(Breach of Implied Contract)   (Negligence)   (State Consumer Protection Laws)    (State Data Breach Notification Statutes)   16.  Based on a public notice announcing the breach Trump published on September  29, 2015, and upon information and belief, from at least May 19, 2014 to June 2, 2015, unauthorized  malware had access to payment card information as it was inputted into payment card systems at the  Properties.  This resulted in the compromise of payment card data (including payment card account  number, card expiration date, and security code) of individuals who used a payment card at the  Properties.  For transactions at certain Properties, cardholder name and other PII may also have been  compromised.   17.  According to Trump, months elapsed between the time Consumer Plaintiffs’  and Class members’ PII was improperly accessed and the time Defendants disseminated notice of  the unauthorized PII access.  Defendants’ unwarranted delay in notifying Consumer Plaintiffs and  Class members about the unauthorized PII disclosure deprived them of the opportunity to take  effective remedial action to reduce the short and long term risk of further fraudulent activity.  II.  The Breach Was Entirely Avoidable and Foreseeable by Defendants.    19.  These security flaws and other infirmities were explicitly outlined by Visa, as  early as 2009, when it issued a Data Security Alert outlining the threat of RAM scraper malware.2   The report instructs companies to “[s]ecure remote access connectivity,” “[i]mplement a secure  network configuration, including egress and ingress filtering to only allow the ports/services  necessary to conduct business” (i.e., segregate networks), “actively monitor logs of network  components, including IDS [intrusion detection systems] and firewalls for suspicious traffic,  particularly outbound traffic to unknown addresses,” “[e]ncrypt cardholder data anywhere it is being  stored and [] implement[] a data field encryption solution to directly address cardholder data in  transit” and “[w]ork with your payment application vendor to ensure security controls are in place  to prevent unauthorized modification to the payment application configuration.”   20.  Despite the simplicity of these security flaws and Visa’s warning about their  existence and potential danger, Defendants failed to take any corrective action and instead neglected  their network security and failed to protect Consumer Plaintiffs and the Class.   22.  All merchants that accept customer payments via payment cards, including  Defendants, are obligated and required to comply with the Payment Card Industry Data Security  Standards (the “PCI DSS”).  How to Be Compliant: Getting Started with PCI Data Security Standard  Compliance, PCI SSC, available at. pcisecuritystandards.org/merchants/how_to_be_compliant.php  (last visited June 24, 2015) (stating “[i]f you are a merchant that accepts payment cards, you are  required to be complaint with the PCI [DSS].”).  Compliance with the PCI DSS is common practice  in the retail industry.   23.  The PCI DSS, among other things, mandates merchants to protect cardholder  data, PCI DSS v. 3.0 at 34 (Nov. 2013),3 requires merchants to install and maintain firewalls, id. at  19, forbids merchants from using default settings and passwords for applications and devices, id. at  28,  requires merchants to segment cardholder data, id. at 61, and requires merchants to identify and  authenticate their system users.  Id. at 64.   24.  To adhere to the PCI DSS, a merchant must, inter alia:  First, Assess -- identify cardholder data, take an inventory of your IT assets and business processes  for payment card processing, and analyze them for vulnerabilities that could expose cardholder data.  Second, Remediate -- fix vulnerabilities and do not store cardholder data unless you need it. Third,  Report -- compile and submit required remediation validation records (if applicable), and submit  compliance reports to the acquiring bank and card brands you do business with.  (emphasis in original).  How to Be Compliant: Getting Started with PCI Data Security Standard  Compliance,  PCI  51.  Certification of Consumer Plaintiffs’ claims for class-wide treatment is  appropriate because Consumer Plaintiffs can prove the elements of their claims on class-wide bases  using the same evidence as would be used to prove those elements in individual actions alleging the  same claims.   52.  The members of the Classes are so numerous that joinder of all members of the  Classes is impracticable.  Consumer Plaintiffs are informed and believe that the proposed Classes  contain thousands of purchasers who used payment cards to complete purchases at Defendants’  Properties who have been damaged by Defendants’ conduct as alleged herein. The precise number  of Class members is unknown to Consumer Plaintiffs, but may be ascertained from Defendants’  records.   54.  Defendants engaged in a common course of conduct giving rise to the claims  asserted by Consumer Plaintiffs, on behalf of themselves and the other Class members.  Individual  questions, if any, pale by comparison, in both quality and quantity, to the numerous common  questions that dominate this action.   56.  Consumer Plaintiffs will fairly and adequately protect the interests of the  members of the Classes, have retained counsel experienced in complex consumer class action  litigation, and intend to prosecute this action vigorously.  Consumer Plaintiffs have no adverse or  antagonistic interests to those of the Classes.   57.  A class action is superior to all other available means for the fair and efficient  adjudication of this controversy.  The damages or other financial detriment suffered by individual  Class members are relatively small compared to the burden and expense that would be entailed by  individual litigation of their claims against Defendants.  It would thus be virtually impossible for the  Class members, on an individual basis, to obtain effective redress for the wrongs done to them.   Individualized litigation would create the danger of inconsistent or contradictory judgments arising  from the same set of facts and would also increase the delay and expense to all parties and the courts.   By contrast, the class action device provides the benefits of adjudication of these issues in a single  proceeding, ensures economies of scale and comprehensive supervision by a single court, and  presents no unusual management difficulties under the circumstances here.   58.  Consumer Plaintiffs seek preliminary and permanent injunctive and equitable  relief on behalf of the Classes, preventing Defendants from further engaging in the acts described  and requiring Defendants to provide full restitution to Consumer Plaintiffs and the other Class  members.   59.  Unless the Classes are certified, Defendants will retain monies received as a  result of their conduct that were taken from Consumer Plaintiffs and the other Class members.   Unless Class-wide injunctions are issued, Defendants will continue to commit the violations alleged,  and the members of the Classes and the general public will continue to be deceived and injured.   61.  Consumer Plaintiffs incorporate by reference and reassert all previous  paragraphs.   62.  Consumer Plaintiffs and members of the Classes are consumers who used their  credit and/or debit cards to purchase products from Defendants, primarily for personal, family or  household purposes.   63.  Defendants engaged in the conduct alleged above in transactions intended to  result, and which did result, in the sale of goods and services to consumers, including Consumer  Plaintiffs and the Class.     64.  This course of conduct also affects trade and commerce, nationally and in  Illinois.  Defendants’ actions and/or inactions regarding their failure to adequately protect the PII of  Consumer Plaintiffs and the Class constitute deceptive acts and unfair practices and have a direct  and substantial affect in Illinois and throughout the United States.   65.  Defendants’ conduct as alleged herein, including without limitation,  Defendants’ failure to maintain reasonable and adequate computer systems and data security  practices, Defendants’ fraudulent and deceptive omissions and/or misrepresentations regarding the  security measures put in place to protect the PII of Consumer Plaintiffs and the Class and the lack  of efficacy of these security measures, Defendants’ failure to timely and accurately disclose the  Breach to Consumer Plaintiffs and the Class, and Defendants’ continued acceptance of credit and  debit card information as payment for goods and services after Defendants knew or should have  known of the Breach’s occurrence and before Defendants fixed the problems that allowed for the  Breach and purged their systems of the malicious hacker software, constitute unfair methods of  competition and unfair, deceptive, fraudulent, unconscionable and/or unlawful acts or practices in  violation of The Illinois Consumer Fraud and Deceptive Trade Practices Act, 815 Ill. Stat. § 505/2,  et seq., and the Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Stat. § 510/2(a)(5), (7) and  (12), et seq., as well as the similar laws of the various other states as they may appear.   67.  As a result, Defendants’ conduct damaged Consumer Plaintiffs and the other  members of the Class, who would not have otherwise completed credit and/or debit card  purchases/transactions at Defendants’ Properties, by exposing their information to third-party  hackers.    68.  Consumer Plaintiffs bring this action on behalf of themselves and all similarly  situated persons for the requested relief and for the public benefit at large in order to promote  truthful, honest and non-deceptive business practices, which will allow consumers to make informed  purchasing decisions and to protect, Consumer Plaintiffs, members of the Class and the public from  Defendants’ unfair, deceptive, fraudulent, unconscionable and/or unlawful practices and methods of  competition.  Defendants’ conduct as alleged herein has had widespread negative consequences and  has affected consumers throughout the nation.  69.  Consumer Plaintiffs incorporate by reference and reasserts all previous  paragraphs.   70.  The Data Breach constitutes a breach of Defendants’ computer security systems  within the meaning of the state data breach notifications statutes of several states as they may appear,  and the data accessed in the Data Breach was protected and covered by the same.   72.  Defendants unreasonably delayed notification of the Data Breach, including the  unauthorized access and theft of the PII of their customers, including Consumer Plaintiffs and the  Classes, after Defendants knew or should have known that the Data Breach had occurred.   73.  When the Data Breach began on or about May 19, 2014, Defendants did not  disclose or notify the public of the data breach.  Defendants knew or should have known that the  Data Breach was occurring as early as May 19, 2014, but failed to disclose its existence to the public,  including Consumer Plaintiffs and the Class, at this time.   74.  From June 2, 2015, until around September 29, 2015, for a period of about four  months, Defendants took inadequate action to remedy the Data Breach.  Defendants failed to inform  the public of the Data Breach during this time even though Defendants knew or should have known  of the Data Breach’s occurrence and the attendant unauthorized access, theft and dissemination of  Consumer Plaintiffs’ and the other Class members’ PII.   75.  On or around June 2, 2015, when Defendants finally reacted to the Data Breach  and began purging its systems of the malicious hacker software and fixing the unreasonable security  holes that led to the Data Breach, Defendants still failed to disclose or provide notice to the public  that the Data Breach had occurred.     76.  Defendants waited until around September 29, 2015, almost four months after  discovery, to disclose the Data Breach and notify their customers.  Defendants downplayed the  significance of the Data Breach and claimed that they did not know whether Personal Information  was stolen and that there was no evidence of misuse of any customer Personal Information.   77.  Defendants failed to disclose to Consumer Plaintiffs and the other Class  members, without unreasonable delay and in the most expedient time possible, the Data Breach and  the unauthorized access and theft of the PII of Consumer Plaintiffs and the other Class members  when Defendants knew, should have known, or reasonably believed that such information had been  compromised.    79.  As a result of Defendants’ failure to notify in the statutorily prescribed time  periods, Consumer Plaintiffs and the other Class members suffered the direct harm as alleged above.   80.  Had Defendants provided timely and accurate notice, Consumer Plaintiffs and  members of the Class could have taken steps to mitigate the direct harm suffered as a result of  Defendant’s unreasonable and untimely delay in providing notice.  Consumer Plaintiffs and the other  members of the Class could have used cash instead of credit and debit cards in closing commercial  transactions at Defendants’ Properties, avoided shopping at the Properties altogether, contacted their  financial institutions to cancel cards and accounts, or taken other steps in efforts to avoid the direct  harm caused by Defendants’ failure to notify.    81.  Defendants’ failure to notify Consumer Plaintiffs and the other Class members  violated Ill. Comp. Stat. Ann. 530/10(a), et seq., and the data breach notification statutes of other  states as they may appear.   82.  Consumer Plaintiffs and the other members of the Class seek all remedies  available under the applicable state data breach notification statutes, including but not limited to  damages as alleged above, equitable relief and reasonable attorneys’ fees, and costs, as provided by  law.  83.  Consumer Plaintiffs incorporate by reference and reassert all previous  paragraphs.   85.  Upon gaining access to the PII of Consumer Plaintiffs and members of the  Class, Defendants owed to Consumer Plaintiffs and the Class a duty of reasonable care in handling  and using this information and securing and protecting the information from being stolen, accessed  and misused by unauthorized parties.  Pursuant to this duty, Defendants were required to design,  maintain and test their security systems to ensure that these systems were reasonably secure and  capable of protecting the PII of Consumer Plaintiffs and the Class.  Defendants further owed to  Consumer Plaintiffs and the Class a duty to implement systems and procedures that would detect a  breach of their security systems in a timely manner and to timely act upon security alerts from such  systems.   86.  Defendants owed this duty to Consumer Plaintiffs and the other Class members  because Consumer Plaintiffs and the other Class members compose a well-defined, foreseeable and  probable class of individuals whom Defendants should have been aware could be injured by  Defendants’ inadequate security protocols.  Defendants actively solicited Consumer Plaintiffs and  the other Class members to use their PII in sales transactions at Defendants’ Properties.  To facilitate  and close these sales transactions, Defendants used, handled, gathered and stored the PII of  Consumer Plaintiffs and the other Class members.  Attendant to Defendants’ solicitation, use and  storage, Defendants knew of their inadequate and unreasonable security practices with regard to  their computer systems and also knew that hackers routinely attempt to access, steal and misuse the  PII that Defendants actively solicited, used and/or stored from Consumer Plaintiffs and the other  Class members.  As such, Defendants knew a breach of their systems would cause damage to their  customers, including Consumer Plaintiffs and the other Class members.  Thus, Defendants had a  duty to act reasonably in protecting the sensitive information of their consumers.   88.  Defendants also owed a duty to timely and accurately disclose to Consumer  Plaintiffs and the other Class members the scope, nature and occurrence of the Breach.  This duty  was required and necessary in order for Consumer Plaintiffs and the other Class members to take  appropriate measures to avoid unauthorized charges to their credit-and/or debit-card accounts, cancel  and/or change usernames and passwords on compromised accounts, monitor their accounts to  prevent fraudulent activity, contact their financial institutions about compromise or possible  compromise, obtain credit monitoring services and/or take other steps in an effort to mitigate the  harm caused by the Data Breach and Defendants’ unreasonable misconduct.   89.  Defendants breached their duties to Consumer Plaintiffs and the other Class  members by failing to implement and maintain security systems and controls that were capable of  adequately protecting the PII of Consumer Plaintiffs and the other Class members.  More  specifically, Defendants breached their duties to Consumer Plaintiffs and the other Class members  by failing to remedy the deficiencies found in the remote access points to their servers and corporate  networks and by storing Consumer Plaintiffs’ and the other Class members’ data on their servers.     90.  Defendants further breached their duties to Consumer Plaintiffs and the other  Class members when they failed to fix the deficiencies associated with their security and storage  policies despite the fact that they knew or, at the very least, should have known, that these  deficiencies were the leading cause of data breaches and theft of sensitive consumer information.   91.  Defendants also breached their duties to timely and accurately disclose to the  Consumer Plaintiffs and the other Class members that their PII had been or was reasonably believed  to have been improperly accessed or stolen.   93.  The injuries to Consumer Plaintiffs and the other Class members were  reasonably foreseeable to Defendants because laws, statutes, and industry standards, such as the PCI  DSS, require Defendants to safeguard and protect their computer systems and employ procedures  and controls to ensure that unauthorized third parties did not gain access to Consumer Plaintiffs’ and  the other Class members’ PII.   94.  The injuries to Consumer Plaintiffs and the other Class members also were  reasonably foreseeable because Defendants knew or should have known that their computer systems  used for processing consumer sales transactions were inadequate and unable to protect solicited  consumer PII from being breached, accessed and stolen by hackers and unauthorized third parties.   As such, Defendants’ own misconduct created a foreseeable risk of harm to Consumer Plaintiffs and  the other Class members.   95.  Defendants’ failure to take reasonable steps to protect the PII of Consumer  Plaintiffs and the other members of the Class was a proximate cause of their injuries because it  directly allowed hackers easy access to Consumer Plaintiffs’ and the other Class members’ PII.  This  ease of access allowed hackers to implement unsophisticated attacks and thereafter steal PII of  Consumer Plaintiffs and the other members of the Class and disseminate it over black markets.     96.  As a direct proximate result of Defendants’ conduct, Consumer Plaintiffs and  the other Class members have suffered theft of their PII.  Defendants allowed cybercriminals access  to Class members’ PII, thereby decreasing the security of Class members’ bank accounts, making  Class members’ identities less secure and reliable, and subjecting Class members to the imminent  threat of identity theft.  Not only will Consumer Plaintiffs and the other members of the Class have  to incur time and money to re-secure their bank accounts and identities, but they will also have to  protect against the specter of identity theft for years to come.   98.  Holding Defendants accountable under negligence law will further the policies  embodied in such law by incentivizing larger property and/or hotel chains to properly secure  sensitive consumer information and thereby protect the consumers who rely on these companies  every day.  I.  The Breach.  