(“Unfair” Business Practices in Violation of the Unfair Competition Law,  Cal. Bus. & Prof. Code §§ 17200, et seq.—On Behalf of All Classes)   (“Unlawful” Business Practices in Violation of the Unfair Competition Law,  Cal. Bus. & Prof. Code §§ 17200, et seq.—On Behalf of All Classes)   22.  A phishing attack is a scheme by cyber criminals to try to get people to share personal  and financial data, such as W-2s during the upcoming tax season.  In 2016, the IRS warned that  criminals were targeting company payroll departments.   23.  One phishing variation is known as a “spoofing” email that will contain the actual name  of the company’s chief executive officer (“CEO”) or another executive; however, it is sent by a person  pretending to be the CEO.  The email will go to a company office employee and will request a list of  employees and information, such as social security numbers.    46.  Plaintiffs hereby incorporate all other paragraphs of this Complaint and restates them as  if fully set forth herein.   47.  Defendant requested and came into possession of Plaintiffs’ and Class members’ PII,  and had a duty to exercise reasonable care in safeguarding and protecting such information from  unlawful intrusion.  Defendant’s duty arose from, among other things, the legal requirements and its  relationship with its employees.    48.  Defendant had a duty to have procedures in place to detect and prevent the improper  access and misuse of Plaintiffs’ and Class members’ PII, and a duty to timely notify Plaintiffs of a data  breach of their PII.  Defendant also had a duty to adequately train personnel regarding the protection  of Plaintiffs’ and Class members’ PII.  The breach of security, unauthorized access, and resulting  injury to Plaintiffs’ and the Class were reasonably foreseeable, particularly in light of its inadequate  data security policies and procedures and lack of training and widely reported spoofing incidents.   52.  Plaintiffs hereby incorporate all other paragraphs of this Complaint and restates them as  if fully set forth herein.   53.  The UCL defines unfair business competition to include any “unlawful, unfair or  fraudulent” act or practice, as well as any “unfair, deceptive, untrue or misleading” advertising.  Cal.  Bus. Prof. Code § 17200.    54.  A business act or practice is “unlawful” if it violates any established state or federal  law.   55.  SRG’s practices were unlawful and in violation of Civil Code § 1798.81.5(b) because  SRG failed to take reasonable measures in protecting Plaintiffs’ and Class members’ PII, as alleged  herein.   56.  SRG’s practices were also unlawful and in violation of Civil Code § 1798.82 because  SRG unreasonably delayed informing Plaintiffs and Class members about the breach of security after  SRG knew the breach occurred.   57.  Plaintiffs reserve the right to identify other violations of law as the facts develop.    60.  Plaintiffs hereby incorporate all other paragraphs of this Complaint and restates them as  if fully set forth herein.   61.  The UCL defines unfair business competition to include any “unlawful, unfair or  fraudulent” act or practice, as well as any “unfair, deceptive, untrue or misleading” advertising.  Cal.  Bus. Prof. Code § 17200.   65.  Plaintiffs hereby incorporate all other paragraphs of this Complaint and restates them as  if fully set forth herein.   66.  Employees of Defendant SRG provided their PII in connection with their employment  with SRG in order to verify their identity, receive compensation, and in order for SRG to have  complete employee records for tax purposes, among other things.   67.  Plaintiffs and the Employee Class members provided various forms of PII to SRG as a  condition precedent to their employment with SRG, or in connection with employer sponsored  benefits.   68.  Understanding the sensitive nature of PII, SRG implicitly promised Plaintiffs and the  Employee Class members that it would take adequate measures to protect their PII.   74.  Plaintiff Annie Fulton hereby incorporates all other paragraphs of this Complaint and  restates them as if fully set forth herein.    75.  Defendant conducts business in California and owns computerized data that includes  the PII of California residents, including Plaintiff’s PII.   76.  Plaintiff Annie Fulton was a California resident at the time she worked for Defendant.     77.  Defendant’s information security systems were breached in January 2017, however,  Defendant did not inform Plaintiff and the California Employee Class until sometime in late March  2017.    81.  Plaintiffs Cary Berger, Christine Willetts, Ruth Phelps, and Irene Sung hereby  incorporate all other paragraphs of this Complaint and restates them as if fully set forth herein.    82.  Defendant conducts business in Massachusetts and owns computerized data that  includes the PII of Massachusetts residents, including Plaintiffs’ PII.   83.  Plaintiffs were at all relevant times residents of Massachusetts.   84.  Defendant’s information security systems were breached in January 2017, however,  Defendant did not inform Plaintiffs until sometime in late March 2017.    85.  By failing to timely disclose to Plaintiffs and each member of the proposed  Massachusetts Employee Class that their PII was reasonably believed to have been acquired by an  unauthorized person, Defendant violated Mass. Gen. Laws §§ 93H-1, et seq.  Defendant failed to  notify Plaintiffs and the proposed Massachusetts Employee Class of the 2017 data breach in the most  expedient time possible and unreasonably delayed notifying those affected since law enforcement did  not determine notification would hinder a criminal investigation.   86.  Defendant could have notified Plaintiffs and the proposed Massachusetts Employee  Class sooner had it implemented and maintained adequate policies and procedures.    88.  Plaintiff Kimberly Carboni hereby incorporates all other paragraphs of this Complaint  and restates them as if fully set forth herein.    89.  Defendant conducts business in Florida and owns computerized data that includes the  PII of Florida residents, including Plaintiff’s PII.   90.  Plaintiff was at all relevant times a resident of Florida.     91.  Defendant’s information security systems were breached in January 2017, however,  Defendant did not inform Plaintiff until sometime in late March 2017.    92.  By failing to timely disclose to Plaintiff and each member of the proposed Florida  Employee Class that their PII was reasonably believed to have been acquired by an unauthorized  person, Defendant violated Fla. Sta. §§ 501.171, 292.0041, 282.318(2)(i), et seq.  Defendant failed to  notify Plaintiff and the proposed Florida Employee Class of the 2017 data breach in the most  expedient time possible and unreasonably delayed notifying those affected since law enforcement did  not determine notification would hinder a criminal investigation.     93.  Defendant could have notified Plaintiff and the proposed Florida Employee Class  sooner had it implemented and maintained adequate policies and procedures.    94.  As a direct and proximate result of Defendant’s violation of Fla. Sta. §§ 501.171,  292.0041, 282.318(2)(i), et seq., Plaintiff and Florida Employee Class members have been injured.   Plaintiff and Florida Employee Class members are therefore entitled to damages, injunctive relief, and  reasonable attorneys’ fees and costs.  Breach of Implied Contract—On Behalf of the Nationwide Employee Class   Negligence—On Behalf of All Classes   Violation of the Security Breach Notification Law, Fla. Stat. §§ 501.171, 292.0041, 282.318(2)(i),  et seq.—by Kimberly Carboni on Behalf of the Florida Employee Class   Violation of the Security Breach Notification Law, Mass. Gen. Laws §§ 93H-1, et seq.—by Cary  Berger, Christine Willetts, Ruth Phelps, and Irene Sung on Behalf of the Massachusetts  Employee Class    Violation of the Security Breach Notification Law, N.C. Gen. Stat. §§ 75-61, 75-65, et seq.—by  Emmalyne Owens on Behalf of the North Carolina Employee Class    Violation of the Security Breach Notification Law, Cal. Civil Code § 1798.82—by Annie Fulton  on Behalf of the California Employee Class   What is a Phishing Attack?  