22.  The ARG was founded in 1964 and is America’s first nationally  franchised sandwich restaurant. ARG’s restaurant system consists of over 3,300  restaurants worldwide. In 2016, ARG produced system-wide sales of more than  $3.6 billion.5 A large majority of these sales at ARG locations are made to  customers using credit or debit cards.   23.  When ARG customers pay using credit or debit cards, ARG collects  Customer Data related to those cards including the cardholder name, the account  number, expiration date, card verification value (CVV), and PIN data for debit  cards. ARG stores the Customer Data in its POS system and transmits this  information to a third party for completion of the payment.   25.  Stolen Customer Data is a valuable commodity. A “cyber black- market” exists in which criminals openly post stolen payment card numbers, social  security numbers, and other personal information on a number of underground  Internet websites. The Customer Data is “as good as gold” to identity thieves  because they can use victims’ personal data to open new financial accounts and  take out loans in another person’s name, incur charges on existing accounts, or  clone ATM, debit, or credit cards.   26.  As the FTC recognizes, once identity thieves have personal  information, “they can drain your bank account, run up your credit cards, open new  utility accounts, or get medical treatment on your health insurance.”6   27.  Furthermore, identity thieves may commit various types of  government fraud such as: immigration fraud; obtaining a driver’s license or  identification card in the victim’s name but with another’s picture; using the  victim’s information to obtain government benefits; or filing a fraudulent tax return  using the victim’s information to obtain a fraudulent refund. Some of this activity  may not come to light for years.   29.  At all relevant times, ARG was well-aware, or reasonably should have  been aware, that hackers had been targeting the payment card data of major U.S.  retailers, including national restaurant chains, for many years. Indeed, in the years  leading up to the ARG breach, retailer such as Home Depot and Target and  restaurant chains including P.F. Chang’s, Wendy’s, Dairy Queen, and Noodles &  Company were subject to well-publicized data breaches. In a number of these  breaches, hackers were able to install data-stealing malware on the restaurants’  POS systems.   30.  Due to the extensive network of financial institutions involved in  credit and debit transactions and the large volume of daily transactions, financial  institutions and credit card processing companies have issued rules and standards  governing the basic protective measures that merchants must take to ensure that a  customer’s valuable Customer Data is safeguarded.   31.  Furthermore, the requirements of industry standards, the FTC Act, and  other authorities imposed a duty on ARG to use adequate care to protect its  customers’ sensitive Customer Data:   35.  As early as 2009, the predecessor entity of Defendant was well-aware  of the risks of a data breach:  We rely on computer systems and information technology to run our  business. Any material failure, interruption or security breach of  our computer systems or information technology may adversely  affect the operation of our business and results of operations.  We are significantly dependent upon our computer systems and  information technology to properly conduct our business. A failure or  interruption of computer systems or information technology could  result in the loss of data, business interruptions or delays in business  operations. Also, despite our considerable efforts and technological  resources to secure our computer systems and information technology,  security breaches, such as unauthorized access and computer viruses,  may occur resulting in system disruptions, shutdowns or unauthorized  disclosure of confidential information. Any security breach of our  computer systems or information technology may result in adverse  publicity, loss of sales and profits, penalties or loss resulting from  misappropriation of information.  Wendy’s/Arby’s Restaurants, LLC, Prospectus (Nov. 9, 2009)   37.  In or around October 20, 2016, hackers installed malicious malware to  access POS systems at approximately 1,000 ARG corporate-owned restaurant  locations nationwide, allowing the thieves to download and steal copies of ARG  customers’ Customer Data.   38.  ARG estimates that the breach occurred between October 20, 2016  and January 12, 2017.12    39.  PSCU, an organization that handles 800 credit unions, was the first to  report the breach, reporting that both Track 1 and Track 2 data may have been  compromised in the ARG data breach. Track 1 and Track 2 data normally includes  credit and debit card information such as the cardholder name, primary account  number, expiration date, and, in certain instances, PIN number. The PSCU alert  also indicated that at least 355,000 credit and debit cards were compromised.13   41.  In addition to ARG’s failure to prevent the data breach, ARG also  failed to detect the breach for nearly three months, and only learned of it after  “industry partners” notified ARG of the breach in mid-January.14   42.  The breach occurred because ARG failed to implement adequate data  security measures to protect its POS network from the potential danger of a data  breach, and failed to implement and maintain adequate systems to detect and  prevent the breach and resulting harm that it has caused.   43.  Had ARG implemented and maintained adequate safeguards to protect  the Customer Data, deter the hackers, and detect the data breach within a  reasonable amount of time, it is more likely than not that the breach would have  been prevented.   44.  In permitting the data breach to occur, ARG breached its implied  agreement with customers to protect their personal and financial information and  violated industry standards.  57.  Plaintiffs seek relief on behalf of themselves and as representatives of  all others who are similarly situated. Pursuant to Fed. R. Civ. P. 23(a), (b)(2), and  (b)(3), Plaintiffs seek to certify a class of all persons residing in the United States  who made a credit or debit card purchase at any ARG affected location from  October 20, 2016 through January 12, 2017 (the “Nationwide Class”).   58.  Plaintiffs also seek to certify a class of all persons residing in the  Connecticut who made a credit or debit card purchase at any ARG affected  location from October 20, 2016 through January 12, 2017 (the “Connecticut  Subclass”).   59.  The Nationwide Class and Connecticut Subclass are individually  referred to as “Class” and collectively referred to as the “Classes.”   61.  Plaintiffs hereby reserve the right to amend or modify the class  definitions with greater specificity or division after having had an opportunity to  conduct discovery.   62.  Plaintiffs are members of both Classes.   63.  Each of the proposed Classes meet the criteria for certification under  Federal Rule of Civil Procedure 23(a), (b)(2), and (b)(3):    64.  Numerosity. The proposed Classes include at least 355,000 customers  whose data was compromised in the ARG data breach. While the precise number  of Class members has not yet been determined, the massive size of the ARG data  breach indicates that joinder of each member would be impracticable.    66.  Typicality. Plaintiffs’ claims are typical of the claims of the Classes.  Plaintiffs and Class members were injured through ARG’s uniform misconduct  and their legal claims arise from the same core practices employed or omitted by  71.  Plaintiffs restate and reallege Paragraphs 1 through 70 as if fully set  forth herein.   72.  Plaintiffs and Connecticut Subclass members are consumers who used  their credit or debit cards to purchase food and drink products from ARG.   73.  ARG engages in in transactions intended to result, and which did  result, in the sale of goods or services to consumers, including Plaintiffs and  Connecticut Subclass members.    74.  ARG is engaged in, and its acts and omissions affect, trade and  commerce. ARG acts, practices, and omissions were done in the course of ARG’s  business of marketing, offering for sale, and selling goods and services throughout  Connecticut.   76.  ARG knew or should have known that its computer systems and data  security practices were inadequate to safeguard the Customer Data of Plaintiffs and  Connecticut Subclass members, deter hackers, and detect a breach within a  reasonable time, and that the risk of a data breach was highly likely.   77.  By engaging in such Deceptive Trade Practices, ARG has violated the  83.  Plaintiffs restate and reallege Paragraphs 1 through 70 as if fully set  forth herein.   84.  ARG solicited and invited Plaintiffs and Class members to eat at its  restaurants and make purchases using their credit or debit cards. Plaintiffs and  Class members accepted ARG offers and used their credit or debit cards to make  purchases at ARG restaurants from October 20, 2016 through January 12, 2017.   86.  Plaintiffs and Class members would not have provided and entrusted  their Customer Data with ARG in the absence of the implied contract between  them and ARG.     87.  Plaintiffs and Class members fully performed their obligations under  the implied contracts with ARG.   88.  ARG breached the implied contracts it made with Plaintiffs and Class  members by failing to safeguard and protect the Customer Data of Plaintiffs and  Class members and by failing to timely detect the data breach within a reasonable  time.    89.  As a direct and proximate result of ARG’s breaches of the implied  contracts between ARG and Plaintiffs and Class members, Plaintiffs and Class  members sustained actual losses and damages as described in detail above and  deserve to recoup those losses and damages.   90.  Plaintiffs restate and reallege Paragraphs 1 through 70 as if fully set  forth herein.   92.  Furthermore, the law imposes an affirmative duty on ARG to timely  detect unauthorized access and theft of the Customer Data.   93.  ARG breached the duties it owed to Plaintiffs and Class members in  numerous ways, including:  a. by creating a foreseeable risk of harm through the misconduct  previously described;  b. by failing to implement adequate security systems, protocols and  practices sufficient to protect the Customer Data both before and  after learning of the data breach;   c. by failing to comply with the minimum industry data security  standards, including the PCI-DSS, during the period of the data  breach; and  d. by failing to timely detect the data breach;   95.  Neither Plaintiffs nor the other Class members contributed to the data  breach and subsequent misuse of their Customer Data as described in this  Complaint.   96.  But for ARG’s wrongful and negligent breach of the duties it owed  Plaintiffs and Class members, their Customer Data either would not have been  compromised or they would have been able to prevent some or all of their  damages.   97.  As a direct and proximate cause of ARG’s negligent conduct,  Plaintiffs and the Class suffered damages including, but not limited to those stated  in Paragraphs 50-51. Moreover, the nature of other forms of economic damage and  injury may take years to detect, and the potential scope can only be assessed after a  thorough investigation of the facts and events surrounding the theft mentioned  above. Accordingly, Plaintiffs and the Class members have suffered injury and will  continue to do so, and are entitled to damages in an amount to be proven at trial.  Breach of Implied Contract  (On Behalf of Plaintiffs and all Classes)   I.  Background   Negligence  (On Behalf of Plaintiffs and all Classes)  