1.    Rutter’s Violated PCI Data Security Standards   14.  Rutter’s is an operator of a large chain of convenience stores and gas  stations.    16.  Thus, Rutter’s did not discover the Data Breach for nearly eighteen  months and did not notify consumers of the Data Breach for more than a month after  discovering it.    18.  Rather than proactively taking steps to help consumers deal with and  avoid damage from the Data Breach, Rutter’s placed the burden on consumers to  protect themselves:   It is always advisable to review your payment card statements for any  unauthorized activity. You should immediately report any unauthorized  charges to your card issuer because payment card rules generally  provide that cardholders are not responsible for unauthorized charges  reported in a timely manner. The phone number to call is usually on the  back of your payment card. Please see the section below for information  on additional steps you may take.7   2.   Rutter’s Violated the FTC Act   20.  Thus, rather than providing meaningful assistance to consumers to help  deal with the fraud that has and will continue to result from the Data Breach, Rutter’s  simply told them to carefully monitor their own accounts and remain “vigilant” for  fraud. In contrast to what is and has been frequently made available to consumers in  recent data breaches, Rutter’s has not offered or provided any monitoring service or  fraud insurance to date.    22.  Rutter’s failed to properly safeguard Class Members’ Card  Information, allowing malware to be present on—and cybercriminals to access  Payment Card Information from—its systems for as many as nine months  completely undetected. Rutter’s also failed to properly monitor its systems. Had it  properly done so, Rutter’s would have discovered the malware much sooner than  eighteen months after the breach began. Indeed, Rutter’s reported that it “received a  report from a third party” of the Data Breach. Had the unnamed third-party not  notified Rutter’s of the Data Breach, it presumably would have gone undetected even  longer than it did.    23.  Rutter’s had a continuing duty pursuant to common law, industry  standards, card network rules, and representations made in its own privacy policy to  keep consumers’ Card Information confidential and to protect it from unauthorized  access.  B.  Rutter’s Was on Notice of a Significant Risk of a Data Breach    26.  The Visa warning specified that hackers were placing “malware” onto  card processing systems. Notably, Rutter’s reported that malware was placed on its  gas pumps.11   27.  The Visa warning also specified that hackers were attacking gas station  merchants that had not yet upgraded to chip technology. Although Rutter’s reported  that it utilizes chip readers at POS terminals inside some of its stores, its notice is  silent as to its implementation, and use of, chip readers at its gas pumps. The Visa  warning placed Rutter’s on further notice of an unusually high risk of a data breach.  Rutter’s failed to improve its cardholder data security despite these known critical  risks.   C.  Previous Credit Card Data Breach at Rutter’s   29.  These breaches, coupled with numerous others affecting other retail  companies, put Rutter’s on notice of the importance of data security, the fact that  thieves were aggressively seeking stolen credit card information from Rutter’s, and  the harm that could result from weak data security. Despite these events, Rutter’s  nevertheless failed to adopt adequate data security governing its credit and debit card  transactions.  D.  Rutter’s Privacy Policy   30.  Rutter’s Privacy Policy stated that data security is important to the  Company, and that it is committed to safeguarding consumer data:  HOW we protect and RETAIN your information  We and our Service Providers take security measures to protect  against unauthorized access to or unauthorized alteration,  disclosure, or destruction of data. These include firewalls and  encryption, internal reviews of our Service Providers data collection,  storage and processing practices, and security measures, as well as  physical security measures to guard against unauthorized access to  systems.13   32.  Rutter’s breached its duties, obligations, and promises by, inter alia,  failing to:  (a) adequately safeguard consumers’ Card Information;  (b) maintain an adequate data security environment to reduce the risk of a  data breach;  (c) properly monitor its data security systems for existing intrusions and  weaknesses;  (d) perform penetration tests to determine the strength of its payment card  processing systems;  (e) properly train its information technology staff on matters relevant to  cardholder data security; and  (f) retain outside vendors to periodically test its payment card processing  systems.   33.  There is an extensive network of financial institutions, card-issuing  banks, and card-processing companies involved in credit and debit card transactions.  Card networks have issued detailed rules and standards governing the basic  protective measures that merchants like Rutter’s must take to ensure that payment  card information is properly safeguarded.    35.  PCI DSS establishes detailed comprehensive requirements for  satisfying each of the following twelve “high-level” mandates:14   36.  As noted in the chart, PCI DSS required Rutter’s to “protect all systems  against malware.”  Rutter’s failed to do so. Rutter’s specified that the hacker(s)  placed “malware” on Rutter’s payment processing servers.  14  Payment Card Industry (PCI) Data Security Standard, PCI Security Standards  Council,  May  2018,  at  p.  5,  available  at  https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-  37.  PCI DSS also required Rutter’s to “[t]rack and monitor all access to  network resources.”  Rutter’s failed to do so. The hacker(s) had access to Rutter’s  system for as long as nine months, illustrating that Rutter’s had materially deficient  tracking and monitoring systems in place.   38.  Upon information and belief, Rutter’s violated numerous other  provisions of the PCI DSS, including subsections underlying the chart above. Those  deficiencies will be revealed during discovery with the assistance of expert  witnesses.    39.  PCI DSS sets the minimum level of what must be done, not the  maximum. While PCI compliance is an important first step in securing cardholder  data, it is not sufficient on its own to protect against all breaches, nor does it provide  a safe harbor against civil liability for a data breach.   40.  At all relevant times, Rutter’s was well-aware of its PCI DSS  obligations to protect cardholder data. Rutter’s was an active participant in the  payment card networks as it collected and likely transmitted thousands (or more) of  sets of payment card data per day.    42.  The Federal Trade Commission (“FTC”) has held that the failure to  employ reasonable measures to protect against unauthorized access to confidential  consumer data constitutes an unfair act or practice prohibited by Section 5 of the  Federal Trade Commission Act (“FTCA”), 15 U.S.C. §45.   44.  The FTC has issued orders against businesses for failing to employ  reasonable measures to safeguard customer data. The orders provide further public  guidance to businesses concerning their data security obligations.   45.  Rutter’s knew or should have known about its obligation to comply  with the FTC Act regarding data security.   46.  Rutter’s misconduct violated the FTC Act, led to the Data Breach, and  caused harm to Plaintiff and Class Members.  F.  Misuse of the Stolen Data Has Begun   47.  Widespread misuse of the stolen cardholder data has already begun.   48.  Plaintiff has suffered at least one fraudulent charge on his payment  card, as discussed in detail above.   50.  The Data Breach is particularly alarming given that it reportedly lasted  as long as nine months. Each Plaintiff and the Class Members have been damaged  by the compromise of their Card Information in the Data Breach.   51.  Class Members also face a substantial and imminent risk of fraudulent  charges on their Payment Cards. Criminals carried out the Data Breach and stole the  Card Information with the intent to use it for fraudulent purposes and/or to sell it.   52.  Plaintiff and Class Members have already experienced fraudulent credit  and debit card purchases, and other Class Members will experience fraud going  forward.   54.  Class Members also suffered a “loss of value” of their credit and debit  card information when it was stolen by the hacker in the Data Breach. A robust  market exists for stolen card information, which is sold on the dark web at specific  identifiable prices. This market serves as a means to determine the loss of value to  Class Members.    55.  Class Members also suffered “benefit of the bargain” damages. Class  Members overpaid for goods that should have been – but were not – accompanied  by adequate data security. Part of the price Class Members paid to Rutter’s was  intended to be used to fund adequate data security. Class Members did not get what  they paid for.   56.  Class Members have spent and will continue to spend substantial  amounts of time monitoring their payment card accounts for fraud, disputing  fraudulent transactions, and reviewing their financial affairs more closely than they  otherwise would have done but for the Data Breach. Class Members will also spend  time obtaining replacement cards and resetting automatic payment links to their new  cards. These efforts are burdensome and time-consuming.   59.  The risk of fraud will persist for years. Identity thieves often hold stolen  data for months or years before using it, to avoid detection. Also, the sale of stolen  information on the dark web may take months or more to reach end-users, in part  because the data is often sold in small batches as opposed to in bulk to a single buyer.   60.  Thus, Class Members must vigilantly monitor their financial accounts  for months or years to come.  H.  Class Members Face a Risk of Identity Theft Beyond Just Credit  and Debit Card Fraud    63.  Thus, Rutter’s acknowledges that Class Members face a risk of identity  theft beyond just fraudulent credit and debit card transactions.    64.  Rutter’s has taken no affirmative steps—beyond notifying consumers  of the Data Breach—to protect against these broad-based types of fraud, such as  offering free credit monitoring and identity theft insurance to all customers whose  card information was stolen in the Data Breach. Rutter’s efforts are wholly  insufficient to combat the indefinite undeniable risk of fraud and identity theft.   V.  66.  Excluded from the Classes are Rutter’s executive officers, and the judge  to whom this case is assigned.   67.  Numerosity. The Classes are each so numerous that joinder of all  members is impracticable. On information and belief, the Nationwide Class consists  of hundreds to thousands or more individuals, and the Pennsylvania Class consists  of hundreds to thousands or more individuals. These estimates are based on the fact  that the Data Breach affected most (if not all) of Rutter’s 72 convenience store  locations, as well as its gas pumps, for a nine-month period.    69.  Typicality. Plaintiff’s claims are typical of the claims of all Class  Members because Plaintiff, like other Class Members, suffered a theft of his Card  Information in the Data Breach.   70.  Adequacy of Representation. Plaintiff will fairly and adequately protect  the interests of the Classes. Plaintiff has retained competent and capable counsel  with significant experience in complex class action litigation, including data breach  class actions. Plaintiff and his counsel are committed to prosecuting this action  vigorously on behalf of the Classes. Plaintiff’s counsel has the financial and  personnel resources to do so. Neither Plaintiff nor his counsel have interests that are  contrary to, or that conflict with, those of the Classes.   71.  Predominance. Rutter’s has engaged in a common course of conduct  toward all Class Members. The common issues arising from Rutter’s conduct  predominate over any issues affecting just individual Class Members. Adjudication  of the common issues in a single action has important and desirable advantages of  judicial economy.   73.  Rutter’s has acted on grounds that apply generally to the Classes as a  whole, so that injunctive relief is appropriate on a class-wide basis pursuant to Fed.  R. Civ. P. 23(b)(2).  VI.  74.  Plaintiff re-alleges and incorporates by reference all preceding  allegations as if fully set forth herein.   75.  Rutter’s obtained Class Members’ Payment Card Information in  connection with Class Members’ purchases at Rutter’s stores and gas pumps.   77.  Rutter’s owed a duty of care to Plaintiff and Class Members to provide  data security consistent with the various requirements and rules discussed above.   78.  Rutter’s duty of care arose as a result of, among other things, the special  relationship that existed between Rutter’s and its customers. Rutter’s was in position  to ensure that its systems were sufficient to protect against the foreseeable risk that  a data breach could occur, which would result in substantial harm to consumers.    79.  Also, Rutter’s had a duty to employ reasonable security measures under  Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, which prohibits  “unfair . . . practices in or affecting commerce,” including, as interpreted and  enforced by the FTC, failing to use reasonable measures to protect confidential  consumer data.   80.  Rutter’s duty to use reasonable care in protecting cardholder data arose  not only as a result of the statutes and regulations described above, but also because  Rutter’s is bound by industry standards and PCI DSS rules to protect Card  Information.   82.  Rutter’s breached its duties, and thus was negligent, by failing to use  reasonable measures to protect cardholder information. Rutter’s negligent acts and  omissions include, but are not limited to, the following:  (a) Failing to adopt, implement, and maintain adequate security measures to  safeguard Card Information;  (b) Failing to adequately monitor the security of Rutter’s Payment Card  processing network;  (c) Allowing unauthorized access to Class Members’ sensitive Card  Information;  (d) Failing to detect in a timely manner that Class Members’ Card  Information had been compromised; and  (e) Failing to timely notify Class Members about the Data Breach so that  they could take appropriate steps to mitigate the risk of identity theft and  other damages.   83.  It was foreseeable to Rutter’s that a failure to use reasonable measures  to protect Card Information could result in injury to consumers. Further, actual and  attempted breaches of data security were reasonably foreseeable to Rutter’s given  the known frequency of Payment Card data breaches: (i) in the retail industry in  general, (ii) at gas stations in particular, and (iii) at Rutter’s operations specifically.   84.  Plaintiff and Class Members suffered various types of damages as  alleged above.   86.  Plaintiff and Class Members are entitled to compensatory and  consequential damages suffered as a result of the Data Breach.   87.  Plaintiff and Class Members are also entitled to injunctive relief  requiring Rutter’s to (among other things): (i) strengthen its data security systems  and monitoring procedures; (ii) submit to future annual audits of those systems; and  (iii) provide several years of free credit monitoring and identity theft insurance to all  Class Members.   88.  Plaintiff realleges and incorporates all previous allegations as though  fully set forth herein.   89.  As alleged above, pursuant to the FTC Act, 15 U.S.C. § 45, Rutter’s  had a duty to provide fair and adequate computer systems and data security practices  to safeguard Plaintiff’s and Class Members’ Card Information.   91.  Rutter’s violated Section 5 of the FTC Act (and similar state statutes)  by failing to use reasonable measures to protect Card Information and not complying  with applicable industry standards, including PCI DSS, as described in detail herein.  Rutter’s conduct was particularly unreasonable given the nature and amount of Card  Information it collected and stored and the foreseeable consequences of a data  breach, including, specifically, the immense damages that would result to consumers  and financial institutions.   92.  The harm that has occurred is the type of harm the FTC Act (and similar  state statutes) is intended to guard against. Indeed, the FTC has pursued numerous  enforcement actions against businesses that, as a result of their failure to employ  reasonable data security measures and avoid unfair and deceptive practices, caused  the same harm as that suffered by Plaintiff and the Class.   93.  Rutter’s had a duty to Plaintiff and Class Members to implement and  maintain reasonable security procedures and practices to safeguard Plaintiff’s and  Class Members’ Card Information.   95.  Rutter’s violation of Section 5 of the FTC Act (and similar state  statutes) and its failure to comply with applicable laws and regulations constitutes  negligence per se.   96.  But for Rutter’s wrongful and negligent breach of its duties owed to  Plaintiff and Class Members, Plaintiff and Class Members would not have been  injured.   97.  The injury and harm suffered by Plaintiff and Class Members was the  reasonably foreseeable result of Rutter’s breach of its duties. Rutter’s knew or should  have known that it was failing to meet its duties and that its breach would cause  Plaintiff and Class Members to suffer the foreseeable harms associated with the  exposure of their Card Information.   98.  Had Plaintiff and Class Members known that Rutter’s did and does not  adequately protect customer Card Information, they would not have made purchases  at Rutter’s stores and gas pumps.   A.  The Rutter’s Data Breach   NEGLIGENCE  (On Behalf of Plaintiff, the Nationwide Class,   and, in the alternative, the Pennsylvania Class)   Negligence Per Se  (On Behalf of Plaintiff, the Nationwide Class,   and, in the alternative, the Pennsylvania Class)  