21.  On August 3, 2016, Banner first acknowledged in a public statement (the  “Statement”) that beginning on June 23, 2016, hackers gained unauthorized access to  Banner Health’s computer servers.    22.  According to the Statement, Banner’s initial discovery was that the  attackers targeted payment card data, including cardholder names, card numbers,  expiration dates, and security codes, for payment cards used at Banner facilities across  the country.    23.  Banner has identified that food and beverage outlets affected during the  two-week period between June 23 and July 7, 2016 are located in Alaska, Arizona,  Colorado, and Wyoming.6   24.  According to Banner Health, this portion of the cyberattack continued until  July 7, 2016 – the date on which Banner Health supposedly first learned of the data  breach.  Banner Health merely stated that it “worked quickly to block the attackers”7  without providing any more information as to what steps it took to stop the attack and to  ensure that the attack would not continue or resume, or that its servers would not be  subjected to another attack of this type.    25.  Also in its Statement, Banner identified that on July 13 it subsequently  learned that the attack ran deeper than the credit card information attack that began on  June 23.  Banner announced that beginning a week earlier on June 17, 2016, attackers  “may have” gained unauthorized access to patient information, health plan member and  beneficiary information, and information about physicians and healthcare providers.    27.  Although Banner has not been able to identify with any sense of certainty  the extent of the attack or the exact information and data obtained by the attackers,  Banner Health spokesman Bill Byron identified that the attack is “extensive throughout  the [Banner Health] network.”9    28.  Banner did not make it a top priority to report this breach to its customers  immediately.  It was only on August 3, 2016 – almost an entire month after Banner  learned of this breach – that Banner Health decided it would issue the Statement  acknowledging the cyberattack.    29.  The Statement is underwhelming. The lack of details contained in the  Statement signals that Banner is either withholding information from the public (most  importantly its customers) or that, despite the passage of nearly two months since the  attack began, Banner has been unable to determine critical details concerning the breach,  including the extent of the breach and the volume of compromised information.   31.  The letter that has been sent or that is being sent by Banner to affected  customers is equally devoid of information and details regarding the breach. The letter  identifies: the barebones details of the timeline of the data breach; that customer  information (names, birthdates, addresses, clinical information, Social Security numbers,  insurance information, etc.) “may have” been obtained by attackers; that affected  customers are being offered one year of free credit-monitoring services from Kroll; and –  without providing any information regarding how the breach actually occurred or the  exact measures that Banner will take going forward – that Banner is “further enhancing  the security of [its] systems to help prevent something like this from happening again.”  See, e.g., Exhibit A.   33.  Banner has even had the audacity to implore customers to resume using  payment cards at Banner facilities so that it can continue to make money, stating that  customers can do so “with confidence.”12 But customers like Plaintiff and Class Members  are anything but confident that their information is secure and will not be used to  perpetrate future crimes – including identity theft – in light of Banner’s nonchalant  response to this incident.    34.  Banner’s response to this incident is particularly egregious given the  number and magnitude of data breaches experienced across the United States recently.      35.  Over the past couple of years, large data breaches and cyberattacks have  become somewhat commonplace, as evidenced by the widely publicized incidents at  Target, Home Depot, Anthem, and many others. With 3.7 million potentially affected  customers, the Banner Health breach is the largest of 2016 and would be the eighth  largest attack according to HHS’ Office for Civil Rights.  As a result of the frequency of  these types of cyber security breaches, companies that store and maintain confidential  and highly sensitive information must develop, implement, and maintain up-to-date data  security and retention policies that reduce the risk of cyberattack and unauthorized  release of this information. But many companies do not take these precautions or the  measures taken fall short of being adequate.   37.  According to another cyber security expert, Chris Ensey, chief operating  officer of Dunbar Security Solutions in Hunt Valley, Maryland, following a breach of this  magnitude a company’s IT personnel would need to restart the entire network from  scratch and reset all the components of the network to the state they were in when they  arrived from the factory in order to be certain the breach has been fixed. He also  identified that there is a chance hackers created a “back door” in the initial breach that  may not be caught. Ensey stated “That would make me, if I were in the shoes of the folks  there, really struggle with being able to sleep at night for a while, until they had the  opportunity to do a complete overhaul . . . .”14   38.  But Banner merely identifies that it is still investigating to find out exactly  what happened, and spokesman Byron said he cannot say when the investigation will be  concluded, stating “I don’t know that there is a timeline . . . The goal is to complete the  investigation.”15   40.  Victims of Banner’s data breach face a number of other frustrating and  challenging hurdles.  For example, victims of a data breach of this type face imminent  risk of health insurance discrimination. Individuals risk denial of coverage, improper  “redlining,” and denial or difficulty obtaining disability or employment benefits because  information was improperly disclosed to a provider.    41.  Victims of healthcare data breaches are also particularly susceptible to tax  return fraud. It is estimated that in 2016 there will be $21 billion in losses due to  fraudulent tax refunds, and data breaches are large factor contributing to this reality. The  U.S. Treasury Inspector General for Tax Administration has recognized that “[t]he  increasing number of data breaches in the private and public sectors means more personal  information than ever before is available to unscrupulous individuals.”17   43.  Despite having knowledge of the recent wave of high-profile data breaches  and the need for heightened security measures, Banner Health failed to develop,  implement, and maintain data security and retention policies that reflect industry  standards.  Had Banner done so, it would have both detected the breach earlier and  helped reduce the severity of the breach, or potentially would have prevented the breach  entirely.    44.  This catastrophic and complete failure by Banner resulted in increased  exposure to data breaches, and caused the release of consumers’ personal and medical  data. The release of this information will likely lead to identity theft and fraud-related  issues for the months and years to come.    45.  Furthermore, there is no indication by its words or deeds that Banner is  approaching and responding to this security catastrophe with an utter and necessary sense  of urgency.   46.  As of the date of this Complaint, there is no indication as to whether  Banner Health has implemented recommended security improvements, leaving Plaintiff  and Class Members’ data vulnerable to future data breaches.   47.    Plaintiff brings this action on her own behalf, and on behalf of the  following Class pursuant to FED. R. CIV. P. 23(b)(2) and (3):  All former or present Banner Health patients, health plan members  or health plan beneficiaries, food and beverage customers, or  medical and healthcare providers who had their personal, medical,  financial, or other sensitive information compromised as a result  of the data breach of Banner Health’s computer servers that began  on June 17, 2016.   49.  Numerosity: Members of the Class are so numerous that their individual  joinder is impracticable, as the proposed Class appears to include millions of members  who are geographically dispersed. While the precise number of Class members has not  yet been determined, Banner Health has admitted that the medical, financial, and/or  personal identification records of approximately 3.7 million patients, health plan  members (and their beneficiaries), food and beverage customers, and physicians and  healthcare providers were likely compromised in the data breach.   50.   Typicality: Plaintiff’s claims are typical of the claims of the Class.  Plaintiff and all members of the Class were injured through Banner’s uniform  misconduct. The same event and conduct that gave rise to Plaintiff’s claims are identical  to those that give rise to the claims of every other Class member because Plaintiff and  each member of the Class had their data compromised in the same way by the same  conduct by Banner.   51.   Adequacy: Plaintiff is an adequate representative of the Class because  her interests do not conflict with the interests of the Class that they seek to represent;  Plaintiff has retained counsel competent and highly experienced in class-action  litigation; and Plaintiff and her counsel intend to prosecute this action vigorously. The  interests of the Class will be fairly and adequately protected by Plaintiff and her counsel.   54.  Plaintiff realleges and incorporates all previous allegations.   55.  Banner required Plaintiff and Class Members to submit sensitive personal,  medical, and financial information order to obtain services.   57.  Banner further owed a duty to Plaintiff and Class members to implement  processes that would detect a breach of its security system in a timely manner and to  timely act upon warnings and alerts, including those generated by its own security  systems.   58.  Banner owed a duty to Plaintiff and members of the Class to provide  security consistent with industry standards and requirements, to ensure that its computer  systems and networks, and the personnel responsible for them, adequately protected the  medical, financial, and personal information of Plaintiff and members of the Class whose  confidential data Banner obtained and maintained.   59.  Banner Health owed a duty to timely and accurately disclose to Plaintiff  and members of the Class that their medical, financial, and personal information had been  or was reasonably believed to have been compromised. Timely disclosure was required,  appropriate, and necessary so that, among other things, Plaintiff and members of the  Class could take appropriate measures to avoid identity theft if possible.   60.  Banner knew, or should have known, of the risks inherent in collecting and  storing the medical, financial, and personal information of Plaintiff and members of the  Class and of the critical importance of providing adequate security of that information.   61.  Banner’s conduct created a foreseeable risk of harm to Plaintiff and  members of the Class. This conduct included but was not limited to Banner’s failure to  take the steps and opportunities to prevent and stop the data breach as described in this  Complaint. Banner’s conduct also included its decision not to comply with industry  standards for the safekeeping and maintenance of the medical, financial, and personal  information of Plaintiff and Class members.   63.  To the extent a “special relationship” is required as between Banner, on  the one hand, and Plaintiff and Class members, on the other hand, a “special relationship”  exists between Banner and the Plaintiff and Class Members. Banner entered into a  “special relationship” with the Plaintiff and Class Members whose personal information  was requested, collected, and received by Banner as a prerequisite to rendering services.  A “special relationship” also exists between Banner, on the one hand, and Plaintiff and  Class members, on the other hand, because Banner is a provider of health and health plan  services and thus stands in a fiduciary or quasi-fiduciary relationship with Plaintiff and  Class Members. Banner entered into a “special relationship” with Plaintiff and Class  Members by placing their personal information on Banner’s computer servers –  information that Plaintiff and Class Members had been required to provide to Banner.  Furthermore, Banner also created a “special relationship” with Plaintiff and Class  Members who provided their information to Banner by playing a large in role in creating  and maintaining centralized computer systems and data security practices that were used  for storage of all of Banner customers’ personal information.    64.  Banner breached the duties it owed to Plaintiff and members of the Class  by failing to exercise reasonable care and implement adequate security systems,  protocols, and practices sufficient to protect the medical, financial, and personal  information of Plaintiff and members of the Class, as identified above. This breach was a  proximate cause of injuries and damages suffered by Plaintiff and Class members.   65.  Plaintiff realleges and incorporates all previous allegations.   66.  Pursuant to the Federal Trade Commission Act (15 U.S.C. §45), Banner  had a duty to provide fair and adequate computer systems and data security practices to  safeguard Plaintiff’s and Class Members’ personal information.   67.  Pursuant to HIPAA (42 U.S.C. § 1302d et seq.), Banner had a duty to  implement reasonable safeguards to protect Plaintiff’s and Class Members’ personal  information.   68.  Pursuant to the Gramm-Leach-Bliley Act (15 U.S.C. § 6801), Banner had a  duty to protect the security and confidentiality of Plaintiff’s and Class Members’ personal  information.   69.  Pursuant to Arizona state law, Banner had a duty to Plaintiff and Class  Members to implement and maintain reasonable security procedures and practices to  safeguard Plaintiff’s and Class Members’ personal information. See ARIZ. REV. STAT. §  75.  Plaintiff realleges and incorporates all previous allegations.   76.  Banner negligently and recklessly misrepresented material facts pertaining  to the sale of health benefits services to Plaintiff and Class Members by representing that  it would maintain adequate data privacy and security practices and procedures to  safeguard Plaintiff’s and Class Members’ personal and sensitive information from  unauthorized disclosure, release, data breaches, and theft.    77.  Banner negligently and recklessly misrepresented material facts pertaining  to the sale of health benefits services to Plaintiff and Class Members by representing that  they did and would comply with the requirements of relevant federal and state laws  pertaining to the privacy and security of Plaintiff’s and Class Members’ personal  information.    78.  Because of the inadequacy of their security systems and data protection  systems, Banner either knew or should have known that their representations were not  true.    79.  In reliance upon these misrepresentations, Plaintiff and Class Members  purchased health benefits services from Banner.    81.  As  direct  and  proximate  consequence  of  Banner’s  negligent  misrepresentations, Plaintiff and Class Members have suffered the injuries alleged herein.  82.  Plaintiff realleges and incorporates all previous allegations.   83.  Plaintiff and Class Members conferred a monetary benefit on Banner in the  form of monies paid for the purchase of health benefits services.    84.  Banner appreciated or had knowledge of the benefits conferred upon them  by Plaintiff and Class Members.    85.  The monies for health benefits services that Plaintiff and Class Members  paid (directly or indirectly) to Banner were supposed to be used by Banner, in part, to pay  for the administrative costs of reasonable data privacy and security practices and  procedures.    86.  As a result of Banner’s conduct, Plaintiff and Class Members suffered  actual damages in an amount equal to the difference in value between health benefit  services with the reasonable data privacy and security practices and procedures that  Plaintiff and Class Members paid for, and the inadequate health benefits services without  reasonable data privacy and security practices and procedures that they received.    88.  Banner should be compelled to disgorge into a common fund for the benefit  of Plaintiff and Class Members all unlawful or inequitable proceeds received by it.  89.  Plaintiff realleges and incorporates all previous allegations.   90.  Plaintiff Clark brings this claim on behalf of herself and the Class.   91.  This cause of action is brought pursuant to the ACFA, which provides in  pertinent part:  The act, use or employment by any person of any deception,  deceptive or unfair act or practice, fraud, false pretense, false  promise, misrepresentation, or concealment, suppression or  omission of any material fact with intent that others rely on  such concealment, suppression or omission, in connection  with the sale or advertisement of any merchandise whether or  not any person has in fact been misled, deceived or damaged  thereby, is declared to be an unlawful practice.  Id. § 44-1522.   92.  Plaintiff Clark and members of the Class are “persons” as defined by ARIZ.  REV. STAT. § 44-1521(6), Banner provides “services” as that term is included in the  definition of “merchandise” under ARIZ. REV. STAT. § 44-1521(5), and Banner is  engaged in the “sale” of “merchandise” as defined by ARIZ. REV. STAT. § 44-1521(7).   95.  Defendant intended that Plaintiff and the Class rely on its deceptive and  unfair acts and practices, misrepresentations, and the concealment, suppression, and  omission of material facts, in connection with Banner’s offering of medical services and  incorporating Plaintiff’s and Class members’ sensitive information on its computer  servers, in violation of the AFCA.     96.  Banner also engaged in unfair acts and practices, in connection with the  sale of health benefits services by failing to maintain the privacy and security of Class  Members’ personal information, in violation of duties imposed by and public policies  reflected in applicable federal and state laws, resulting in the data breach. These unfair  acts and practices violated duties imposed by laws including the Federal Trade  Commission Act (15 U.S.C. § 45), HIPAA (42 U.S.C. § 1302d et seq.), and the Gramm- Leach-Bliley Act (15 U.S.C. § 6801), and the Arizona Insurance Information and Privacy  Protection Act (ARIZ. REV. STAT. § 20-2113).   97.  Banner’s wrongful practices occurred in the course of trade or commerce.   98.  Banner’s wrongful practices were and are injurious to the public interest  because those practices were part of a generalized course of conduct on the part of Banner  that applied to all Class members and were repeated continuously before and after Banner  obtained confidential medical, financial, and personal data concerning Plaintiff and Class  members. All Class members have been adversely affected by Banner’s conduct and the  public was and is at risk as a result thereof.   Negligence  (Individually and on Behalf of the Class)   Negligent Misrepresentation  (Individually and on Behalf of the Class)   Unjust Enrichment  (Individually and on Behalf of the Class)   Violation of the Arizona Consumer Fraud Act,  ARIZ. REV. STAT. §§44-1521, et seq. (“ACFA”)  (Individually and on behalf of the Class)  