23. The requirements of Federal Rule of Civil Procedure 23(a), 23(b)(1), 23(b)(2), and 23(b)(3)  are met with respect to the Class defined below.   36.   Waste Management offers a wide range of services including solid waste and  recyclable materials collection services for residential, industrial, municipal and commercial  customers in 48 states. It serves over 20 million residential customers and over 2 million  commercial customers.   37.  Waste Management currently has in excess of 48,000 full-time employees.   38.  Waste Management requires its employees to provide sensitive PII as a condition  of employment. Waste Management’s employees are also required to provide the PII of their  dependents.  The Data Breach   39.  On January 21, 2021, Waste Management detected suspicious activity on its  network.   40.  Waste Management later determined that between January 21, 2021 and January  23, 2021, an unauthorized actor(s) accessed Waste Management’s network and acquired certain  files containing the sensitive PII of Waste Management’s current and former employees.     42.  The unauthorized actor(s) were able to gain access to Waste Management’s  network as a result of Waste Management’s failure to take necessary and required minimal steps  to secure Plaintiffs’ and the Class Members’ PII. Similarly, Waste Management’s failure to take  reasonable steps after detecting suspicious activity on January 21, 2021 allowed the criminal third  party actor(s) to maintain access to Waste Management’s network on January 22 and 23, 2021.   43.  Despite first detecting “suspicious activity” on January 21, 2021, Waste  Management did not begin notifying victims of the breach until May 28, 2021. A copy of a sample  notice letter filed with the California Attorney General is attached hereto as Exhibit 4.   44.  The notice letters offer victims of the breach one free year of credit and identity  monitoring services through Experian.  Plaintiffs and the Class Have Been Injured and Face Substantial Risk of Future Injury   45.  Plaintiffs’ and Class Members’ stolen personal data represents essentially one-stop  shopping for identity thieves. The unauthorized access by the hackers has provided cyber criminals  with the tools to perform the most thorough identity theft—they have obtained all the essential PII  to mimic the identity of the user.    46.  Criminals often trade stolen PII on the “cyber black market” for years following a  breach. Cybercriminals can also post stolen PII on the internet, thereby making such information  publicly available.    48.  According to the Federal Trade Commission (“FTC”), identity theft wreaks havoc  on consumers’ finances, credit history, and reputation and can take time, money, and patience to  resolve.5 Identity thieves use stolen personal information for a variety of crimes, including credit  card fraud, phone or utilities fraud, and bank and finance fraud.6   49.  Identity thieves may commit various types of crimes such as immigration fraud,  obtaining a driver’s license or identification card in the victim’s name but with another’s picture,  applying and opening credit card accounts, and/or using the victim’s information to obtain a  fraudulent tax refund or fraudulent unemployment benefits. The United States government and  privacy experts acknowledge that it may take years for identity theft to come to light and be  detected.   50.  Recently, the FTC has released its updated publication on protecting PII for  businesses, which includes instructions on protecting PII, properly disposing of PII, understanding  network vulnerabilities, implementing policies to correct security problems, using intrusion  detection programs, monitoring data traffic, and having in place a response plan.   85.  Plaintiffs bring all claims as Class claims under Federal Rule of Civil Procedure   87.  Plaintiffs also bring this action on behalf of the following Subclass of similarly  siuated persons:  The Employee Subclass  All natural persons residing in the United States and currently or formerly employed by  Waste Management whose personal information was compromised in the Waste  Management Data Breach, which occurred between approximately January 21, 2021 and  January 23, 2021.   88.  The Nationwide Class and Subclass may be referred to collectively, where  appropriate, as the “Class.”   89.   Excluded from the Class are Defendant; any entity in which Defendant has a  controlling interest, is a parent or subsidiary, or which is controlled by Defendant; and the  affiliates, legal representatives, attorneys, heirs, predecessors, successors, and assigns of  Defendant. Also excluded are the judges and court personnel in this case and any members of their  immediate families.   90.  Plaintiffs reserve the right to modify and/or amend the Class or Subclass  definitions, including but not limited to adding additional subclasses, as necessary.   91.  Certification of Plaintiffs’ claims for Class-wide treatment is appropriate because  Plaintiffs can prove the elements of the claims on a Class-wide basis using the same evidence as  would be used to prove those elements in individual actions alleging the same claims.   93.  Numerosity. The Class and Subclass are so numerous that joinder of all members  is impracticable. The Nationwide Class includes at least hundreds of thousands of individuals  whose personal data was entrusted to Waste Management and compromised in the Waste  Management Data Breach.   94.  Upon information and belief, the Subclass includes at least hundreds of individuals  whose personal data was entrusted to Waste Management and compromised in the Waste  Management Data Breach.   95.  Commonality. There are numerous questions of law and fact common to Plaintiffs  and the Class, including the following:  • whether Defendant engaged in the wrongful conduct alleged in this Complaint;  • whether Defendant’s conduct was unlawful;  • whether Defendant failed to implement and maintain reasonable systems and security  procedures and practices to protect PII;  • whether Defendant unreasonably delayed in notifying those affected of the security  breach;  • whether Defendant owed a duty to Plaintiffs and Class Members to adequately protect  their PII and to provide timely and accurate notice of the Waste Management Data  Breach to Plaintiffs and Class Members ;  • whether Defendant breached its duties to protect the PII of Plaintiffs and Class  Members by failing to provide adequate data security and failing to provide timely and  adequate notice of the Waste Management Data Breach to Plaintiffs and the Class  Members;  • whether Defendant’s conduct was negligent;  • whether Defendant wrongfully or unlawfully failed to inform Plaintiffs and Class  Members that it did not ensure that networks and security practices adequate to  reasonably protect PII were used when handling Plaintiffs’ and the Class Members’ 