16.  Defendants regularly serve the needs of restaurants and other business  owners by selling bulk supplies and equipment.     49.  Pursuant to Rules 23(a), (b)(3) and/or (b)(2) of the Federal Rules of  Civil Procedure, Plaintiff brings this action on behalf of himself and a nationwide  class (“Class”), initially defined as follows:  All persons or entities located in the United States who were  customers of Defendants from February 22, 2009 to the present  (“Class Period”), from whom Defendants collected PII that was  compromised as a result of the data breaches of Defendants’ card  processing systems, and who sustain fraudulent charges as a result of  the breach and/or made out of pocket expenditures in mitigation of  the consequences to them of such data breaches.  Excluded from the  consumer class are governmental entities, the Defendants, any entity  in which the Defendants have a controlling interest, their employees,  officers, directors, legal representatives, heirs, successors and wholly  or partly owned subsidiaries or affiliated companies, including parent  corporations, class counsel and their employees; and the judicial  officers and their immediate family members and associated court  staff assigned to this case.     57.  Plaintiff repeats, realleges and incorporates by reference each and  every allegation contained above as if fully set forth herein.     58.  Defendants owed its member customers a duty of care in the handling  and safeguarding of their PII that was entrusted to them for the purpose of making  purchases at Defendants’ stores.    59.  Additionally, Defendants assumed a duty, and had duties imposed  upon them by regulations to use reasonable care to keep Class members’ financial  data and PII private and secure.     60.  Additionally, Defendants had a duty, and had a duty imposed on them  by regulations, to report the theft of PII to Plaintiff and the Class in an expedient  manner (as to Data Breach One) and an immediate manner (as to Data Breach  Two).   61.  Defendants also represented to Plaintiff and the Class that their  systems were compliant with payment card industry standards, which created a  special relationship between Defendants and Plaintiff and the Class, in that  Plaintiff and the Class reasonably relied on Defendants to take reasonable steps to  safeguard their PII.1     79.  Plaintiff repeats, realleges and incorporates by reference each and  every allegation contained above as if fully set forth herein.     80.  Defendants represented that their systems were compliant with  payment card industry standards.2  However, Defendants negligently allowed  Plaintiff and Class member information to be taken, in December 2012, even after  a similar breach just a year before during September through November of 2011.   GROSS NEGLIGENCE  (On Behalf of Plaintiff and the Class, as Against All Defendants)   NEGLIGENCE  (On Behalf of Plaintiff and the Class, as Against All Defendants)  