25.  As a condition of providing respiratory care products, Defendants require that  their customers/patients entrust them with certain personal information. In their ordinary course  of business, Defendants maintain personal information, including the name, address, zip code,  date of birth, Social Security number, and personal medical information of each current and  former customers/patients.    27.  Defendants had a duty to adopt reasonable measures to protect Plaintiff’s and  Class Members’ PII from involuntary disclosure to third parties.   28.  On January 7, 2017, Defendant American HomePatient learned that its Newark,  Delaware, office had been burglarized and that several unencrypted computer hard drives were  stolen. The files on these computer hard drives contained personal and protected information. On  March 6, 2017, Defendant American HomePatient notified Attorneys General across the country  of the breach and provided them a copy of a notice that Defendant American HomePatient  allegedly was “sending out… to its customers/patients.”   29.  On or about March 6, 2017, Defendant American HomePatient sent a letter to  current and former customers/patients, advising that Defendant American HomePatient  discovered on January 7, 2017, its office in Newark, Delaware “had been burglarized” and that  “[s]everal computer hard drives containing personal information were stolen from the office  during the burglary” and “may have included first and last names, American HomePatient  account numbers, Social Security Numbers, diagnosis codes, date of birth [sic], financial  information, and treatment information.”   30.  Upon information and belief, the March 6, 2017, letter was the first notice  received by Defendant American HomePatient’s current and former customers/patients that their  PII had been wrongly disclosed.    31.  The March 6, 2017, letter failed to advise of the actual date of the Data Disclosure  (only when it was discovered), or why Defendant American HomePatient waited two (2) months  after discovering the incident to notify customers/patients of the Data Disclosure.    33.  Defendants’ negligence in safeguarding its customers/patients’ PII is exacerbated  by the repeated warnings and alerts directed to protecting and securing electronics.    34.   Defendants have acknowledged the sensitive and confidential nature of the PII.  To be sure, collection, maintaining, and protecting PII is vital to many of Defendants’ business  purposes. Defendants have acknowledged through conduct and statements that the misuse or  inadvertent disclosure of PII can pose major privacy and financial risks to impacted individuals,  and that under state law they may not disclose and must take reasonable steps to protect PII from  improper release or disclosure. Despite the prevalence of public announcements of data breach  and data security compromises, and despite their own acknowledgments of data breach and data  security compromises, and despite their own acknowledgment of their duties to keep PII private  and secure, Defendants failed to take appropriate steps to protect the PII of Plaintiff and the  proposed Class from being compromised.    35.  Upon discovery, Defendant American HomePatient failed to take reasonable steps  to clearly and conspicuously inform Plaintiff and the other Class Members of the nature, timing  and extent of the Data Disclosure. By failing to provide adequate, timely notice, Defendant  American HomePatient prevented Plaintiff and Class Members from protecting themselves from  the consequences of the Data Disclosure.    36.  The ramifications of Defendants failure to keep its customers/patients’ PII secure  are long lasting and severe. Once PII is stolen, particularly Social Security numbers, fraudulent  use of that information and damage to victims may continue for years.   38.  Social Security numbers, for example, are among the worst kind of personal  information to have stolen because they may be put to a variety of fraudulent uses and are  difficult for an individual to change.   39.  The Social Security Administration has warned that identity thieves can use an  individual’s Social Security number to apply for additional credit lines. Such fraud may go  undetected until debt collection calls commence months, or even years, later.4    40.  Stolen Social Security numbers also make it possible for thieves to file fraudulent  tax returns, file for unemployment benefits, or apply for a job using a false identity. Each of  these fraudulent activities is difficult to detect. An individual may not know that his or her Social  Security number was used to file for unemployment benefits until law enforcement notifies the  individual’s employer of the suspected fraud. Fraudulent tax returns are typically discovered  only when an individual’s authentic tax return is rejected.   41.  What is more, it is no easy task to change or cancel a stolen Social Security  number. An individual cannot obtain a new Social Security number without significant  2   62.  Plaintiff brings this suit as a class action on behalf of himself and on behalf of all  others similarly situated pursuant to Rule 23(b)(2), (b)(3) and (c)(4) of the Federal Rules of Civil  Procedure.    63.  The Nationwide Class that Plaintiff seeks to represent is defined as follows:  Defendants’ current and former customers/patients whose PII was  compromised as a result of the Data Disclosure which occurred on or  about January 6, 2017.   64.  In the alternative to the Nationwide Class, and pursuant to Federal Rule of Civil  Procedure 23(c)(5), Plaintiff seeks to represent the following state classes only in the event that  the Court declines to certify the Nationwide Class above. Specifically, the state class consists of  the following:  Defendants’ current and former customers/patients who currently reside in  the United States and whose Personal Information was compromised as a  result of the Data Disclosure which occurred on or about January 6, 2017.    66.  Numerosity. Fed. R. Civ. P. 23(a)(1). The members of the Class are so numerous  that joinder of all members is impractical. While the exact number of Class members is unknown  to Plaintiff at this time, based on information and belief, it is estimated to be at or above 13,000.  The exact number is generally ascertainable by appropriate discovery as Defendants have  knowledge of the customers/patients whose PII was in the data file it disclosed.   68.  Typicality. Fed. R. Civ. P. 23(a)(3). Plaintiff’s claims are typical of those of other  Class Members because Plaintiff’s PII, like that of every other class member, was disclosed by  Defendants. Plaintiff’s claims are typical of those of the other Class Members because, inter alia,  all Members of the Class were injured through the common misconduct of Defendants. Plaintiff  is advancing the same claims and legal theories on behalf of himself and all other Class  members, and there are no defenses that are unique to Plaintiff. The claims of Plaintiff and those  of Class members arise from the same operative facts and are based on the same legal theories.   69.  Adequacy of Representation. Fed. R. Civ. P. 23(a)(4). Plaintiff will fairly and  adequately represent and protect the interests of the Class in that he has no disabling conflicts of  interest that would be antagonistic to those of the other members of the Class. Plaintiff seeks no  relief that is antagonistic or adverse to the members of the Class and the infringement of the  rights and the damages he has suffered are typical of other Class members. Plaintiff has retained  counsel experienced in complex consumer class action litigation, and Plaintiff intends to  prosecute this action vigorously.   71.  The nature of this action and the nature of laws available to Plaintiff and the Class  make the use of the class action device a particularly efficient and appropriate procedure to  afford relief to Plaintiff and the Class for the wrongs alleged because Defendants would  necessarily gain an unconscionable advantage since they would be able to exploit and  overwhelm the limited resources of each individual Class member with superior financial and  legal resources; the costs of individual suits could unreasonably consume the amounts that would  be recovered; proof of a common course of conduct to which Plaintiff was exposed is  representative of that experienced by the Class and will establish the right of each member of the  Class to recover on the cause of action alleged; and individual actions would create a risk of  inconsistent results and would be unnecessary and duplicative of this litigation.   72.  The litigation of the claims brought herein is manageable. Defendants’ uniform  conduct, the consistent provisions of the relevant laws, and the ascertainable identities of Class  Members demonstrates that there would be no significant manageability problems with  prosecuting this lawsuit as a class action.   74.  Unless a Class-wide injunction is issued, Defendants may continue in their failure  to properly secure the PII of Class Members, Defendants may continue to refuse to provide  proper notification to Class Members regarding the Data Disclosure, and Defendants may  continue to act unlawfully as set forth in this Complaint.   75.  Further, Defendants have acted or refused to act on grounds generally applicable  to the Class and, accordingly, final injunctive or corresponding declaratory relief with regard to  the members of the Class as a whole is appropriate under Rule 23(b)(2) of the Federal Rules of  Civil Procedure.   77.  Plaintiff restates and realleges paragraphs 1 through 76 above as if fully set forth  herein.   78.  As a condition of their utilizing the services of Defendants, customers/patients  were obligated to provide Defendants with certain PII, including their date of birth, mailing  addresses, Social Security numbers, and personal medical information.   79.  Plaintiff and the Class Members entrusted their PII to Defendants on the premise  and with the understanding that Defendants would safeguard their information, use their PII for  business purposes only, and/or not disclose their PII to unauthorized third parties.    80.  Defendants have full knowledge of the sensitivity of the PII and the types of harm  that Plaintiff and Class Members could and would suffer if the PII were wrongfully disclosed.   82.  Defendants had a duty to exercise reasonable care in safeguarding, securing, and  protecting such information from being compromised, lost, stolen, misused, and/or disclosed to  unauthorized parties. This duty includes, among other things, designing, maintaining, and testing  Defendants’ security protocols to ensure that Plaintiff and Class members’ information in  Defendants’ possession was adequately secured and protected, and that employees tasked with  maintaining such information were adequately trained on security measures regarding the  security of customers/patients’ personal and medical information.   83.  Plaintiff and the Class Members were the foreseeable and probable victims of any  inadequate security practices and procedures. Defendants knew of should have known of the  inherent risks in collecting and storing the PII of Plaintiff and the Class, the critical importance  of providing adequate security of that PII, the necessity for encrypting PII stored on Defendants’  systems, and that they had inadequate employee training and education and IT security protocols  in place to secure the PII of Plaintiff and the Class.   84.  Defendants’ own conduct created a foreseeable risk of harm to Plaintiff and Class  Members. Defendants’ misconduct included, but was not limited to, their failure to take the steps  and opportunities to prevent the Data Disclosure as set forth herein. Defendants’ misconduct also  included their decisions not to comply with industry standards for the safekeeping and encrypted  authorized disclosure of the PII of Plaintiff and Class Members.   85.  Plaintiff and the Class Members had no ability to protect their PII that was in  Defendants’ possession.   87.  Defendants had and continue to have a duty to adequately disclose that the PII of  Plaintiff and Class Members within Defendants’ possession might have been compromised, how  it was compromised, and precisely the types of information that were compromised and when.  Such notice was necessary to allow Plaintiff and the Class Members to take steps to prevent,  mitigate, and repair any identity theft and the fraudulent use of their PII by third parties.   88.  Defendants had a duty to employ proper procedures to prevent the unauthorized  dissemination of the PII of Plaintiff and Class Members.    89.  Defendants have admitted that the PII of Plaintiff and Class Members was  wrongfully disclosed to unauthorized third persons as a result of the Data Disclosure.   90.  Defendants, through their actions and/or omissions, unlawfully breached their  duty to Plaintiff and Class Members by failing to exercise reasonable care in protecting and  safeguarding the PII of Plaintiff and Class Members during the time the PII was within  Defendants’ possession or control.    91.  Defendants improperly and inadequately safeguarded the PII of Plaintiff and  Class Members in deviation of standard industry rules, regulations, and practices at the time of  the Data Disclosure.   92.  Defendants failed to heed industry warnings and alerts to provide adequate  safeguards to protect customers/patients’ PII in the face of increased risk of theft.    93.  Defendants, through their actions and/or omissions, unlawfully breached their  duty to Plaintiff and Class Members by failing to have appropriate procedures in place to detect  and prevent dissemination of their customers/patients’ PII.   95.  But for Defendants’ wrongful and negligent breach of duties owed to Plaintiff and  Class Members, the PII of Plaintiff and Class Members would not have been compromised.   96.  There is a close causal connection between Defendants’ failure to implement  security measures to protect the PII of current and former customers/patients and the harm  suffered or risk of imminent harm suffered by Plaintiff and the Class.   97.  As a result of Defendants’ negligence, Plaintiff and the Class Members have  suffered and will continue to suffer damages and injury including, but not limited to: identity  theft, out-of-pocket expenses associated with addressing false accounts opened; out-of-pocket  expenses associated with procuring robust identity protection and restoration services; increased  risk of future identity theft and fraud, and the costs associated therewith; and time spent  monitoring, addressing and correcting the current and future consequences of the Data  Disclosure.  98.  Plaintiff restates and realleges paragraphs 1 through 76 above as if fully set forth  herein.   Invasion of Privacy  (On Behalf of the Class)  (Against American HomePatient, Inc., and Lincare Holdings, Inc.)   Negligence   (On Behalf of the Class)  (Against American HomePatient, Inc., and Lincare Holdings, Inc.)  