13.  Plaintiff is a former employee of Defendants who worked for Defendants in the  years from approximately 2005 until 2015.  She worked for Defendants in Colorado.     14.  As a condition of her offer of employment from Defendants, Plaintiff, along with  every other employee of Defendants, was required to provide personal identifying information  including first and last name, address, Social Security number, and to fill out tax forms providing  additional confidential information to Defendants.   15.  Defendants retains this and other confidential information that is provided, by all  current and former employees, on various computer systems.       17.  Plaintiff and Defendants’ employees also have an expectation of privacy and  confidentiality in their salary information and tax information that is maintained on Defendants’  systems.     18.  Defendants employ hundreds of people across three states.  As a result,  Defendants are well versed in the requirements of confidentiality and obligations to safeguard  and not disclose confidential information.     19.  On May 2, 2016, Plaintiff received a letter from a “Return Mail Processing  Center” in Portland, Oregon.  The appearance of the letter and the nature and identity of the  sender indicate that the communication was a form letter of the type that is mass produced and  distributed in bulk to many recipients.   The letter contained a subject line stating, “Notice of  Data Breach” and was attached to a document entitled, “Steps You Can Take to Protect Against  Identify Theft and Fraud.”     20.  The Notice of Data Breach indicates that, on April 8, 2016, Defendants  experienced “an incident that may affect the security of your personal information” and describes  that Defendants disclosed “2015 IRS Tax Form W-2 information” to cyber-criminals engaged in  an email spoofing attack.  Before it was determined that the request was fraudulent, Defendants  disclosed the Plaintiffs’ and putative class members’ names, home addresses, Social Security  numbers, and 2015 compensation data.       21.  The Data Breach was not actually detected by Defendants until April 22, 2016,  which was14 days after Defendants had disclosed the confidential information of its employees.     23.  On information and belief, the improper disclosure of this information affects  numerous, perhaps hundreds, of Defendants’ employees, all of whom had their confidential PII  disclosed without their authorization or consent.     24.  In fact, on information and belief, every employee of Defendants in the year 2015,  whether they are a current or former employee, had their information improperly disclosed as a  result of the Data Breach.     25.  Cyber-attacks of this nature against American corporations are commonplace and  foreseeable.     26.  Similar computer intrusions occur routinely in which cyber-criminals impersonate  a high level executive within the corporation and send “phishing” or “spoofing” emails to  employees of a company in which they request either access to confidential and sensitive  information, or the transfer of money.     27.  These types of attempted intrusions into the computer systems of corporations are  commonly referred to as Business E-mail Compromise Scams (“BEC”) and phishing scams.     28.  As a result, law enforcement and cyber-security professionals consistently warn  corporations about this exact type of cyber threat and provide best practice guidelines and  trainings for preventing, detecting, and dealing with cyber-attacks.      30.  This information is at heightened risk at or around the April tax filing deadline as  cyber-criminals attempt to file for and/or obtain fraudulent tax refund payments.     31.  The Federal Bureau of Investigation provides updates and notifications of cyber- security threats including warnings about this exact type of threat.     32.  In addition, the United States government and private security research firms  widely distribute reports about new types of malicious cyber-security threats that should have put  Defendants on notice that they were at risk.     33.  Despite these and other warnings and having known or should have known of the  potential for cyber-security threats, Defendants failed to maintain reasonable and adequate  security measures to safeguard Plaintiff’s and other employees’ PII.     34.  Given the recent increase of data breaches aimed at American corporations,  Defendants should have adopted, implemented, and maintained security measures to protect their  confidential data, including employees’ PII.  Instead, Defendants failed to adopt, implement, or  maintain the necessary security measures and chose instead to remain at risk for cyber-attacks  and implemented only minimal precautions after they learned of the Data Breach.     36.  Defendants also failed to maintain or employ reasonable intrusion prevention and  detection protocols that would have prevented and immediately detected the breach and  disclosure of confidential information as it occurred.     38.  As a result of Defendants’ acts and omissions, including its negligent security  practices, current and former Defendants employees are subject to an increased and concrete risk  of identity theft and tax fraud due to the exposure of their personal and financial information, and  they will have spent and will have to continue to spend substantial time and money securing their  personal information and accounts and protecting their identities.     39.  Defendants’ employees already have been the victim of identity theft and  fraudulent tax filing.  For example, using the information disclosed by Defendants in the Data  Breach, cyber-criminals submitted a fraudulent return the IRS using Plaintiff’s PII.   Consequently, Plaintiff’s tax return was rejected for filing by the IRS, her tax refund has been  delayed, and she has been forced to take steps to address the harm caused by Defendants’  wrongful conduct in the Data Breach.     40.  Identity thieves and cyber-hackers use another’s personal and financial  information including the person’s name, address, Social Security number, and financial  information, without permission, to commit fraud and other crimes.  Identity thieves may commit  various types of crimes, from immigration fraud, obtaining a driver’s license or identification  card in the victim’s name, using the victim’s information to obtain government benefits, to filing  a fraudulent tax return using the victim’s information to obtain refund payments.     42.  There is a strong likelihood that current and former Defendants’ employees, are  already or will become victims of identity fraud given the breadth of information about them that  has been compromised and is now in the hands of cyber-criminals.      43.  Javelin Strategy & Research reported in its 2014 Identity Fraud Study that “[d]ata  breaches are the greatest risk factor for identity fraud.” In 2013, “one in three consumers who  received notification of a data breach became a victim of fraud.” Javelin also found increased  instances of fraud other than credit card fraud, including “compromised lines of credit, internet  accounts, and e-mail payment accounts such as PayPal.”    44.  Defendants’ employees’ will need to monitor their accounts and credit, and will  also need to pay for credit monitoring or credit reports to make sure their credit and identity is  not harmed by thieves. Individuals whose bank information becomes compromised may have to  pay fees to their banks for new debit and credit cards, or have to pay fees to have the cards  shipped faster so that they do not have to wait weeks to make purchases on their accounts. These  individuals may also lose access to their funds and time and money by spending hours on the  phone or in person with banks and credit agencies trying to reverse unauthorized charges, clear  up credit issues, order new cards, or deal with the devastating effects of tax fraud.    46.  Plaintiff has already expended time, effort, and financial resources to begin to  deal with the devastating effects of having her most sensitive information compromised and now  in the hands of criminals.     47.  The United States government and privacy experts acknowledge that it may take  years for identity theft to come to light and be detected, and following the Data Breach, current  and former Defendants employees are now at risk for identity theft and tax fraud for the rest of  their lives.   V.  48.  Plaintiff bring this action on her own behalf, as well as on behalf of all other  similarly situated individuals.   50.  As enumerated above, Defendants engaged in common acts, practices and policies  that violated the Plaintiff’s and Class Members’ rights.  Accordingly, Plaintiff seeks certification  of the proposed class under Fed. R. Civ. P. 23.    