10. The exact number of persons affected by the data breach is currently unknown  but potentially effects millions of account holders and customers.  The data  breach affected potentially millions of credit and debit cards maintained by  37. PLAINTIFF brings this action on behalf of herself and on behalf of all others  similarly situated (“the Class”).   49. PLAINTIFF incorporates by reference all of the above paragraphs of this  Complaint as though fully stated herein.  50. DEFENDANT'S failure to disclose information concerning the data breach  directly and promptly to affected customers, constitutes a fraudulent act or  practice in violation of California Business & Professions Code section 17200  et seq.  51. DEFENDANT’S acts, practices, and omissions detailed above constitute  fraudulent practices in that they are likely to deceive a reasonable consumer  in that PLAINTIFF and Class members were induced to shop at Neiman  Marcus stores and pay for merchandise using credit cards based on the  understanding, whether explicit or implied, that DEFENDANT had  implemented appropriate security protocols and that, in the event of a loss or  breach, DEFENDANT would promptly notify affected customers.   52. DEFENDANT’S acts, practices, and omissions detailed above, constitute  unlawful practices and/or acts as they constitute violations of numerous  provisions of California law, including but not limited to Cal. Civ. Code §  1798.80 et seq.   55. PLAINTIFF incorporates by reference all of the above paragraphs of this  Complaint as though fully stated herein.   56. DEFENDANT came into possession of the INFORMATION of PLAINTIFF  and other Class members and thus had a duty to exercise reasonable care in  safeguarding and protecting such INFORMATION from being compromised,  lost, stolen, misused, and/or disclosed to unauthorized parties.   58. DEFENDANT had a duty to have procedures in place to detect and prevent  the loss or unauthorized dissemination of said INFORMATION.    59. DEFENDANT, through its actions and/or omissions, unlawfully breached its  duty to PLAINTIFF and Class members by failing to exercise reasonable care  in protecting and safeguarding said INFORMATION within its possession.   60. DEFENDANT, through its actions and/or omissions, unlawfully breached its  duty to PLAINTIFF and Class members to exercise reasonable care by failing  to have appropriate procedures in place to detect and prevent dissemination of  PLAINTIFF’S and other Class members’ INFORMATION.  61. DEFENDANT, through its actions and/or omissions, unlawfully breached its  duty to timely disclose to PLAINTIFF and the Class members the fact that  their INFORMATION had been compromised.   62. DEFENDANT'S negligent and wrongful breach of its duties owed to  PLAINTIFF and the Class proximately caused PLAINTIFF and Class  members' INFORMATION to be compromised.   63. As a direct and proximate cause of DEFENDANT’S failure to exercise  reasonable care and use commercially reasonable security measures its  databases were accessed without authorization and customers’  INFORMATION was compromised and exposed to unauthorized access.   66. PLAINTIFF incorporates by reference all of the above paragraphs of this  Complaint as though fully stated herein.   67. As herein, DEFENDANT violated various statutes, including California Civil  Code §§ 1798.80 et seq., which requires a business that licenses, owns, or  maintains INFORMATION to give prompt notification to persons potentially  affected by a security breach.    68. This statute was intended to protect customers’ information from  unauthorized disclosure and to ensure prompt notification of any such  unauthorized, unlawful disclosure.    70. By engaging in the negligent conduct as alleged above, DEFENDANT was  guilty of oppression, fraud, or malice, in that DEFENDANT acted or failed to  act with a willful and conscious disregard of PLAINTIFF’S and Class  members’ rights.  PLAINTIFF therefore seeks an award of damages,  including punitive damages, in an amount to be proven at trial, on behalf of  herself and the Class. 71. PLAINTIFF incorporates by reference all of the above paragraphs of this  Complaint as though fully stated herein.   72. Plaintiff and Class members were the owners and possessors of their  INFORMATION. As the result of DEFENDANT'S wrongful conduct,  DEFENDANT has interfered with the PLAINTIFF’S and Class members'  rights to possess and control such property, to which they had a superior right  of possession and control at the time of conversion.   73. As a direct and proximate result of DEFENDANT'S conduct, PLAINTIFF  and the Class members suffered injury, damage, loss or harm and therefore  seek compensatory damages.  74. Plaintiff and the Class members did not consent to DEFENDANT'S  mishandling and loss of their INFORMATION.   76. PLAINTIFF incorporates by reference all of the above paragraphs of this  Complaint as though fully stated herein.   77. The INFORMATION of PLAINTIFF and other consumers of DEFENDANT  was and continues to be private information.  PLAINTIFF and each member  of the Class had a legally protected informational privacy interest in the  confidential and sensitive information that DEFENDANT obtained and  unlawfully disseminated.   78. PLAINTIFF and other members of the Class had a legally protected  autonomy privacy interest regarding their INFORMATION without unwanted  observation, intrusion, or interference.   79. PLAINTIFF and members of the Class reasonably expected that their  confidential and sensitive information would be kept private.   8. DEFENDANT is a nationwide retailer ranked 504th on the Fortune 1,000 list.  PLAINTIFF is a regular shopper at Neiman Marcus stores, and uses her  Neiman Marcus credit card regularly at a Neiman Marcus store in this  Judicial District.  Plaintiff has made numerous purchases at Neiman Marcus  between July 2013 and October 2013 and as recently December 26, 2013.  80. DEFENDANT’S failure to secure and protect PLAINTIFF’S and other  customers’ INFORMATION resulted in the public disclosure and publication  of such private information to third parties, including but not limited to  hackers.    81. Dissemination of PLAINTIFF’S and other consumers’ INFORMATION is not  of a legitimate public concern; publicity of their INFORMATION would be,  is, and will continue to be offensive to PLAINTIFF, putative Class members,  and other reasonable people.   82. DEFENDANT’S wrongful actions and/or inaction as described above  constituted and continue to constitute a serious invasion of the privacy of  PLAINTIFF and other consumers by publicly disclosing private facts (i.e.,  their INFORMATION).   84. In violating the privacy of PLAINTIFF and Class members as alleged above,  DEFENDANT was guilty of oppression, fraud, or malice, in that  DEFENDANT acted or failed to act with a willful and conscious disregard of  PLAINTIFF’S and Class members’ rights.  PLAINTIFF therefore seeks an  award of damages, including punitive damages, in an amount to be proven at  trial, on behalf of herself and the Class. 85. PLAINTIFF incorporates by reference all of the above paragraphs of this  Complaint as though fully stated herein.   86. DEFENDANT owns and/or licenses computerized data that includes  PLAINTIFF’S and Class members’ INFORMATION and/or maintains  computerized data that includes INFORMATION that it does not own.  As  such, DEFENDANT owed PLAINTIFF and Class members a duty to  implement and maintain reasonable security procedures and practices  appropriate to the nature of the information, to protect the personal  information from unauthorized access, destruction, use, modification, or  disclosure, and to promptly notify and disclose any breach of security and/or  unauthorized access of such information to persons affected thereby.    96. PLAINTIFF and the Class members delivered and entrusted their  INFORMATION to DEFENDANT for the sole purpose of receiving services  from DEFENDANT.   97. During the time of bailment, DEFENDANT owed PLAINTIFF and the Class  members a duty to safeguard this information properly and maintain  reasonable security procedures and practices to protect such information.  DEFENDANT breached this duty.   98. As a result of these breaches of duty, PLAINTIFF and the Class members  have suffered harm, as alleged above.   99. PLAINTIFF seeks actual damages on behalf of the Class.  100. Moreover, DEFENDANT, by and through the conduct alleged above, was  guilty of oppression, fraud, or malice, in that DEFENDANT acted or failed to  act with a willful and conscious disregard of PLAINTIFF’S and Class  members’ rights.  PLAINTIFF therefore seeks an award of damages,  including punitive damages, in an amount to be proven at trial, on behalf of  herself and the Class. BAILMENT   CONVERSION   INVASION OF PRIVACY   NEGLIGENCE  NEGLIGENCE PER SE  UNLAWFUL, UNFAIR, AND FRAUDULENT BUSINESS  PRACTICES UNDER CALIFORNIA BUSINESS AND PROFESSIONS  CODE § 17200, ET SEQ.  VIOLATION OF THE CALIFORNIA DATA BREACH ACT, CAL CIV.  CODE § 1798.80, ET SEQ.  