraphs 1-61 as if fully set forth herein.   98.  Under Ga. Code Ann. § 10-1-912(a), “[a]ny information broker … that  maintains computerized data that includes personal information of individuals shall give  notice of any breach of the security of the system following discovery or notification of  the breach in the security of the data to any resident of this state whose unencrypted  personal information was, or is reasonably believed to have been, acquired by an  unauthorized person. The notice shall be made in the most expedient time possible and  without unreasonable delay … .”   A.  The Data Breach Compromised the PII of Thousands of Consumers   NEGLIGENCE  (On Behalf of the Nationwide Class and the Statewide Subclass)   NEGLIGENCE PER SE  (On behalf of the Nationwide Class and the Statewide Subclass)   VIOLATION OF THE GEORGIA SECURITY BREACH NOTIFICATION ACT  Ga. Code Ann. § 10-1-912, et seq.  (On Behalf of the Georgia Subclass)  