You are on page 1of 45
 
Class Action Complaint – Page 112345678910111213141516171819202122232425262728Khesraw Karmand (Cal. Bar No. 280272)Matthew J. Preusch (Cal. Bar No. 298144)kkarmand@kellerrohrback.commpreusch@kellerrohrback.com
KELLER ROHRBACK L.L.P.
1129 State Street, Suite 8Santa Barbara, California 93101Tel.: (805) 456-1496 / Fax (805) 456-1497Lynn Lincoln Sarko,
 pro hac vice forthcoming 
lsarko@kellerrohrback.comGretchen Freeman Cappio,
 pro hac vice forthcoming 
gcappio@kellerrohrback.comCari Campen Laufenberg,
 pro hac vice forthcoming 
claufenberg@kellerrohrback.comAmy N.L. Hanson,
 pro hac vice forthcoming 
ahanson@kellerrohrbak.com
KELLER ROHRBACK L.L.P.
1201 Third Ave., Suite 3200Seattle, Washington 98101Tel: (206) 623-1900 / Fax: (206) 623-3384
Attorneys for PlaintiffsUNITED STATES DISTRICT COURTCENTRAL DISTRICT OF CALIFORNIA
Michael Corona and Christina Mathis,individually and on behalf of otherssimilarly situated,Plaintiffs,v.Sony Pictures Entertainment, Inc.,Defendant.)))))))))))CASE NO.CLASS ACTION COMPLAINTJURY TRIAL DEMANDED
Case 2:14-cv-09600 Document 1 Filed 12/15/14 Page 1 of 45 Page ID #:1
 
Class Action Complaint – Page 212345678910111213141516171819202122232425262728
I.
 INTRODUCTION
Plaintiffs Michael Corona and Christina Mathis (“Plaintiffs”), individuallyand on behalf of all others similarly situated, alleges the following against SonyPictures Entertainment, Inc. (“Defendant” or “Sony”), based where applicable on personal knowledge, information and belief, and the investigation and research of counsel.
II.
 NATURE OF THE ACTION
1. An epic nightmare, much better suited to a cinematic thriller than toreal life, is unfolding in slow motion for Sony’s current and former employees:Their most sensitive data, including over 47,000 Social Security numbers,employment files including salaries, medical information, and anything else thattheir employer Sony touched, has been leaked to the public, and may even be in thehands of criminals.2. At its core, the story of “what went wrong” at Sony boils down to twoinexcusable problems: (1) Sony failed to secure its computer systems, servers, anddatabases (“Network”), despite weaknesses that it has known about for years, because Sony made a “business decision to accept the risk” of losses associatedwith being hacked; and (2) Sony subsequently failed to timely protect confidentialinformation of its current and former employees from law-breaking hackers who(a) found these security weaknesses, (b) obtained confidential information of Sony’s current and former employees stored on Sony’s Network, (c) warned Sony
Case 2:14-cv-09600 Document 1 Filed 12/15/14 Page 2 of 45 Page ID #:2
 
Class Action Complaint – Page 312345678910111213141516171819202122232425262728that it would publicly disseminate this information, and (d) repeatedly followedthrough by publicly disseminating portions of the information that they claim tohave obtained from Sony’s Network through multiple dumps of internal data fromSony’s Network.3. The security weaknesses in Sony’s Network exposed sensitive personal identifying information (“PII”) to cyber criminals, who obtained that PII(the “Data Breach”). This PII includes, but is not limited to, current and formeemployee names, home addresses, telephone numbers, birthdates, Social Securitynumbers, email addresses, salaries and bonus plans, healthcare records, performance evaluations, scans of passports and visas, reasons for termination,details of severance packages and other sensitive employment and personalinformation.4. Sony owed a legal duty to Plaintiffs and the other Class members tomaintain reasonable and adequate security measures to secure, protect, andsafeguard their PII stored on its Network. Sony breached that duty by one or moreof the following actions or inactions: failing to design and implement appropriatefirewalls and computer systems, failing to properly and adequately encrypt data,losing control of and failing to timely re-gain control over Sony Network’scryptographic keys, and improperly storing and retaining Plaintiffs’ and the other Class members’ PII on its inadequately protected Network.
Case 2:14-cv-09600 Document 1 Filed 12/15/14 Page 3 of 45 Page ID #:3

Reward Your Curiosity

Everything you want to read.
Anytime. Anywhere. Any device.
No Commitment. Cancel anytime.
576648e32a3d8b82ca71961b7a986505