Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 1 of 45 Page ID #:1

1
2
3
4
5
6
7
8
9
10
11
12
13
14

K h esra w K a rm a nd(C a l. B a rN o. 28 027 2)
M at
t
h ew J. P reusch (C a l. B a rN o. 29 8 144)
kka rm a nd@ kellerroh rba ck.com
m preusch @ kellerroh rba ck.com
K E L L E RRO H RB A C K L .L .P .
1129 St
at
eSt
reet
, Suit
e8
Sa nt
a B a rba ra , C a lifornia 9 3101
Tel.:(8 05) 456 -149 6 / F a x(8 05) 456 -149 7
L ynn L incoln Sa rko, pro h a c v icefort
h com ing
lsa rko@ kellerroh rba ck.com
G ret
ch en F reem a n C a ppio, pro h a c v icefort
h com ing
g ca ppio@ kellerroh rba ck.com
C a riC a m pen La ufenberg , pro h a c v icefort
h com ing
cla ufenberg @ kellerroh rba ck.com
A m yN .L. H a nson, pro h a c v icefort
h com ing
a h a nson@ kellerroh rba k.com
K E L L E RRO H RB A C K L .L .P .
1201Th ird A v e., Suit
e3200
Sea t
t
le, W a sh ing t
on 9 8 101
Tel:(206 ) 6 23-19 00/ F a x:(206 ) 6 23-338 4

15
16
17
18

At
t
orneysforP la int
iffs
UN I TE D STA TE S D I STRI C T C O URT
C E N TRA L D I STRI C T O F C A L I F O RN I A

19
20
21
22
23
24
25
26
27

M ich a elC orona a ndC h rist
ina M a t
h is,
indiv idua llya ndon beh a lf of ot
h ers
sim ila rlysit
ua t
ed,

)
)
)
)
P la int
iffs, )
)
v.
)
)
SonyP ict
uresEnt
ert
a inm ent
, I nc.,
)
)
D efenda nt
. )

C A SE N O .
C L A SS A C TI O N C O M P L A I N T

JURYTRIA L D EM A N D ED

28
C la ssA ct
ion C om pla int–P a g e1

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 2 of 45 Page ID #:2

1
2
3
4

I.

I N TRO D UC TI O N

P la int
iffsM ich a elC orona a ndC h rist
ina M a t
h is(“P la int
iffs”), indiv idua lly
a ndon beh a lf of a llot
h erssim ila rlysit
ua t
ed, a lleg est
h efollow ing a g a instSony

5

P ict
uresEnt
ert
a inm ent
, I nc. (“D efenda nt
”or“Sony”), ba sedw h erea pplica bleon

6

persona lknow ledg e, inform a t
ion a ndbelief, a ndt
h einv est
ig a t
ion a ndresea rch of

7
8

counsel.
II.

9
10
11

1.

N A TURE O F TH E A C TI O N

A n epic nig h t
m a re, m uch bet
t
ersuit
edt
o a cinem a t
ic t
h rillert
h an t
o

rea llife, isunfolding in slow m ot
ion forSony’scurrenta nd form erem ployees:

12
13

Th eirm ostsensit
iv eda t
a , including ov er47 ,000Socia lSecurit
ynum bers,

14

em ploym entfilesincluding sa la ries, m edica linform a t
ion, a nda nyt
h ing elset
h at

15

t
h eirem ployerSonyt
ouch ed, h a sbeen lea kedt
ot
h epublic, a nd m a yev en bein t
he

16
17
18
19

h a ndsof crim ina ls.
2.

A tit
score, t
h est
oryof “w h a tw entw rong ”a tSonyboilsdow n t
ot
wo

inexcusa bleproblem s:(1) Sonyfa iledt
o secureit
scom put
ersyst
em s, serv ers, a nd

20
21

da t
a ba ses(“N et
w ork”), despit
ew ea knessest
h a tith a sknow n a boutforyea rs,

22

beca useSonym a dea “businessdecision t
o a cceptt
h erisk”of lossesa ssocia t
ed

23

w it
h being h a cked;a nd(2) Sonysubsequent
lyfa iledt
ot
im elyprot
ectconfident
ia l

24
25

inform a t
ion of it
scurrenta nd form erem ployeesfrom la w -brea king h a ckersw h o

26

(a ) foundt
h esesecurit
yw ea knesses, (b) obt
a inedconfident
ia linform a t
ion of

27
28

Sony’scurrenta nd form erem ployeesst
oredon Sony’sN et
w ork, (c) w a rnedSony

C la ssA ct
ion C om pla int–P a g e2

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 3 of 45 Page ID #:3

1
2

t
h a titw ouldpubliclydissem ina t
et
h isinform a t
ion, a nd(d) repea t
edlyfollow ed
t
h roug h bypubliclydissem ina t
ing port
ionsof t
h einform a t
ion t
h a tt
h eycla im t
o

3
4
5
6

h a v eobt
a ined from Sony’sN et
w orkt
h roug h m ult
ipledum psof int
erna lda t
a from
Sony’sN et
w ork.
3.

Th esecurit
yw ea knessesin Sony’sN et
w orkexposedsensit
iv e

7
8

persona lident
ifying inform a t
ion (“P I I ”) t
o cybercrim ina ls, w h o obt
a inedt
h a tP I I

9

(t
h e“D a t
a B rea ch ”). Th isP I I includes, butisnotlim it
edt
o, currenta nd form er

10

em ployeena m es, h om ea ddresses, t
eleph onenum bers, birt
h da t
es, Socia lSecurit
y

11
12

num bers, em a ila ddresses, sa la riesa ndbonuspla ns, h ea lt
h ca rerecords,

13

perform a nceev a lua t
ions, sca nsof pa ssport
sa ndv isa s, rea sonsfort
erm ina t
ion,

14

det
a ilsof sev era ncepa cka g esa ndot
h ersensit
iv eem ploym enta ndpersona l

15
16
17
18

inform a t
ion.
4.

Sonyow eda leg a ldut
yt
o P la int
iffsa ndt
h eot
h erC la ssm em berst
o

m a int
a in rea sona blea nda dequa t
esecurit
ym ea surest
o secure, prot
ect
, a nd

19
20

sa feg ua rdt
h eirP I I st
oredon it
sN et
w ork. Sonybrea ch edt
h a tdut
ybyoneorm ore

21

of t
h efollow ing a ct
ionsorina ct
ions:fa iling t
o desig n a nd im plem enta ppropria t
e

22

firew a llsa ndcom put
ersyst
em s, fa iling t
o properlya nda dequa t
elyencryptda t
a,

23
24

losing cont
rolof a nd fa iling t
ot
im elyre-g a in cont
rolov erSonyN et
w ork’s

25

crypt
og ra ph ic keys, a nd im properlyst
oring a ndret
a ining P la int
iffs’a ndt
h eot
h er

26
27

C la ssm em bers’P I I on it
sina dequa t
elyprot
ect
edN et
w ork.

28
C la ssA ct
ion C om pla int–P a g e3

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 4 of 45 Page ID #:4

1
2

5.

A st
h eresultof Sony’sfa iluret
o secureit
sN et
w ork, P la int
iffs’a nd

t
h eot
h erC la ssm em bers’P I I w a scom prom ised, pla cing t
h em a ta n increa sedrisk

3
4
5
6

of fra uda nd ident
it
yt
h eft
, a ndca using directfina ncia lexpensesa ssocia t
edw it
h
creditm onit
oring , repla cem entof com prom isedcredit
, debita ndba nkca rd
num bers, a ndot
h erm ea suresneededt
o prot
ecta g a instt
h em isuseof t
h eirP I I

7
8
9
10

a rising from t
h eD a t
a B rea ch .
6.

Sonyisno st
ra ng ert
o da t
a brea ch es, m a king it
sv ulnera bilit
yt
ot
h is

la t
esta t
t
a ckpa rt
icula rlysurprising a ndeg reg ious. F orexam ple, in A pril2011,

11
12

Sony’sP la ySt
at
ion v ideo g a m enet
w orksuffereda m a j
orbrea ch w h en h a ckers

13

st
olem illionsof usera ccount
sfrom t
h eonlineg a m ing serv ice.

14

7.

G iv en t
h erepea t
edda t
a brea ch essufferedbySony, a sw ella srecent

15
16

sig nifica ntda t
a brea ch ev ent
sin t
h eret
a ilercont
ext
, Sonyknew orsh ouldh a v e

17

know n t
h a tsuch a securit
ybrea ch w a slikelya ndt
a ken a dequa t
epreca ut
ionst
o

18

prot
ectit
scurrenta nd form erem ployees’P I I .

19
20
21
22

8.

I n fa ct
, recent
lylea kedem a ilsa nd int
erna la ssessm ent
srev ea lt
h at

Sony’sow n inform a t
ion t
ech nolog y(“IT”) depa rt
m enta nd, sepa ra t
ely, it
sg enera l
counselbeliev edt
h a tit
st
ech nolog ica lsecurit
ya ndem a ilret
ent
ion policiesra n t
he

23
24

riskof m a king t
oo m uch da t
a v ulnera blet
o at
t
a ck. I f onlySonyh a d h eededit
sow n

25

a dv icein t
im e.

26
27
28
C la ssA ct
ion C om pla int–P a g e4

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 5 of 45 Page ID #:5

1
2
3
4

I I I . JURI SD I C TI O N

9.

Th isC ourth a sdiv ersit
yj
urisdict
ion ov ert
h isa ct
ion pursua ntt
ot
he

C la ssA ct
ion F a irnessA ct(“C A F A ”), 28 U.S.C . § 1332(d)(2). P la int
iff C orona a nd

5

D efenda nta recit
izensof differentst
at
es. Th ea m ountin cont
rov ersyexceeds$5

6

m illion, a ndt
h erea rem oret
h a n 100put
at
iv ecla ssm em bers.

7
8
9
10

10.

Th isC ourth a spersona lj
urisdict
ion ov ert
h eD efenda ntbeca use

D efenda ntislicensedt
o do businessin C a lifornia orot
h erw iseconduct
sbusiness
in C a lifornia .

11
12

11.

Venueisproperin t
h isC ourtpursua ntt
o 28 U.S.C . § 139 1(b) beca use

13

unla w fulpra ct
icesa rea lleg edt
o h a v ebeen com m it
t
ed in t
h isfedera lj
udicia l

14

dist
ricta ndD efenda ntreg ula rlyconduct
sbusinessin t
h isdist
rict
.

15
I V.

16
17
18
19

12.

P A RTI E S

P la int
iff M ich a elC orona iscurrent
lya residentof t
h eSt
at
eof

Virg inia . P la int
iff C orona isa form erem ployeeof SonyP ict
uresEnt
ert
a inm ent
.
Sonyem ployedC orona from 2004t
o 2007 in C ulv erC it
y, C a lifornia . P la int
iff

20
21

C orona ’sP I I w a scom prom isedw h en h a ckersa ccessedSony’sN et
w ork, including

22

butnotlim it
edt
o h isfullna m e, Socia lSecurit
yN um ber, birt
h da t
e, form era ddress,

23

sa la ryh ist
ory, a ndrea son forresig ning . I n a ddit
ion, t
h eP I I of P la int
iff C orona ’s

24
25

w ifea ndda ug h t
erw a sa lso com prom ised in t
h eD a t
a B rea ch . To da t
e, P la int
iff

26

C orona h a sincurredcost
s, including spending ov er$7 00fora yea rof ident
it
yt
h eft

27
28

prot
ect
ion from L ifeL ockforh im a ndh isfa m ily. H eh a sexpended40-50h ours

C la ssA ct
ion C om pla int–P a g e5

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 6 of 45 Page ID #:6

1
2

at
t
em pt
ing t
o sa feg ua rdh im self a nd h isfa m ilym em bersfrom ident
it
yt
h eftor
ot
h erh a rm sca usedbyt
h erelea seof t
h eirP I I a sa resultof t
h eD a t
a B rea ch . G oing

3
4
5
6

forw a rd, P la int
iff C orona a nt
icipa t
esspending considera blet
im eea ch da yin a n
effortt
o cont
a in t
h eim pa ctof Sony’sD a t
a B rea ch on h im self a nd h isfa m ily
m em bers.

7
8
9
10

13.

P la int
iff C h rist
ina M a t
h isisa residentof t
h eSt
at
eof C a lifornia w h o

ist
em pora rilyw orking on a n a ssig nm entoutof st
at
e. P la int
iff M a t
h isisa form er
em ployeeof SonyP ict
uresC onsum erP roduct
s, a subsidia ryof Sony. Sony

11
12

em ployedP la int
iff M a t
h isfrom 2000t
o 2002in C ulv erC it
y, C a lifornia . D espit
e

13

t
h efa ctt
h a tsh eh a snotw orked forSonyin 12yea rs, P la int
iff M a t
h is’sP I I w a s

14

com prom isedw h en h a ckersa ccessedSony’sN et
w ork, including butnotlim it
edt
o

15
16

h erSocia lSecurit
yN um bera nd form era ddress. To da t
e, P la int
iff M a t
h ish a s

17

h ea rdnot
h ing from Sonya boutt
h ebrea ch ot
h ert
h a n a form let
t
erresponset
o h er

18

em a ilinquirya boutt
h eD a t
a B rea ch . P la int
iff M a t
h ish a sincurredcost
s, including

19
20

spending ov er$300fora yea rof ident
it
yt
h eftprot
ect
ion from L ifeL ockfor

21

h erself. Sh eh a sa lrea dyexpended10h oursa t
t
em pt
ing t
o sa feg ua rd h erself from

22

ident
it
yt
h efta ndot
h erh a rm sca usedbyt
h erelea seof h erP I I a sa resultof t
he

23
24

D at
a B rea ch . G oing forw a rd, P la int
iff M a t
h isa nt
icipa t
esspending considera ble

25

t
im eea ch da yin a n effortt
o cont
a in t
h eim pa ctof Sony’sD a t
a B rea ch on h erself.

26
27
28
C la ssA ct
ion C om pla int–P a g e6

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 7 of 45 Page ID #:7

1
2

14.

D efenda ntSonyP ict
uresEnt
ert
a inm ent
, I nc. isa C orpora t
ion

org a nized undert
h ela w sof D ela w a re, w it
h principa lofficesloca t
ed in C ulv er

3
4

C it
y, C ount
yof L osA ng eles, C a lifornia .

5
6

V.

F A C TUA L A L L E G A TI O N S

7

Sony’sD a t
a B rea ch E x
posedt
h eP I I of I t
sC urrenta ndF orm er
E m ployees

8

15.

9

A.

O n inform a t
ion a ndbelief, on N ov em ber24, 2014, a h a ckerg roup

t
h a tca llst
h em selv esG ua rdia nsof P ea ce(“G O P ”) t
ookov erSony’sN et
w ork,

10
11

displa yedt
h eirow n m essa g esa ndskelet
on im a g e, seizedcont
rolof prom ot
iona l

12

Tw it
t
era ccount
sforSonym ov ies, a ndw a rnedSonyt
h a tith a dobt
a ined“secret
s”

13

a ndt
h rea t
enedt
o lea kt
h em t
ot
h eW eb:

14
15
16
17
18
19
20
21
22

16 .

In t
h eda ysfollow ing t
h eD a t
a B rea ch , P I I of currenta nd form erSony

23
24

em ployees, a sw ella sa ct
orsa nd film m a kersw erepubliclypublish edon t
he

25

int
ernet
.

26
27
28

17 .

Specifica lly, on D ecem ber2, 2014, da t
a cont
a ining t
h eP I I of

t
h ousa ndsof Sonyem ployees, including , forexam ple, t
h eirna m es, socia lsecurit
y
C la ssA ct
ion C om pla int–P a g e7

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 8 of 45 Page ID #:8

1
2

num bers, birt
h da t
es, h om ea ddresses, j
ob t
it
les, perform a nceev a lua t
ions, sca nsof
pa ssport
sa nd v isa s, sa la riesa ndbonuspla ns, rea sonsfort
erm ina t
ion a nddet
a ilsof

3
4
5
6

sev era ncepa cka g es, w a spost
edonline.
18 .

Securit
yresea rch erB ria n K rebs, w h o w a st
h efirstt
o uncov erot
h er

recenth ig h -profileda t
a brea ch esa tcom pa niessuch a sTa rg etC orpora t
ion a nd

7
8

H om eD epotInc., report
ed in a D ecem ber2, 2014blog postt
h a tsev era lof h is

9

sourcesh a dconfirm edt
h a tt
h eh a ckersof Sony’sN et
w orkh a dst
olen m oret
h a n 25

10

g ig a byt
esof sensit
iv eda t
a , including Socia lSecurit
ynum bersa nd m edica la nd

11
12
13
14

sa la ryinform a t
ion, on t
ensof t
h ousa ndsof Sonyem ployees.
19 .

K rebsreport
edt
h a th eh a dpersona llyseen sev era lfilescont
a ining

persona linform a t
ion on Sonyem ployeesbeing t
ra dedon onlinet
orrentnet
w orks.

15
16

Th efilesincludea M icrosoftExceldocum entt
h a tcont
a inst
h ena m e, loca t
ion,

17

em ployeeI D , net
w orkuserna m e, ba sesa la rya ndda t
eof birt
h form oret
h a n 6 ,8 00

18

people;a st
at
usreportfrom A pril2014list
ing t
h ena m es, da t
esof birt
h , Socia l

19
20

Securit
ynum bersa ndh ea lt
h sa v ing sa ccountda t
a on m oret
h a n 7 00Sony

21

em ployees;a nda filet
h a ta ppea rst
o bet
h eproductof a n int
erna la uditfrom

22

P ricew a t
erh ouseC oopers, m a deup of screen sh ot
sof dozensof em ployees’federa l

23
24

t
a xrecordsa ndot
h ercom pensa t
ion da t
a . K rebsfoundt
h a ta “com preh ensiv e

25

sea rch on L inkedI n fordozensof na m esin t
h e[M icrosoftExcel]listindica t
e[d]

26
27

t
h a tv irt
ua llya llcorrespond[ed]t
o currentorform erSonyem ployees.”

28
C la ssA ct
ion C om pla int–P a g e8

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 9 of 45 Page ID #:9

1
2

20.

O nt
h eev ening of D ecem ber2, 2014, sourcesreport
edt
h a tSonyC EO

M ich a elL ynt
on a ndco-ch a irm a n A m yP a sca la tSonysenta n int
erna lm em o t
o

3
4
5
6

6 ,500currentem ployeest
h a tconfirm edt
h a ta “la rg ea m ountof confident
ia lSony
P ict
uresEnt
ert
a inm entda t
a h a sbeen st
olen byt
h ecybera t
t
a ckers, including
personnelinform a t
ion,”st
at
edt
h a t“t
h epriv a cya ndsecurit
yof ourem ployeesa re

7
8

of rea lconcern t
o us,”w a rnedt
h a t“w ea renotyetsureof t
h efullscopeof

9

inform a t
ion t
h a tt
h ea t
t
a ckersh a v eorm ig h trelea se”a nd“unfort
una t
elyh a v et
o

10

a skyou t
o a ssum et
h a tinform a t
ion a boutyou in t
h epossession of t
h ecom pa ny

11
12

m ig h tbein t
h eirpossession,”a ndprom ised em ployeest
h a tt
h eyw ouldreceiv ea n

13

em a ilon D ecem ber3, 2014t
h a tout
linedst
epst
o sig n up forident
it
yprot
ect
ion

14

serv ices.

15
16
17
18

21.

O n D ecem ber5, 2014, sourcesreport
edt
h a tSony’scurrentD a t
a

B rea ch h a d lea kedev en m oreP I I t
h a n h a d been report
edprev iously, consist
ing of
47 ,426 uniqueSocia lSecurit
ynum bersa nd na m es, da t
esof birt
h , h om ea ddresses,

19
20

em a ila ddresses, sa la ryinform a t
ion, including Socia lSecurit
ynum bersof m ore

21

t
h a n 15,200currentorform erSonyem ployees. Th eSocia lSecurit
ynum bersw ere

22

copied m oret
h a n 1.1m illion t
im est
h roug h outt
h e6 01filesst
olen byh a ckers

23
24

a ccording t
o I dent
it
yF inderL LC , w h osecom pa nya na lyzedt
h ebrea ch edda t
a . Th e

25

persona linform a t
ion w a sfound in m oret
h a n 500sprea dsh eet
s, 7 5P D F sa nd

26
27
28

sev era lW orddocum ent
s, noneof w h ich w ereprot
ect
edbypa ssw ords. I dent
it
y
F inderL L C C EO Todd F einm a n expla ined t
h a tpersona linform a t
ion such a s
C la ssA ct
ion C om pla int–P a g e9

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 10 of 45 Page ID #:10

1
2

Socia lSecurit
ynum berssh ouldbest
ored in onepla cew it
h pa ssw ordprot
ect
ion
a nd“[l]ea v ing t
h esefilesopen isnotm a king t
h eh a ckers’j
ob difficult
.”Th efiles

3
4
5
6

h a v esincebeen publiclypost
edonlineon m ult
iplefilesh a ring w ebsit
es.
22.

A lso on D ecem ber5, 2014, h a ckersw erereport
edt
o h a v esenta n

em a ilt
o em ployeest
h a tt
h rea t
enedt
h eirfa m iliesif t
h eydid notsupportG ua rdia ns

7
8

of P ea ceg oa ls, st
at
ing :“P lea sesig n yourna m et
o obj
ectt
h efa lse[sic]of t
he

9

com pa nya tt
h eem a ila ddressbelow if you don’tw a ntt
o sufferda m a g e. I f you

10

don’t
, notonlyyou butyourfa m ilyw illbein da ng er.”

11
12
13
14

23.

A sof D ecem ber8 , 2014, h a ckersh a drelea seda round140g ig a byt
es

of a ca ch eof int
erna lSonyfilesa nd film st
h eycla im t
ot
a lsa tlea st100t
era byt
es—
a pproxim a t
ely10t
im est
h ea m ountof inform a t
ion st
ored in t
h eL ibra ryof

15
16

C ong ress.

17

24.

18

M oreov er, B usinessI nsiderreport
edt
h a tSonyC EO M ich a elL ynt
on

senta secondcom pa ny-w idem em o t
o currentem ployeeson D ecem ber8 , 2014

19
20

a ssuring t
h em t
h a tSonyw a sdoing ev eryt
h ing itcouldt
o prot
ectem ployeesa ft
era

21

seriesof cyber-a t
t
a ckst
h a trev ea ledt
h eirpersona linform a t
ion, including Socia l

22

Securit
ynum bersa nda ddresses, st
at
ing t
h a tt
h eF edera lB urea u of I nv est
ig a t
ion

23
24

h a s“dedica t
edt
h eirseniorst
a ff t
ot
h isg loba linv est
ig a t
ion”a ndt
h a t“recog nized

25

expert
sa rew orking on t
h ism a t
t
era nd looking outforoursecurit
y.”

26
27
28

25.

W h ilem oret
h a n 117 ,000cyber-a t
t
a cksh itbusinessesea ch da y, t
he

LosA ng elesTim esreport
edt
h a tP h illip L ieberm a n, t
h epresidentof securit
y
C la ssA ct
ion C om pla int–P a g e10

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 11 of 45 Page ID #:11

1
2

m a na g em entprog ra m m a kerL ieberm a n Soft
w a re, sa id few of t
h osea t
t
a cksa reon
t
h esca leof t
h eblow dea ltt
o Sony. “It
’sobv iousfrom t
h escopeof w h a t
’sbeen

3
4
5
6

donet
h a tt
h eint
rudersow nedt
h eent
ireenv ironm ent. . . Sonylostcont
rolof t
h eir
env ironm ent
,”L ieberm a n sa id.
26 .

N o definit
iv eev idencea boutt
h eperpet
ra t
orsh a sbeen disclosed, but

7
8

sev era lsecurit
yfirm sh a v efocusedon t
h efa ctt
h a tda t
a relea sedbyt
h ea t
t
a ckers

9

includea num berof Sony’spriv a t
ecrypt
og ra ph ic keys. K ev in B ocek, v ice

10

presidenta tVena fi, expla inedt
o B usinessw eekt
h a tlosing cont
rolof t
h ese

11
12

crypt
og ra ph ic “keyst
ot
h eking dom ”is“a big dea l.”O ncea n a t
t
a ckerh a sa ccesst
o

13

t
h ecrypt
og ra ph ic keys, a n a t
t
a ckerca n g etont
o encrypt
edserv ersw it
h out

14

t
rig g ering int
rusion det
ect
ion syst
em sbeca uset
h esesyst
em sa ssum et
h a tencrypt
ed

15
16
17
18

da t
a issa fe.
27 .

B usinessw eekreport
edt
h a ta n a t
t
a ckusing crypt
og ra ph ic keys

indica t
est
h a tt
h eh a ckerlikelyspenta sig nifica nta m ountof t
im ew it
h in t
he

19
20

com pa ny’snet
w ork. Th isisbeca usecom pa niesa reoft
en slow t
o ch a ng et
h eir

21

crypt
og ra ph ic keys, ev en w h en t
h eyknow t
h eya rev ulnera ble.

22

28 .

Som ereport
sh a v esug g est
edt
h a tt
h ea t
t
a ckersof Sony’sN et
w ork

23
24

m a yh a v einit
ia t
edt
h eira t
t
a cka sea rlya sa yea rpriort
ot
h epublic disclosures

25

reg a rding t
h eD a t
a B rea ch in N ov em ber, 2014.

26
27
28

29 .

Th us, a nyonew it
h a ccesst
ot
h ecrypt
og ra ph ic keysw ould h a v e

a ccesst
o Sony’sN et
w orkunt
ilt
h ecom pa nym a na g edt
o ch a ng et
h em — a process
C la ssA ct
ion C om pla int–P a g e11

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 12 of 45 Page ID #:12

1
2

t
h a toft
en becom esdifficultw h en com pa niesloset
ra ckof a llt
h ew a yst
h at
crypt
og ra ph ic keysa reused. F orexam ple, K a sperskyLa b point
soutt
h a ta sa m ple

3
4
5
6

of t
h em a lw a ret
h a th a ckersinst
a lledon t
h eSonyN et
w orkduring t
h eD a t
a B rea ch
sh ow edt
ra cesof being sig nedbya v a liddig it
a lcert
ifica t
efrom Sony. A ccording
t
ot
h ecybersecurit
yfirm :

7
8

Th est
olen Sonycert
ifica t
es(w h ich w erea lso lea kedbyt
h ea t
t
a ckers)

9

ca n beusedt
o sig n ot
h erm a licioussa m ples. I n t
urn, t
h eseca n be

10

furt
h erused in ot
h era t
t
a cks. . . . B eca uset
h eSonydig it
a lcert
ifica t
es

11
12

a ret
rust
edbysecurit
ysolut
ions, t
h ism a kesa t
t
a cksm oreeffect
iv e. . .

13

W e’v eseen a t
t
a ckerslev era g et
rust
edcert
ifica t
esin t
h epa st
, a sa

14

m ea nsof bypa ssing w h it
elist
ing soft
w a rea nddefa ult
-denypolicies.

15
16
17
18

30.

Th us, if Sony’scrypt
og ra ph ic keysw erea m ong t
h eda t
a relea sed,

Sony’sa bilit
yt
o prev entfurt
h eruna ut
h orizeda ccesst
o it
sN et
w orkw ouldbe
sev erelycom prom iseda nda ddit
iona l, if notong oing , brea ch esof it
sN et
w ork

19
20

w ouldbelikely.

21

31.

22

I nform a t
ion t
ech nolog yonlinepublica t
ion A RS Tech nica not
a bly

report
edt
h a tt
h eh a ckersw erea blet
o collectsig nifica ntint
ellig enceon t
h eSony

23
24

N et
w orkfrom Sony’sow n inform a t
ion t
ech nolog ydepa rt
m ent
. A m ong stt
h efiles

25

publiclydisclosedt
h esecondw eekof D ecem ber2014w a sa corpora t
ecert
ifica t
e

26
27
28

a ut
h orit
yt
h a tw a sint
endedt
o beusedin crea t
ing serv ercert
ifica t
esfor
D efenda nt
’sI nform a t
ion Syst
em sServ ice(I SS). Th iscorpora t
ecert
ifica t
e
C la ssA ct
ion C om pla int–P a g e12

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 13 of 45 Page ID #:13

1
2

a ut
h orit
ym a yh a v ebeen usedt
o crea t
et
h eserv ercert
ifica t
et
h a tw a susedt
o sig n a
la t
erv ersion of t
h em a lw a ret
h a tt
ookSony’sN et
w orkofflinein N ov em ber2014.

3

5

D espit
eSony’sL ong st
a nding K now ledg eof I t
sN et
w ork’sSecurit
y
W ea kness, I tM a dea B usinessD ecision t
o A cceptTh isRiskD espit
e
P rev iousD a t
a B rea ch es

6

32.

4

B .

Sonyh a sbeen a long st
a nding a nd frequentt
a rg etforh a ckers, butit

7
8
9
10

a ppa rent
lym a dea businessdecision t
o a cceptt
h eriskof lossesa ssocia t
edw it
h
being h a cked.
33.

P utsim ply, Sonyknew a boutt
h erisksitt
ookw it
h it
spa sta ndcurrent

11
12
13
14

em ployees’da t
a . Sonyg a m bled, a nd it
sem ployees–pa sta ndcurrent–lost
.
34.

F orexam ple, a sreport
edon t
h eG izm odo w ebsit
e, j
ustt
w o m ont
hs

beforet
h eD a t
a B rea ch beca m epublic, Sonyrelea seda sca t
h ing int
erna lI T

15
16

a ssessm ent
.In t
h ereportSony’sI T personnelfoundba sic securit
yprot
ocolw ent

17

unh eededa ndw h a tlit
t
leI T securit
yitdidh a v ew a spla g uedw it
h unm onit
ored

18

dev ices, m iscom m unica t
ion, a nda la ckof a ccount
a bilit
y.

19
20
21
22

35.

F urt
h erm ore, t
o Sony’sch a g rin, em a ilsfrom t
h eD efenda nt
’sg enera l

counsel, Lea h W eil, w erereport
edlylea ked a sw ell. A m ong ot
h ert
opics, t
he
em a ilsv oicedconcernsa boutt
h ev olum eof da t
a a v a ila bleon em a ils. F orexam ple,

23
24
25
26

onereport
edlyst
at
ed, “W h ileundoubt
edlyt
h erew illbeem a ilst
h a tneedt
o be
ret
a inedorst
oredelect
ronica llyin a syst
em ot
h ert
h a n em a il, m a nyca n bedelet
ed,
a ndI a m inform edbyourI T collea g uest
h a tourcurrentuseof t
h eem a ilsyst
em for

27
28

v irt
ua llyev eryt
h ing isnott
h ebestw a yt
o do t
h is.”

C la ssA ct
ion C om pla int–P a g e13

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 14 of 45 Page ID #:14

1
2

36 .

A ccording t
o a n a na lysisbysecurit
yfirm P a cketN inj
a s, m oret
h an

9 00dom a inst
h a ta ppea rt
o berela t
edt
ot
h ecom pa nyh a v ebeen com prom isedov er

3
4
5
6

t
h ela stt
w elv eyea rs.
37 .

Sonyh a dt
h ea bilit
ya ndknow -h ow t
o im plem enta nd m a int
a in

sufficientonlinesecurit
yconsist
entw it
h indust
ryst
a nda rdsa sa lea derin t
he

7
8
9
10

com put
ert
ech nolog yindust
ry.
38 .

N ev ert
h eless, a sreport
edbyt
h et
ech nolog ya ndbusinessw ebsit
e

C I O , Sony’sexecut
iv edirect
orof inform a t
ion securit
y, Ja son Spa lt
ro, m a dea

11
12

businessdecision in N ov em ber2005nott
o ensuret
h esecurit
yof Sony’sN et
w ork.

13

A tt
h a tt
im e, a n a udit
orw h o h a dj
ustcom plet
eda rev iew of Spa lt
ro’ssecurit
y

14

pra ct
icest
oldh im t
h a tSonyh a dsev era lsecurit
yw ea knesses, including

15
16
17
18

insufficient
lyst
rong a ccesscont
rols, w h ich isa keySa rba nes-O xleyrequirem ent
.
39 .

Spa lt
ro subsequent
lysa id in a 2007 int
erv iew w it
h CIO t
h a th ew a s

notw illing t
o putup a lotof m oneyt
o defendSony’ssensit
iv einform a t
ion, st
at
ing :

19
20
21
22

“It
’sa v a lidbusinessdecision t
o a cceptt
h erisk.”
40.

C I O report
edon A pril6 , 2007 , t
h a tC ent
erforD em ocra cya nd

Tech nolog ypriv a cyexpert
, A riSch w a rt
z, believ edSpa lt
ro’srea soning t
o be

23
24

“sh ort
sig h t
ed”beca uset
h ecostof not
ifica t
ion isonlya sm a llport
ion of t
he

25

pot
ent
ia lcostof a da t
a brea ch .

26
27
28

41.

I n M a y2009 , report
ssurfa cedt
h a tuna ut
h orizedcopiesof Sony’s

cust
om ers’creditca rdsw ereem a iledt
o a n out
sidea ccount
.
C la ssA ct
ion C om pla int–P a g e14

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 15 of 45 Page ID #:15

1
2

42.

I n Ja nua ry2011, h a ckersm a det
h eP la ySt
at
ion g a m eM odern W a rfa re

2unpla ya blet
h roug h t
h eP la ySt
at
ion N et
w ork.

3
4
5
6

C.

Sony’sM a jorD a t
a B rea ch in A pril2011
43.

I n A pril2011, Sony’sP la ySt
at
ion v ideo g a m enet
w orksuffereda

m aj
orbrea ch in A pril2011in w h ich h a ckersst
olem illionsof usera ccount
sfrom

7
8
9
10

t
h eonlineg a m ing serv ice.
44.

Tw o w eekspriort
ot
h eA pril2011da t
a brea ch , Sonyw a s

a nonym ouslyw a rnedof t
h eim pending brea ch :

11
12

You h a v ea busedt
h ej
udicia lsyst
em in a n a t
t
em ptt
o censor

13

inform a t
ion on h ow yourproduct
sw ork. . . N ow you w illexperience

14

t
h ew ra t
h of A nonym ous. You sa w a h ornet
’snesta ndst
uckyour

15
16

[explet
iv e]in it
. You m ustfa cet
h econsequencesof youra ct
ions,

17

A nonym ousst
yle. . . Expectus(em ph a sisa dded).

18

45.

D espit
et
h isdirectt
h rea tt
o im m inent
lybrea ch t
h eSonyN et
w ork,

19
20
21
22

Sonyfa iledt
o im plem enta dequa t
esa feg ua rdst
o prot
ectit
.
46 .

A sreport
edbyEng a dg et
.com , on M a y1, 2011, SonyC orpora t
ion

C h ief I nform a t
ion O fficer, Sh inj
iH a sej
im a , a dm it
t
edduring a pressconference

23
24
25

t
h a tSony’sN et
w orkw a snotsecurea tt
h et
im eof t
h eA pril2011da t
a brea ch a nd
st
at
edt
h a tt
h ea t
t
a ckw a sa “know n v ulnera bilit
y.”

26
27
28
C la ssA ct
ion C om pla int–P a g e15

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 16 of 45 Page ID #:16

1
2

47 .

I n a ddit
ion, on June8 , 2011, Sony’sD eput
yP resident
, report
edly

a dm it
t
edSony’sN et
w orkfa iledt
o m eetm inim um securit
yst
a nda rdsa tt
h et
im eof

3
4
5
6

t
h eA pril2011da t
a brea ch .
48 .

A sreport
edbyt
h eG ua rdia n, Sony’sK a zH ira ist
at
edt
h a tSonyh a s

“doneev eryt
h ing t
o bring ourpra ct
icesa tlea stin linew it
h indust
ryst
a nda rdsor

7
8

bet
t
er”w h en a skedw h et
h erSonyh a drev isedit
ssecurit
ysyst
em sfollow ing t
he

9

A pril2011da t
a brea ch .

10

49 .

I n responset
ot
h eA pril2011da t
a brea ch , Sonyrepresent
edt
h a tit

11
12

im plem ent
edba sic m ea surest
o defenda g a instnew a t
t
a cks, including t
h efollow ing

13

syst
em st
h a tsh ould h a v ebeen in pla cepriort
o A pril2011:a ut
om a t
edsoft
w a re

14

m onit
oring ;enh a ncedda t
a encrypt
ion;enh a nceda bilit
yt
o det
ectint
rusionst
ot
he

15
16

N et
w ork, such a sa n ea rly-w a rning syst
em t
o det
ectunusua la ct
iv it
ypa t
t
erns;a nd

17

a ddit
iona lfirew a lls. A ddit
iona lly, Sonyh ireda C h ief I nform a t
ion Securit
yO fficer.

18

50.

N ev ert
h eless, Joh n B um g a rner, C h ief Tech nolog yO fficerof t
he

19
20

independent
, non-profitresea rch inst
it
ut
eUnit
edSt
at
esC yber-C onsequencesUnit
,

21

foundt
h a ta sof M a y10, 2011, una ut
h orizeduserscouldst
illa ccessint
erna lSony

22

resources, including securit
y-m a na g em entt
ools. B um g a rner’sresea rch a lso

23
24

sh ow edt
h a tt
h eproblem sw it
h Sony’ssyst
em sw erem orew idesprea dt
h a n Sony

25

h a da cknow ledg eda tt
h a tt
im e.

26
27
28

51.

A ft
ert
h eA pril2011brea ch , Sonyoffered freeident
it
yt
h eft

prot
ect
ion, a m ong ot
h erbenefit
s, t
o P la ySt
at
ion users.
C la ssA ct
ion C om pla int–P a g e16

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 17 of 45 Page ID #:17

1
2

52.

B usinessw eekreport
edt
h a tt
h eca useof t
h eA pril2011brea ch w a s

t
h a tSonylostcont
rolof it
scrypt
og ra ph ic keys— w h ich isa lso t
h efocusof sev era l

3
4
5
6

securit
yfirm sinv est
ig a t
ing t
h epresentD a t
a B rea ch of Sony’sN et
w ork— a nd
not
edt
h a tif Sonyh a sa g a in lostcont
rolof it
scrypt
og ra ph ic keys, itra isest
he
quest
ion w h yith a d notprot
ect
edt
h em m orecloselyt
h reeyea rsla t
er.

7
53.

8
9
10

C la ssa ct
ion lit
ig a t
ion on beh a lf of g a m ersfollow edt
h eA pril2011

brea ch a ndSonya g reedt
o set
t
let
h osecla im sin June2014in exch a ng efor$15
m illion in g a m es, onlinecurrencya nd ident
it
yt
h eftreim bursem ent
.

11
12
13
14

D.

Sony’sF a iluret
o P rev entD a t
a B rea ch esC ont
inuedA ft
erA pril2011
54.

C onsist
entw it
h M r. B um g a rner’sresea rch on t
h eext
entof problem s

w it
h t
h esecurit
yof Sony’sN et
w ork, Sony’sba dinform a t
ion t
ech nolog ysecurit
y

15
16
17
18

h a bit
scont
inued.
55.

Sony’sN et
w orkw a sa g a in brea ch ed in June2011, com prom ising ov er

1m illion users’persona linform a t
ion, including na m es, birt
h da t
es, em a il

19
20
21
22

a ddresses, passw ords, h om ea ddresses, a ndph onenum bers.
56 .

Th eh a ckerscla im edt
h a titw a snotdifficultt
o brea ch Sony’s

N et
w orkin June2011a ndt
h a tt
h est
olen da t
a w a sunencrypt
ed.

23
24
25
26

57 .

N um erousexpert
sin t
h efielda g reea nda t
t
ribut
et
h eJune2011da t
a

brea ch t
o a n unsoph ist
ica t
ed m et
h odof h a cking t
h a tw ould noth a v ebeen
successfulif Sonyh a dev en t
h em ostba sic securit
ym ea suresin pla ce.

27
28
C la ssA ct
ion C om pla int–P a g e17

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 18 of 45 Page ID #:18

1
2

58 .

F orexam ple, P C W orldt
ech nolog yj
ourna listTonyB ra dlyobserv ed

t
h a tSony“seem st
o ig norecom plia ncerequirem ent
sa ndba sic securit
ybest

3
4
5
6

pra ct
ices, so itisba sica llybeg g ing t
o bea t
t
a cked.”B ra dleyfurt
h era dv isedt
h at
com pa niessh ould follow securit
y“bestpra ct
icesa ndda t
a securit
ycom plia nce
requirem ent
s”— a nd in sh ort
— “[d]on’tbea Sony.”

7
8
9
10

59 .

L ikew ise, F redTouch et
t
eof A ppRiv erst
at
ed:“[t
]h ereisno doubtt
h at

Sonyneedst
o spendsom em a j
oreffortin t
ig h t
ening up it
snet
w orksecurit
y. Th is
la t
esth a cka g a instt
h em w a sa seriesof sim pleSQ L I nj
ect
ion a t
t
a cksa g a instit
s

11
12
13
14

w eb serv ers. Th issim plysh ould noth a v eh a ppened.”
6 0.

I n F ebrua ry2014, Sony’sexecut
iv edirect
orof inform a t
ion securit
y

Ja son Spa lt
ro not
ifiedSonyC h ief F ina ncia lO fficerD a v id H endlert
h a ta

15
16

sig nifica nta m ountof pa ym entinform a t
ion h a dbeen st
olen off of Sony’sN et
w ork

17

rela t
ing t
o 7 59 indiv idua lsa ssocia t
edw it
h t
h ea t
ersin B ra zil. Th est
olen pa ym ent

18

inform a t
ion h a dbeen st
oreda s.t
xtt
extfilesa ndSonyh a dbeen st
oring t
h ist
ypeof

19
20
21
22

inform a t
ion t
h isw a ysince2008 .
6 1.

Spa lt
o brush edoff t
h esig nifica nceof t
h eF ebrua ry2014a t
t
a ckfrom

t
h est
a ndpointof leg a lexposurea ndrecom m endeda g a instprov iding a ny

23
24
25
26
27

not
ifica t
ion of t
h isbrea ch t
o indiv idua ls.
6 2.

I n cont
ra st
, Sonyt
ookv eryseriouslyt
h et
h rea tof denia lof serv ice

at
t
a ckson it
sbusiness, pa rt
icula rlya ft
erw h a th a d h a ppenedt
ot
h eSony

28
C la ssA ct
ion C om pla int–P a g e18

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 19 of 45 Page ID #:19

1
2

P la yst
at
ion N et
w orka ndissuedw a rning sof likelyfut
urea t
t
a cksin M a rch 2014
a nd A pril2014.

3
6 3.

4
5
6

I n A ug ust2014, a m ont
h a ft
erSonyset
t
led t
h ecla ssa ct
ion lit
ig a t
ion

broug h tbyP la ySt
at
ion g a m ersa sa resultof t
h eA pril2011brea ch — a ndj
ust
m ont
h sbeforet
h eG O P h a ckerst
ookresponsibilit
yfort
h ecurrentD a t
a B rea ch —

7
8

h a ckersa g a in t
ookdow n t
h eP la ySt
at
ion N et
w orka nda lso t
ookdow n Sony’s

9

Ent
ert
a inm entN et
w orkbyov erw h elm ing Sony’sN et
w orkw it
h “denia lof serv ice”

10

at
t
a cks.

11
6 4.

12
13
14

A lso in A ug ust2014, inform a t
ion t
ech nolog yonlinepublica t
ion A RS

Tech nica report
edSony’sC h ief I nform a t
ion Securit
yO fficerP h ilReit
ing er
a nnouncedh ew ouldbest
epping dow n, not
ing t
h a tt
h erew erea num berof a rch a ic

15
16

syst
em st
h a th a dbeen in pla cea tSonyfora g esw it
h plent
yof pot
ent
ia la t
t
a ck

17

point
s.

18

6 5.

At
t
a ckson Sony’sN et
w orkh a v econt
inued t
o bereport
eda srecent
ly

19
20

a sD ecem ber7 , 2014.

21

E.

22

Th eF edera lG ov ernm entisC urrent
lyI nv est
ig a t
ing Sony’sL a t
estD a t
a
B rea ch

23

66.

24

O n D ecem ber1, 2014, t
h eF edera lB urea u of I nv est
ig a t
ion (“F B I ”)

la unch eda n inv est
ig a t
ion int
o Sony’scyber-int
rusion.

25
26
27
28
C la ssA ct
ion C om pla int–P a g e19

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 20 of 45 Page ID #:20

1
2

67.

Th eF B I confirm edon D ecem ber8 , 2014t
h a titw illa dv iseSony’s

em ployeeson h ow t
o m a na g et
h elea kof t
h eirpersona linform a t
ion in t
h em a ssiv e

3
4

SonyN et
w orkD a t
a B rea ch .

5
6

68.

O n D ecem ber10, 2014, t
h eSena t
eC om m it
t
eeon B a nking , H ousing

a ndUrba n A ffa irsh elda cybersecurit
yh ea ring in w h ich N ew YorkSena t
or

7
8
9

C h a rlesSch um erra isedconcernsov ert
h eorig in of Sony’scurrentD a t
a B rea ch .

10

Th eH a ckedP I I of Sony’sC urrenta ndF orm erE m ployeesw a s
Va lua ble

11

69.

12

F.

A sa resultof t
h eD a t
a B rea ch , cyber-crim ina lsnow possesst
h eP I I of

Sony’scurrenta nd form erem ployees.

13
7 0.

14

A st
h eF edera lTra deC om m ission h a sst
at
ed, P I I such a sSocia l

15

Securit
ynum bers, fina ncia linform a t
ion, a ndot
h ersensit
iv einform a t
ion a re“w h a t

16

t
h iev esusem ostoft
en t
o com m itfra udorident
it
yt
h eft
.”I n a ddit
ion, onceident
it
y

17
18
19
20

t
h iev esh a v epersona linform a t
ion, “t
h eyca n dra in yourba nka ccount
, run up your
creditca rds, open new ut
ilit
ya ccount
s, org etm edica lt
rea t
m enton yourh ea lt
h
insura nce.”

21
7 1.

22
23
24

L eg it
im a t
eorg a niza t
ionsa ndt
h ecrim ina lunderg rounda like

recog nizet
h ev a lueof such da t
a. O t
h erw ise, t
h eyw ould notpa yfororm a int
a in it
,
ora g g ressiv elyseekit
. C rim ina lsseekpersona la nd fina ncia linform a t
ion of

25
26
27

consum ersbeca uset
h eyca n usebiog ra ph ica lda t
at
o perpet
ua t
em orea nd la rg er
t
h eft
s.

28
C la ssA ct
ion C om pla int–P a g e20

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 21 of 45 Page ID #:21

1
2
3
4

G .

SonyF a iledt
o Tim elya ndA dequa t
elyP rot
ectC urrenta ndF orm er
E m ployees’P I I
7 2.

Sonyh a sa lrea dya ct
edt
o prot
ectit
self byusing h a cking m et
h odsof

it
sow n t
o com ba tilleg a ldow nloa dsof it
sm ov iest
h a th a ckerspubliclyrelea sed

5
6

a ft
ert
h eD a t
a B rea ch , a ccording t
o Recode. Specifica lly, itish a rnessing A m a zon

7

W eb Serv ices(t
h eba ckendt
h a th ost
sN et
flix,I nst
a g ra m a nd m a nyot
h ers) t
o

8

la unch a dist
ribut
eddenia lof serv ice(D D oS) a t
t
a ckon w ebsit
esh ost
ing t
h est
olen

9
10
11
12

a sset
s.
7 3.

Sonyh a snot
, h ow ev er, sim ila rlya ct
edt
o prot
ectit
scurrenta nd

form erem ployees.

13
14

7 4.

Th isisim port
a ntbeca use, a ccording t
o expert
s, oneoutof fourda t
a

15

brea ch not
ifica t
ion recipient
sbeca m ea v ict
im of ident
it
yfra ud, in w h ich a n

16

ident
it
yt
h ief usesa not
h er’spersona la nd fina ncia linform a t
ion such a st
h at

17
18
19
20

person’sna m e, a ddress, a ndot
h erinform a t
ion, w it
h outperm ission, t
o com m it
fra udorot
h ercrim es.
7 5.

F orinst
a nce, ident
it
yt
h iev esm a ycom m itv a rioust
ypesof crim es

21
22
23
24

such a sim m ig ra t
ion fra ud, obt
a ining a driv er’slicenseorident
ifica t
ion ca rdin t
he
v ict
im ’sna m ebutw it
h a not
h er’spict
ure, using t
h ev ict
im ’sinform a t
ion t
o obt
a in
g ov ernm entbenefit
s, orfiling a fra udulentt
a xret
urn using t
h ev ict
im ’s

25
26

inform a t
ion t
o obt
a in a fra udulentrefund.

27
28
C la ssA ct
ion C om pla int–P a g e21

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 22 of 45 Page ID #:22

1
2

76.

I n a ddit
ion, ident
it
yt
h iev esm a yg etm edica lserv icesusing

consum ers’lostinform a t
ion orcom m ita nynum berof ot
h erfra uds, such a s

3
4
5
6

obt
a ining a j
ob, procuring h ousing orev en g iv ing fa lseinform a t
ion t
o police
during a n a rrest
.
77.

F urt
h erm ore, t
h eP I I t
h a tSonyfa iledt
o a dequa t
elyprot
ecta ndt
h at

7
8

w a sst
olen in t
h eD a t
a B rea ch is“asg ooda sg old”t
o ident
it
yt
h iev esbeca use

9

ident
it
yt
h iev esca n usev ict
im s’persona lda t
at
o open new fina ncia la ccount
sa nd

10

incurch a rg esin a not
h erperson’sna m e, t
a keoutloa nsin a not
h erperson’sna m e,

11
12
13
14

a nd incurch a rg eson exist
ing a ccount
s.
78.

F ina lly, t
h eG O P h a ckersh a v ea lrea dyused t
h isP I I t
o h a ra ssSony’s

em ployeesbyt
h rea t
ening h a rm t
ot
h eirfa m iliesif t
h eydidnotcoopera t
eby

15
16

sig ning a docum entev idencing supportfort
h eG O P m ission a ndsubst
a nt
ia lly

17

im pa iring t
h eira bilit
yt
o w orkw h ilem a lw a rew a sinst
a lledon t
h eSonyN et
w ork.

18

79.

Th eUnit
edSt
at
esg ov ernm enta ndpriv a cyexpert
sa cknow ledg et
h at

19
20
21
22

itm a yt
a keyea rsforident
it
yt
h eftt
o com et
o lig h ta ndbedet
ect
ed.
8 0.

A ccording ly, a sI dent
it
yF inderL L C C EO Todd F einm a n t
old

L a w 36 0, t
h erea lv ict
im sa reSony’sem ployeesa ndex-em ployees:“Th ey’renow

23
24
25
26
27

a triskforident
it
yt
h eftfort
h erestof t
h eirliv es.”
8 1.

O n inform a t
ion a ndbelief, t
h eP I I post
edt
ot
h eI nt
ernetpert
a ining t
o

Sonyem ployeesw a snotlim it
edt
o currentem ployeesa ndda t
esba ckt
o em ployees

28
C la ssA ct
ion C om pla int–P a g e22

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 23 of 45 Page ID #:23

1
2

t
h a tleftSonya slong a g o a s2000, a ndt
o a ct
orsa nd film m a kersw h o w orked for
Sonya sfa rba cka s19 8 4.

3
4
5
6

8 2.

N ot
a bly, w h ilesev era lform erSonyem ployeesreport
edseeing t
h eir

persona lda t
a in lea keddocum ent
sbyD ecem ber8 , 2014, oneform erh ig h -ra nking
Sonyem ployeew h o leftt
h ecom pa nyea rliert
h isyea rt
oldC N ET t
h at
:“Th e

7
8
9
10

st
udio’sdonea bsolut
elynot
h ing t
o rea ch outt
o us.”
8 3.

O n D ecem ber9 , 2014, on inform a t
ion a nd belief, Sonybeg a n

g enera llyresponding t
o inquiriesbyform erSonyem ployeesconcerneda boutt
he

11
12

SonyN et
w orkD a t
a B rea ch a ndpublic dissem ina t
ion of form erSonyem ployeeP I I

13

st
olen byt
h eh a ckers.

14

8 4.

Sony’sbela t
edresponsedid notconfirm w h et
h erspecific currentor

15
16

form erem ployees’P I I h a dbeen com prom ised, a ndinst
ea dputt
h eburden on t
he

17

inquiring currentorform erem ployeest
o a ctt
o “m inim izeyourriskof ident
it
y

18

t
h eft
.”Sony’sresponsenot
edt
h a tform erSonyem ployeescouldexpectt
o receiv e

19
20

a n em a ilw it
h in t
h enextsev era lda yst
h a tw ould includeinst
ruct
ionson h ow t
h ey

21

couldsig n up for12m ont
h sof ident
it
yprot
ect
ion serv icesa tno ch a rg ew it
h at
h ird

22

pa rt
yprov iderof Sony’sch oosing .

23
24
25
26
27
28

8 5.

I n conj
unct
ion w it
h it
sbela t
eddisclosure, Sonyputt
h eburden on

P la int
iffsa ndt
h eot
h erC la ssm em berst
o m onit
orforda m a g esca usedbyt
h eD a t
a
B rea ch , ca ut
ioning t
h em t
o w at
ch outforuna ut
h orized useof t
h eircreditca rdda t
a
a nd ident
it
y-t
h eftsca m s. I m plicit
lyrecog nizing t
h eda m a g eca usedbyt
h eD a t
a
C la ssA ct
ion C om pla int–P a g e23

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 24 of 45 Page ID #:24

1
2

B rea ch , Sonyencoura g edP la int
iffsa ndt
h eot
h erC la ssm em berst
o “rem a in
v ig ila nt
,t
o rev iew youra ccountst
at
em ent
sa ndt
o m onit
oryourcreditreport
s.”

3
4
5
6

86.

O n D ecem ber10, 2014, Tw in C it
ies.com ech oedt
h econcern of

form erSonyem ployees, report
ing t
h a tnea rly4,000peopleh a dj
oineda recent
ly
form ed F a cebookg roup ca lled“SonyEx-Em ployeesW orrieda boutt
h eI nfo

7
8

B rea ch ,”a ndt
h a tm a nyof t
h oseform erem ployeesw ereconcernedt
h a tt
h eya re

9

una blet
o g etinform a t
ion from t
h est
udio a bouth ow t
o reg ist
erforcredit

10

m onit
oring a ndt
h eident
it
yprot
ect
ion t
h a tt
h est
udio h a snow a rra ng edt
o offer“t
o

11
12
13
14

a llcurrenta ndpot
ent
ia llya ffect
ed form erem ployeesa ndt
h eirdependent
s.”
87.

O n inform a t
ion a ndbelief, on ora boutD ecem ber12, 2014, Sony’s

t
h irdpa rt
yident
it
yprot
ect
ion prov iderA llC lea rI D beg a n prov iding form er

15
16

em ployeesw it
h a ct
iv a t
ion codest
h a tt
h eycoulduset
o sig n up forcredit

17

m onit
oring a nda n ident
it
yt
h eftinsura ncepolicy.

18

88.

Sony’slim it
edofferof 12m ont
h sof creditm onit
oring a nd insura nce

19
20

isina dequa t
e. N eit
h erdoesa nyt
h ing t
o prev entident
it
yfra ud. C reditm onit
oring

21

onlyinform sa consum erof inst
a ncesof fra udulentopening of new a ccount
s, not

22

fra udulentuseof exist
ing creditca rds. A g enciesof t
h efedera lg ov ernm enta nd

23
24

priv a cyexpert
sa cknow ledg et
h a tst
olen da t
a m a ybeh eld form oret
h a n a yea r

25

beforebeing usedt
o com m itident
it
yt
h efta ndoncest
olen da t
a h a sbeen soldor

26
27

post
edon t
h eI nt
ernet
, fra udulentuseof st
olen da t
a m a ycont
inueforyea rs.

28
C la ssA ct
ion C om pla int–P a g e24

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 25 of 45 Page ID #:25

1
2

89.

O n inform a t
ion a ndbelief, t
h eD a t
a B rea ch t
ot
h eSonyN et
w ork

a nd/ora ccept
ing creditm onit
oring a nd ident
it
yprot
ect
ion m a yresultin credit

3
4
5

reporta g enciespla cing red fla g son currenta nd form erSonyem ployeecredit
report
s, w h ich subst
a nt
ia llyim pa irsv ict
im s’a bilit
yt
o obt
a in a ddit
iona lcredit
.

6

VI .

C L A SS A C TI O N A L L E G A TI O N S

7
8
9
10

9 0.

P la int
iffsbring t
h issuita sa cla ssa ct
ion pursua ntt
o Rule23of t
he

F edera lRulesof C iv ilP rocedure, on beh a lf of h im self a nda llot
h erssim ila rly
sit
ua t
ed, a sm em bersof a C la ssinit
ia llydefineda sfollow s:

11
12

A llform era ndcurrentem ployeesin t
h eUnit
edSt
at
esof Sonyw h ose

13

P ersona llyI dent
ifia bleI nform a t
ion w a scom prom isedbySony’s

14

securit
ybrea ch est
h a tbeca m epublic st
a rt
ing in N ov em ber2014, a nd

15
16
17
18

a nyrela t
edsecurit
ybrea ch es.
9 1.

P la int
iffsa lso seekt
o cert
ifya C a lifornia Subcla ssconsist
ing of a ll

m em bersof t
h eC la ssw h o a reresident
sof C a lifornia undert
h erespect
iv eda t
a

19
20
21
22

brea ch st
at
ut
eof C a lifornia setfort
h in C ountII I . Th iscla ssisdefineda sfollow s:
A llform era ndcurrentem ployeesof Sonyw h o a reresident
sof
C a lifornia w h oseP ersona llyI dent
ifia bleI nform a t
ion w a s

23
24
25

com prom isedbySony’ssecurit
ybrea ch est
h a tbeca m epublic st
a rt
ing
in N ov em ber2014, a nda nyrela t
edsecurit
ybrea ch es.

26
27
28
C la ssA ct
ion C om pla int–P a g e25

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 26 of 45 Page ID #:26

1
2

9 2.

P la int
iffsa lso seekt
o cert
ifya Virg inia Subcla ssconsist
ing of a ll

m em bersof t
h eC la ssw h o a reresident
sof Virg inia undert
h erespect
iv eda t
a

3
4

brea ch st
at
ut
eof Virg inia setfort
h in C ountIV. Th iscla ssisdefineda sfollow s:

5

A llform era ndcurrentem ployeesof Sonyw h o a reresident
sof

6

Virg inia w h oseP ersona llyI dent
ifia bleI nform a t
ion w a scom prom ised

7
8

bySony’ssecurit
ybrea ch est
h a tbeca m epublic st
a rt
ing in N ov em ber

9

2014, a nda nyrela t
edsecurit
ybrea ch es.

10

9 3.

N um erosit
y. Th eC la ssissufficient
lynum erous, a sa pproxim a t
ely

11
12

15,000Sonyem ployeesa nd form erem ployeesh a v eh a dt
h eirP I I com prom ised.

13

Th eP ut
at
iv eC la ssm em bersa reso num erousa nddispersedt
h roug h outt
h eUnit
ed

14

St
at
est
h a tj
oinderof a llm em bersisim pra ct
ica ble. P ut
at
iv eC la ssm em bersca n be

15
16

ident
ifiedbyrecordsm a int
a inedbyD efenda nt
.

17
18

9 4.

C om m on Q uest
ionsof F a cta ndL a w . C om m on quest
ionsof fa ct

a nd la w exista st
o a llm em bersof t
h eC la ssa ndpredom ina t
eov era nyquest
ions

19
20

a ffect
ing solelyindiv idua lm em bersof t
h eC la ss, pursua ntt
o Rule23(b)(3).

21

A m ong t
h equest
ionsof fa cta ndla w t
h a tpredom ina t
eov era nyindiv idua lissues

22

a re:

23
24
25
26
27
28

(1)

W h et
h erSonyfa iledt
o exerciserea sona bleca ret
o prot
ect

P la int
iffs’a ndt
h eC la ss’P I I ;
(2)

W h et
h erSonyt
im ely, a ccura t
ely, a nda dequa t
elyinform ed

P la int
iffsa ndt
h eC la sst
h a tt
h eirP I I h a dbeen com prom ised;
C la ssA ct
ion C om pla int–P a g e26

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 27 of 45 Page ID #:27

1
2

(3)

W h et
h erSony’sconductw it
h respectt
ot
h eda t
a brea ch w a s

unfa ira nddecept
iv e;

3
(4)

4
5

W h et
h erSonyow eda leg a ldut
yt
o P la int
iffsa ndt
h eC la sst
o

prot
ectt
h eirP I I a ndw h et
h erD efenda ntbrea ch edt
h isdut
y;

6

(5)

W h et
h erSonyw a sneg lig ent
;

8

(6 )

W h et
h erSonyret
a insem ployees’da t
a fora rea sona blet
im e;

9

(7 )

W h et
h erP la int
iffsa ndt
h eC la ssa rea ta n increa sedriskof

7

10

ident
it
yt
h efta sa resultof Sony’sbrea ch esa nd fa iluret
o prot
ectP la int
iffs’

11
12

a ndt
h eC la ss’P I I ;a nd

13
14

(8 )

W h et
h erP la int
iffsa nd m em bersof t
h eC la ssa reent
it
ledt
ot
he

relief soug h t
, including inj
unct
iv erelief.

15
16
17
18

9 5.

Typica lit
y. P la int
iffs’cla im sa ret
ypica lof t
h ecla im sof m em bersof

t
h eC la ssbeca useP la int
iffsa ndt
h eC la sssust
a inedda m a g esa rising outof
D efenda nt
’sw rong fulconducta sdet
a iled h erein. Specifica lly, P la int
iffs’a ndt
he

19
20

C la ss’cla im sa risefrom Sony’sfa iluret
o inst
a lla nd m a int
a in rea sona blesecurit
y

21

m ea surest
o prot
ectP la int
iffs’a ndt
h eC la ss’sP I I , a ndt
ot
im elynot
ifyt
h em w h en

22

t
h esecurit
ybrea ch occurred.

23
24
25
26
27
28

96.

A dequa cy. P la int
iffsw illfa irlya nda dequa t
elyprot
ectt
h eint
erest
s

of t
h eC la ssa nd h a sret
a inedcounselcom pet
enta ndexperienced in cla ssa ct
ion
la w suit
s. P la int
iffsh a v eno int
erest
sa nt
a g onist
ic t
o orin conflictw it
h t
h oseof t
he
C la ssa ndt
h ereforeisa n a dequa t
erepresent
at
iv eforC la ss.
C la ssA ct
ion C om pla int–P a g e27

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 28 of 45 Page ID #:28

1
2

97.

Superiorit
y. A cla ssa ct
ion issuperiort
o ot
h era v a ila blem et
h odsfor

t
h efa ira ndefficienta dj
udica t
ion of t
h iscont
rov ersybeca uset
h ej
oinderof a ll

3
4
5
6

m em bersof t
h eput
at
iv eC la ssisim pra ct
ica ble. F urt
h erm ore, t
h ea dj
udica t
ion of
t
h iscont
rov ersyt
h roug h a cla ssa ct
ion w illa v oidt
h epossibilit
yof a n inconsist
ent
a ndpot
ent
ia llyconflict
ing a dj
udica t
ion of t
h ecla im sa ssert
edh erein. Th erew illbe

7
8

no difficult
yin t
h em a na g em entof t
h isa ct
ion a sa cla ssa ct
ion.

9

VI I . C A USE S O F A C TI O N

10
11

C O UN T I :N eg lig ence
98.

P la int
iffsa ndt
h eC la ssrea lleg ea nd incorpora t
ebyreferencet
he

12
13

a lleg a t
ionscont
a ined in ea ch of t
h epreceding pa ra g ra ph sof t
h isC om pla inta sif

14

fullysetfort
h h erein.

15

99.

D efenda ntow eda dut
yt
ot
h eC la sst
o exerciserea sona bleca rein

16
17

obt
a ining , securing , sa feg ua rding , delet
ing a ndprot
ect
ing P la int
iffs’a ndt
h eC la ss’

18

P I I w it
h in it
spossession orcont
rolfrom being com prom ised, lost
, st
olen, a ccessed

19

a nd m isusedbyuna ut
h orizedpersons. Th isdut
yincluded, a m ong ot
h ert
h ing s,

20
21

desig ning , m a int
a ining a ndt
est
ing Sony’ssecurit
ysyst
em st
o ensuret
h at

22

P la int
iffs’a ndC la ssm em bers’P I I in Sony’spossession w a sa dequa t
elysecured

23

a ndprot
ect
ed. Sonyfurt
h erow eda dut
yt
o P la int
iffsa ndt
h eC la sst
o im plem ent

24
25

processest
h a tw oulddet
ecta brea ch of it
ssecurit
ysyst
em in a t
im elym a nnera nd

26

t
ot
im elya ctupon w a rning a nda lert
sincluding t
h oseg enera t
edbyit
sow n securit
y

27
28

syst
em s.

C la ssA ct
ion C om pla int–P a g e28

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 29 of 45 Page ID #:29

1
2

100. Sonyow eda dut
yt
o P la int
iffsa ndt
h em em bersof t
h eC la sst
o
prov idesecurit
y, including consist
entw it
h of indust
ryst
a nda rdsa ndrequirem ent
s,

3
4
5
6

t
o ensuret
h a tit
ssyst
em sa nd net
w orks, a ndt
h epersonnelresponsiblefort
h em ,
a dequa t
elyprot
ect
edt
h eP I I of it
scurrenta nd form erem ployees.
101. Sonyow eda dut
yof ca ret
o P la int
iffsa ndt
h em em bersof t
h eC la ss

7
8

beca uset
h eyw ereforeseea blea ndproba blev ict
im sof a nyina dequa t
esecurit
y

9

pra ct
ices. Sonyknew orsh ouldh a v eknow n ith a d ina dequa t
elysa feg ua rded it
s

10

N et
w ork, pa rt
icula rlyin lig h tof it
sm ult
iplepriorbrea ch es, a snot
eda bov e, a ndyet

11
12

Sonyfa iledt
ot
a kerea sona blepreca ut
ionst
o sa feg ua rdcurrenta nd form er

13

em ployees’P I I .

14

102. Sonyow eda dut
yt
ot
im elya nda ccura t
elydiscloset
o P la int
iffsa nd

15
16

m em bersof t
h eC la sst
h a tt
h eirP I I h a dbeen orw a srea sona blybeliev edt
o h ave

17

been com prom ised. Tim elydisclosurew a srequired, a ppropria t
ea nd necessa ryso

18

t
h at
, a m ong ot
h ert
h ing s, P la int
iffsa ndt
h em em bersof t
h eC la sscouldt
a ke

19
20

a ppropria t
em ea surest
o a v oid ident
ifyt
h eftorfra udulentch a rg es, including ,

21

m onit
ort
h eira ccountinform a t
ion a ndcreditreport
sforfra udulenta ct
iv it
y, cont
a ct

22

t
h eirba nksorot
h erfina ncia linst
it
ut
ions, obt
a in creditm onit
oring serv ices, file

23
24

report
sw it
h la w enforcem enta ndot
h erg ov ernm ent
a la g enciesa ndt
a keot
h erst
eps

25

t
o m it
ig a t
eora m eliora t
et
h eda m a g esca usedbySony’sm isconduct
.

26
27
28

103. P la int
iffsa nd m em bersof t
h eC la ssent
rust
edSonyw it
h t
h eirP I I on
t
h eprem isea ndw it
h t
h eunderst
a nding t
h a tSonyw ouldsa feg ua rdt
h eir
C la ssA ct
ion C om pla int–P a g e29

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 30 of 45 Page ID #:30

1
2

inform a t
ion, a ndSonyw a sin a posit
ion t
o prot
ecta g a instt
h eh a rm sufferedby
P la int
iffsa nd m em bersof t
h eC la ssa sa resultof t
h eD a t
a B rea ch .

3
4
5
6

104. Sonyknew , orsh ouldh a v eknow n, of t
h einh erentrisksin collect
ing
a ndst
oring t
h eP I I of P la int
iffsa nd m em bersof t
h eC la ssa ndof t
h ecrit
ica l
im port
a nceof prov iding a dequa t
esecurit
yof t
h a tinform a t
ion.

7
8
9
10

105. Sony’sow n conducta lso crea t
eda foreseea bleriskof h a rm t
o
P la int
iffsa nd m em bersof t
h eC la ss. Sony’sm isconductincluded, butw a snot
lim it
edt
o, it
sfa iluret
ot
a ket
h est
epsa ndopport
unit
iest
o prev enta ndst
op t
he

11
12

D at
a B rea ch a ssetfort
h h erein. Sony’sm isconducta lso includedit
sdecision nott
o

13

com plyw it
h indust
ryst
a nda rdsfort
h esa fekeeping a nd m a int
ena nceof t
h eP I I of

14

P la int
iffsa nd m em bersof t
h eC la ss.

15
16
17
18

106 . Th roug h it
sa ct
sa ndom issionsdescribedh erein, Sonyunla w fully
brea ch ed it
sdut
yt
o userea sona bleca ret
o prot
ecta ndsecureP la int
iffs’a ndt
he
C la ss’P I I w it
h in it
spossession orcont
rol. M orespecifica lly, D efenda ntfa iledt
o

19
20

m a int
a in a num berof rea sona blesecurit
yproceduresa ndpra ct
icesdesig nedt
o

21

prot
ectt
h eP I I of P la int
iffsa ndt
h eC la ss, including , butnotlim it
edt
o, est
a blish ing

22

a nd m a int
a ining indust
ry-st
a nda rdsyst
em st
o sa feg ua rdit
scurrenta nd form er

23
24

em ployees’P I I . G iv en t
h eriskinv olv eda ndt
h ea m ountof da t
a a tissue, Sony’s

25

brea ch of it
sdut
iesw a sent
irelyunrea sona ble.

26
27
28
C la ssA ct
ion C om pla int–P a g e30

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 31 of 45 Page ID #:31

1
2

107 . Sonybrea ch ed it
sdut
iest
ot
im elya nda ccura t
elydiscloset
h at
P la int
iffs’a ndC la ssm em bers’P I I in Sony’spossession h a dbeen orw a s

3
4
5
6

rea sona blybeliev edt
o h a v ebeen, st
olen orcom prom ised.
108 . A sa directa ndproxim a t
eresultof D efenda nt
’sbrea ch of it
sdut
ies,
P la int
iffsa nd m em bersof t
h eC la ssh a v ebeen h a rm edbyt
h erelea seof t
h eirP I I ,

7
8

ca using t
h em t
o expendpersona lincom eon creditm onit
oring serv icesa ndput
t
ing

9

t
h em a ta n increa sedriskof ident
it
yt
h eft
. P la int
iffsa nd m em bersof t
h eC la ssh a v e

10

spentt
im ea nd m oneyt
o prot
ectt
h em selv esa sa resultof D efenda nt
’sconduct
, a nd

11
12

w illcont
inuet
o berequiredt
o spendt
im ea nd m oneyprot
ect
ing t
h em selv es, t
h eir

13

ident
it
ies, t
h eircredit
, a ndt
h eirreput
at
ions.

14
15

C O UN T I I :Viola t
ion of C a lifornia C onfident
ia lit
yof
M edica lI nform a t
ion A ct
, C a l. C iv . C ode§ 56 , et seq.

16

109 . P la int
iffsa ndt
h eC la ssrea lleg ea nd incorpora t
ebyreferencet
he

17
18
19
20

a lleg a t
ionscont
a ined in ea ch of t
h epreceding pa ra g ra ph sof t
h isC om pla inta sif
fullysetfort
h h erein.
110. C a lifornia C iv ilC ode§ 56 , etseq., know n a st
h eC onfident
ia lit
yof

21
22
23
24

M edica lI nform a t
ion A ct(“M edica lI nform a t
ion A ct
”), requiresem ployersw h o
receiv em edica linform a t
ion t
o est
a blish a ppropria t
eprocedurest
o ensuret
he
confident
ia lit
ya ndprot
ect
ion from una ut
h orizedusea nddisclosureof t
h at

25
26
27

inform a t
ion. Th eseproceduresm a yinclude, buta renotlim it
edt
o, inst
ruct
ion
reg a rding confident
ia lit
yof em ployeesa nd a g ent
sh a ndling filescont
a ining

28
C la ssA ct
ion C om pla int–P a g e31

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 32 of 45 Page ID #:32

1
2

m edica linform a t
ion, a ndsecurit
ysyst
em srest
rict
ing a ccesst
o filescont
a ining
m edica linform a t
ion.

3
4
5
6

111. F urt
h erm ore, t
h eM edica lI nform a t
ion A ctproh ibit
sem ployersfrom
disclosing m edica linform a t
ion reg a rding a pa t
ientw it
h outfirstobt
a ining w rit
t
en
a ut
h oriza t
ion from t
h epa t
ient
.

7
8

112. I n t
h eusua lcourseof business, em ployers, including Sony, possess

9

a ndret
a in cert
a in m edia t
ion recordsa ndinform a t
ion belong ing t
o it
scurrenta nd

10

form erem ployees, including cert
a in of P la int
iffs’m edica linform a t
ion. D uring

11
12
13
14

t
h eirem ploym entw it
h Sony, P la int
iffsliv edin C a lifornia .
113. A ta llrelev a ntt
im es, D efenda nth a da leg a ldut
yt
o prot
ectt
he
confident
ia lit
yof P la int
iffs’a ndC la ssm em bers’m edica linform a t
ion.

15
16
17
18

114. B yfa iling t
o ensurea dequa t
esecurit
ysyst
em sw erein pla cet
o
prev enta ccessa nddisclosureof P la int
iffs’a ndC la ssm em bers’priv a t
em edica l
inform a t
ion w it
h outw rit
t
en a ut
h oriza t
ion, D efenda ntv iola t
edt
h eM edica l

19
20

I nform a t
ion A cta ndt
h eirleg a ldut
yt
o prot
ectt
h econfident
ia lit
yof such

21

inform a t
ion.

22

115. P ursua ntt
o C a l. C iv . C ode§ 56 .36 , t
h oseP la int
iffsa nd m em bersof

23
24

t
h eC la ssw h osem edica linform a t
ion w a scom prom iseda reent
it
ledt
o nom ina l

25

st
at
ut
oryda m a g esof $1,000percla ssm em bera sw ella sa nya ct
ua lda m a g es

26
27

sust
a inedbyt
h oseP la int
iffsa nd m em bersof t
h eC la ss.

28
C la ssA ct
ion C om pla int–P a g e32

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 33 of 45 Page ID #:33

1
2
3
4

C O UN T I I I :Viola t
ion of C a l. C iv . C ode§ 17 9 8 .8 0etseq.
(O n B eh a lf O f P la int
iff M a t
h isa ndt
h eC a lifornia Subcla ss)
116 . P la int
iffsa ndt
h eC la ssrea lleg ea nd incorpora t
ebyreferencet
he
a lleg a t
ionscont
a ined in ea ch of t
h epreceding pa ra g ra ph sof t
h isC om pla inta sif

5
6
7
8

fullysetfort
h h erein.
117 . Sect
ion 17 9 8 .8 2of t
h eC a lifornia C iv ilC odeprov ides, in pert
inent
pa rt
, a sfollow s:

9
10

(b) A nyperson orbusinesst
h a tm a int
a inscom put
erizedda t
at
h at

11

includespersona linform a t
ion t
h a tt
h eperson orbusinessdoesnot

12

ow n sh a llnot
ifyt
h eow nerorlicenseeof t
h einform a t
ion of a ny

13
14

brea ch of t
h esecurit
yof t
h eda t
a im m edia t
elyfollow ing discov ery, if

15

t
h epersona linform a t
ion w a s, orisrea sona blybeliev edt
o h a v ebeen,

16

a cquiredbya n una ut
h orizedperson.

17
* * *

18
19
20

(d) A nyperson orbusinesst
h a tisrequired t
o issuea securit
ybrea ch
not
ifica t
ion pursua ntt
ot
h issect
ion sh a llm eeta llof t
h efollow ing

21
22
23
24

requirem ent
s:
(1) Th esecurit
ybrea ch not
ifica t
ion sh a llbew rit
t
en in pla in
la ng ua g e.

25
26
27

(2) Th esecurit
ybrea ch not
ifica t
ion sh a llinclude, a ta
m inim um , t
h efollow ing inform a t
ion:

28
C la ssA ct
ion C om pla int–P a g e33

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 34 of 45 Page ID #:34

1
2

(A ) Th ena m ea ndcont
a ctinform a t
ion of t
h ereport
ing
person orbusinesssubj
ectt
ot
h issect
ion.

3
4
5
6

(B ) A listof t
h et
ypesof persona linform a t
ion t
h a tw ere
ora rerea sona blybeliev edt
o h a v ebeen t
h esubj
ectof a
brea ch .

7
8

(C ) I f t
h einform a t
ion ispossiblet
o det
erm inea tt
h et
im e

9

t
h enot
iceisprov ided, t
h en a nyof t
h efollow ing :(i) t
he

10

da t
eof t
h ebrea ch , (ii) t
h eest
im a t
edda t
eof t
h ebrea ch , or

11
12

(iii) t
h eda t
era ng ew it
h in w h ich t
h ebrea ch occurred. Th e

13

not
ifica t
ion sh a lla lso includet
h eda t
eof t
h enot
ice.

14

(D ) W h et
h ernot
ifica t
ion w a sdela yeda sa resultof a la w

15
16

enforcem entinv est
ig a t
ion, if t
h a tinform a t
ion ispossible

17

t
o det
erm inea tt
h et
im et
h enot
iceisprov ided.

18

(E) A g enera ldescript
ion of t
h ebrea ch incident
, if t
h at

19
20

inform a t
ion ispossiblet
o det
erm inea tt
h et
im et
h enot
ice

21

isprov ided.

22

(F ) Th et
oll-freet
eleph onenum bersa nda ddressesof t
he

23
24

m aj
orcreditreport
ing a g enciesif t
h ebrea ch exposeda

25

socia lsecurit
ynum berora driv er’slicenseorC a lifornia

26
27
28

ident
ifica t
ion ca rd num ber.
* * *
C la ssA ct
ion C om pla int–P a g e34

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 35 of 45 Page ID #:35

1
2

(f) A nyperson orbusinesst
h a tisrequiredt
o issuea securit
ybrea ch
not
ifica t
ion pursua ntt
ot
h issect
ion t
o m oret
h a n 500C a lifornia

3
4
5
6

resident
sa sa resultof a sing lebrea ch of t
h esecurit
ysyst
em sh a ll
elect
ronica llysubm ita sing lesa m plecopyof t
h a tsecurit
ybrea ch
not
ifica t
ion, excluding a nypersona llyident
ifia bleinform a t
ion, t
ot
he

7
8

At
t
orneyG enera l. A sing lesa m plecopyof a securit
ybrea ch

9

not
ifica t
ion sh a llnotbedeem edt
o bew it
h in subdiv ision (f) of

10

Sect
ion 6 254of t
h eG ov ernm entC ode.

11
12

(g ) F orpurposesof t
h issect
ion, “brea ch of t
h esecurit
yof t
h esyst
em ”

13

m ea nsuna ut
h orizeda cquisit
ion of com put
erizedda t
at
h at

14

com prom isest
h esecurit
y, confident
ia lit
y, orint
eg rit
yof persona l

15
16

inform a t
ion m a int
a inedbyt
h eperson orbusiness. G oodfa it
h

17

a cquisit
ion of persona linform a t
ion bya n em ployeeora g entof t
he

18

person orbusinessfort
h epurposesof t
h eperson orbusinessisnota

19
20

brea ch of t
h esecurit
yof t
h esyst
em , prov idedt
h a tt
h epersona l

21

inform a t
ion isnotusedorsubj
ectt
o furt
h eruna ut
h orizeddisclosure.

22

118 . Th euna ut
h orizeda cquisit
ion of P la int
iffs’a ndC la ssm em bers’P I I

23
24
25
26
27
28

const
it
ut
eda “brea ch of t
h esecurit
ysyst
em ”of Sony.
119 . Sonyunrea sona blydela yed inform ing a nyonea boutt
h ebrea ch of
securit
yof C a lifornia Subcla ssm em bers’confident
ia la nd non-public inform a t
ion
a ft
erSonyknew t
h eD a t
a B rea ch h a doccurred.
C la ssA ct
ion C om pla int–P a g e35

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 36 of 45 Page ID #:36

1
2

120. D efenda ntfa iledt
o discloset
o C a lifornia Subcla ssm em bers, w it
h out
unrea sona bledela y, a nd in t
h em ostexpedientt
im epossible, t
h ebrea ch of securit
y

3
4
5
6

of t
h eirunencrypt
ed, ornotproperlya ndsecurelyencrypt
ed, P I I w h en t
h eyknew
orrea sona blybeliev edsuch inform a t
ion h a dbeen com prom ised.
121. Upon inform a t
ion a ndbelief, no la w enforcem enta g encyinst
ruct
ed

7
8
9
10

Sonyt
h a tnot
ifica t
ion t
o C a lifornia Subcla ssm em bersw ould im pedeinv est
ig a t
ion.
122. P ursua ntt
o Sect
ion 17 9 8 .8 4of t
h eC a lifornia C iv ilC ode:
(a ) A nyw a iv erof a prov ision of t
h ist
it
leiscont
ra ryt
o public policy

11
12

a nd isv oida nd unenforcea ble.

13
14

* * *
(e) A nybusinesst
h a tv iola t
es, proposest
o v iola t
e, orh a sv iola t
edt
h is

15
16

t
it
lem a ybeenj
oined.

17

123. A sa resultof Sony’sv iola t
ion of C a l. C iv . C ode§ 17 9 8 .8 2, C a lifornia

18

Subcla ssm em bersincurredeconom ic da m a g esrela t
ing t
o expensesforcredit

19
20
21
22

m onit
oring a ndot
h erident
ifyt
h eftprev ent
ion serv ices.
124. P la int
iff M a t
h is, indiv idua llya ndon beh a lf of t
h eot
h erC a lifornia
Subcla ssm em bers, seeka llrem ediesa v a ila bleunderC a l. C iv . C ode§ 17 9 8 .8 4,

23
24

including , butnotlim it
edt
o:(a ) da m a g essufferedbyC a lifornia Subcla ssm em bers

25

a sa lleg eda bov e;a nd(b) equit
a blerelief.

26
27

C O UN T I V:Viola t
ion of § 18 .2-18 6 .6 ., etseq.
(O n B eh a lf O f P la int
iff C orona a ndt
h eVirg inia Subcla ss)

28
C la ssA ct
ion C om pla int–P a g e36

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 37 of 45 Page ID #:37

1
2

125. P la int
iffsa ndt
h eC la ssrea lleg ea nd incorpora t
ebyreferencet
he
a lleg a t
ionscont
a ined in ea ch of t
h epreceding pa ra g ra ph sof t
h isC om pla inta sif

3
4
5
6

fullysetfort
h h erein.
126 . Sect
ion 18 .2-18 6 .6 of t
h eC odeof Virg inia prov ides, in pert
inentpa rt
,
a sfollow s:

7
8

(B ) I f unencrypt
edorunreda ct
edpersona linform a t
ion w a soris

9

rea sona blybeliev edt
o h a v ebeen a ccesseda nda cquiredbya n

10

una ut
h orizedperson a ndca uses, ort
h eindiv idua lorent
it
yrea sona bly

11
12

believ esh a sca usedorw illca use, ident
it
yt
h eftora not
h erfra udt
o a ny

13

residentof t
h eC om m onw ea lt
h , a n indiv idua lorent
it
yt
h a tow nsor

14

licensescom put
erizedda t
at
h a tincludespersona linform a t
ion sh a ll

15
16

disclosea nybrea ch of t
h esecurit
yof t
h esyst
em follow ing discov ery

17

ornot
ifica t
ion of t
h ebrea ch of t
h esecurit
yof t
h esyst
em t
ot
h eO ffice

18

of t
h eA t
t
orneyG enera la nda nya ffect
edresidentof t
he

19
20

C om m onw ea lt
h w it
h outunrea sona bledela y. N ot
icerequiredbyt
h is

21

sect
ion m a yberea sona blydela yedt
o a llow t
h eindiv idua lorent
it
yt
o

22

det
erm inet
h escopeof t
h ebrea ch of t
h esecurit
yof t
h esyst
em a nd

23
24

rest
oret
h erea sona bleint
eg rit
yof t
h esyst
em . N ot
icerequiredbyt
h is

25

sect
ion m a ybedela yed if, a ft
ert
h eindiv idua lorent
it
ynot
ifiesa la w -

26
27
28

enforcem enta g ency, t
h ela w -enforcem enta g encydet
erm inesa nd
a dv isest
h eindiv idua lorent
it
yt
h a tt
h enot
icew illim pedea crim ina l
C la ssA ct
ion C om pla int–P a g e37

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 38 of 45 Page ID #:38

1
2

orciv ilinv est
ig a t
ion, orh om ela ndorna t
iona lsecurit
y. N ot
icesh a llbe
m a dew it
h outunrea sona bledela ya ft
ert
h ela w -enforcem enta g ency

3
4
5
6

det
erm inest
h a tt
h enot
ifica t
ion w illno long erim pedet
he
inv est
ig a t
ion orj
eopa rdizena t
iona lorh om ela ndsecurit
y.
(C ) A n indiv idua lorent
it
ysh a lldiscloset
h ebrea ch of t
h esecurit
yof

7
8

t
h esyst
em if encrypt
edinform a t
ion isa ccesseda nda cquiredin a n

9

unencrypt
ed form , orif t
h esecurit
ybrea ch inv olv esa person w it
h

10

a ccesst
ot
h eencrypt
ion keya ndt
h eindiv idua lorent
it
yrea sona bly

11
12

believ est
h a tsuch a brea ch h a sca usedorw illca useident
it
yt
h eftor

13

ot
h erfra udt
o a nyresidentof t
h eC om m onw ea lt
h.

14

(D ) A n indiv idua lorent
it
yt
h a tm a int
a inscom put
erizedda t
at
h at

15
16

includespersona linform a t
ion t
h a tt
h eindiv idua lorent
it
ydoesnot

17

ow n orlicensesh a llnot
ifyt
h eow nerorlicenseeof t
h einform a t
ion of

18

a nybrea ch of t
h esecurit
yof t
h esyst
em w it
h outunrea sona bledela y

19
20

follow ing discov eryof t
h ebrea ch of t
h esecurit
yof t
h esyst
em , if t
he

21

persona linform a t
ion w a sa ccesseda nda cquiredbya n una ut
h orized

22

person ort
h eindiv idua lorent
it
yrea sona blybeliev est
h epersona l

23
24

inform a t
ion w a sa ccesseda nda cquiredbya n una ut
h orizedperson.

25

(E) I n t
h eev enta n indiv idua lorent
it
yprov idesnot
icet
o m oret
h an

26
27
28

1,000personsa tonet
im epursua ntt
ot
h issect
ion, t
h eindiv idua lor
ent
it
ysh a llnot
ify, w it
h outunrea sona bledela y, t
h eO fficeof t
he
C la ssA ct
ion C om pla int–P a g e38

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 39 of 45 Page ID #:39

1
2

At
t
orneyG enera la nda llconsum erreport
ing a g enciest
h a tcom pile
a nd m a int
a in fileson consum erson a na t
ionw ideba sis, a sdefined in

3
4
5
6

15U.S.C . § 16 8 1a (p), of t
h et
im ing , dist
ribut
ion, a ndcont
entof t
he
not
ice.
127 . F orpurposesof t
h issect
ion, “persona linform a t
ion”m ea nst
h efirst

7
8

na m eorfirstinit
ia la nd la stna m ein com bina t
ion w it
h a nd linkedt
o a nyoneor

9

m oreof t
h efollow ing da t
a elem ent
st
h a trela t
et
o a residentof t
h eC om m onw ea lt
h,

10

w h en t
h eda t
a elem ent
sa reneit
h erencrypt
ednorreda ct
ed:

11
12

(a ) Socia lsecurit
ynum ber;

13

(b) D riv er’slicensenum berorst
at
eident
ifica t
ion ca rd num berissued

14

in lieu of a driv er’slicensenum ber;or

15
16

(c) F ina ncia la ccountnum ber, orcreditordebitca rd num ber, in

17

com bina t
ion w it
h a nyrequiredsecurit
ycode, a ccesscode, or

18

pa ssw ordt
h a tw ouldperm ita ccesst
o a resident
’sfina ncia la ccount
.

19
20

128 . F orpurposesof t
h issect
ion, “not
ice”m ea ns:

21

(1) W rit
t
en not
icet
ot
h ela stknow n post
a la ddressin t
h erecordsof t
he

22

indiv idua lorent
it
y;

23
24

(2) Teleph onenot
ice;

25

(3) Elect
ronic not
ice;or

26
27
28

(4) Subst
it
ut
enot
ice, if t
h eindiv idua lort
h eent
it
yrequiredt
o prov idenot
ice
dem onst
ra t
est
h a tt
h ecostof prov iding not
icew illexceed$50,000, t
he
C la ssA ct
ion C om pla int–P a g e39

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 40 of 45 Page ID #:40

1
2

a ffect
edcla ssof Virg inia resident
st
o benot
ifiedexceeds100,000resident
s,
ort
h eindiv idua lort
h eent
it
ydoesnoth a v esufficientcont
a ctinform a t
ion or

3
4
5

consentt
o prov idenot
icea sdescribed in subdiv isions1, 2, or3of t
h is
definit
ion. Subst
it
ut
enot
iceconsist
sof a llof t
h efollow ing :

6

(a )

E-m a ilnot
iceif t
h eindiv idua lort
h eent
it
yh a se-m a ila ddresses

7
8

fort
h em em bersof t
h ea ffect
edcla ssof resident
s;

9
10

(b)

C onspicuouspost
ing of t
h enot
iceon t
h ew ebsit
eof t
he

indiv idua lort
h eent
it
yif t
h eindiv idua lort
h eent
it
ym a int
a insa w ebsit
e;

11
12
13
14

a nd
(c)

N ot
icet
o m aj
orst
at
ew idem edia .

129 . F urt
h er, t
h e“not
ice”requiredbyt
h issect
ion sh a llincludea

15
16
17
18

descript
ion of t
h efollow ing :
(1) Th eincidentin g enera lt
erm s;
(2) Th et
ypeof persona linform a t
ion t
h a tw a ssubj
ectt
ot
h euna ut
h orized

19
20

a ccessa nda cquisit
ion;

21

(3) Th eg enera la ct
sof t
h eindiv idua lorent
it
yt
o prot
ectt
h epersona l

22

inform a t
ion from furt
h eruna ut
h orizeda ccess;

23
24

(4) A t
eleph onenum bert
h a tt
h eperson m a yca llforfurt
h erinform a t
ion a nd

25

a ssist
a nce, if oneexist
s;a nd

26
27
28

(5) A dv icet
h a tdirect
st
h eperson t
o rem a in v ig ila ntbyrev iew ing a ccount
st
at
em ent
sa nd m onit
oring freecreditreport
s.
C la ssA ct
ion C om pla int–P a g e40

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 41 of 45 Page ID #:41

1
2

130. “B rea ch of t
h esecurit
yof t
h esyst
em ”m ea nst
h euna ut
h orizeda ccess
a nda cquisit
ion of unencrypt
eda ndunreda ct
edcom put
erizedda t
at
h at

3
4
5
6

com prom isest
h esecurit
yorconfident
ia lit
yof persona linform a t
ion m a int
a inedby
a n indiv idua lorent
it
ya spa rtof a da t
a ba seof persona linform a t
ion reg a rding
m ult
ipleindiv idua lsa ndt
h a tca uses, ort
h eindiv idua lorent
it
yrea sona blybeliev es

7
8

h a sca used, orw illca use, ident
it
yt
h eftorot
h erfra udt
o a nyresidentof t
he

9

C om m onw ea lt
h . G ood fa it
h a cquisit
ion of persona linform a t
ion bya n em ployeeor

10

a g entof a n indiv idua lorent
it
yfort
h epurposesof t
h eindiv idua lorent
it
yisnota

11
12

brea ch of t
h esecurit
yof t
h esyst
em , prov idedt
h a tt
h epersona linform a t
ion isnot

13

used fora purposeot
h ert
h a n a la w fulpurposeof t
h eindiv idua lorent
it
yorsubj
ect

14

t
o furt
h eruna ut
h orizeddisclosure.

15
16
17
18

131.

Th euna ut
h orizeda cquisit
ion of P la int
iffs’a ndC la ssm em bers’P I I

const
it
ut
eda “brea ch of t
h esecurit
yof t
h esyst
em ”of SonyunderSect
ion 18 .218 6 .6 .A . of t
h eC odeof Virg inia .

19
20
21
22

132. Sonyunrea sona blydela yed inform ing a nyonea boutt
h ebrea ch of
securit
yof Virg inia Subcla ssm em bers’confident
ia la nd non-public inform a t
ion
a ft
erSonyknew t
h eD a t
a B rea ch h a doccurred.

23
24
25
26
27
28

133. D efenda ntfa iledt
o discloset
o Virg inia Subcla ssm em bers, w it
h out
unrea sona bledela y, a nd in t
h em ostexpedientt
im epossible, t
h ebrea ch of securit
y
of t
h eirunencrypt
ed, ornotproperlya ndsecurelyencrypt
ed, persona linform a t
ion
w h en t
h eyknew orrea sona blybeliev edsuch inform a t
ion h a dbeen com prom ised.
C la ssA ct
ion C om pla int–P a g e41

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 42 of 45 Page ID #:42

1
2

134. Upon inform a t
ion a ndbelief, no la w enforcem enta g encyinst
ruct
ed
Sonyt
h a tnot
ifica t
ion t
o Virg inia Subcla ssm em bersw ould im pedeinv est
ig a t
ion.

3
4
5
6

135. N ot
h ing in Sect
ion 18 .2-18 6 .6 .I . of t
h eC odeof Virg inia lim it
sa n
indiv idua lfrom recov ering directeconom ic da m a g esfrom a v iola t
ion of t
h is
sect
ion.

7
8
9
10

136 . A sa resultof Sony’sv iola t
ion of Sect
ion 18 .2-18 6 .6 . of t
h eC odeof
Virg inia , Virg inia Subcla ssm em bersincurredeconom ic da m a g esrela t
ing t
o
expensesforcreditm onit
oring a nd ident
it
yt
h eftprot
ect
ion. I n a ddit
ion, t
h eyh a v e

11
12

expended m a nyh oursa t
t
em pt
ing t
o sa feg ua rdt
h em selv esfrom ident
it
yt
h eftor

13

ot
h erh a rm sca usedbyt
h erelea seof t
h eirP I I a sa resultof t
h eD a t
a B rea ch ,

14

including freezing t
h eircreditrecordsa ndot
h erident
ifyt
h eftprev ent
ion serv ices.

15
16
17
18

137 . P la int
iff C orona , indiv idua llya ndon beh a lf of t
h eot
h erVirg inia
Subcla ssm em bers, seeka llrem ediesa v a ila bleunderSect
ion 18 .2-18 6 .6 .I . of t
he
C odeof Virg inia , including , butnotlim it
ed t
o:(a ) da m a g essufferedbyVirg inia

19
20

Subcla ssm em bersa sa lleg eda bov e;a nd(b) equit
a blerelief.

21
22

P RA YE RF O RRE L I E F
W H EREF O RE, P la int
iffs, on beh a lf of t
h em selv esa ndt
h eC la sssetfort
h

23
24
25
26

h erein, respect
fullyrequest
st
h efollow ing relief:
A.

Th a tt
h eC ourtcert
ifyt
h isca sea sa cla ssa ct
ion pursua ntt
o F edera l

Ruleof C iv ilP rocedure23(a ), (b)(2) a nd(b)(3), a nd, pursua ntt
o F edera lRuleof

27
28
C la ssA ct
ion C om pla int–P a g e42

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 43 of 45 Page ID #:43

1
2

C iv ilP rocedure23(g ), a ppointP la int
iffsa ndP la int
iffs’counselof recordt
o
representsa idC la ss;

3
4
5
6

B .

F inding t
h a tSonybrea ch ed it
sdut
yt
o sa feg ua rda ndprot
ect

P la int
iffs’a ndt
h eC la ss’P I I t
h a tw a scom prom ised in t
h esecurit
ybrea ch t
h at
beca m epublic know ledg est
a rt
ing in N ov em ber2014;

7
8
9
10

C.

Th a tt
h eC ourta w a rdP la int
iffsa ndt
h eC la ssa ppropria t
erelief,

including a nya ct
ua la ndst
at
ut
oryda m a g es, rest
it
ut
ion a nddisg org em ent
.
D.

Th a tt
h eC ourta w a rdequit
a ble, inj
unct
iv ea nddecla ra t
oryrelief a s

11
12

m a ybea ppropria t
eundera pplica blest
at
ela w s. P la int
iffs, on beh a lf of t
h eC la ss

13

seeksa ppropria t
einj
unct
iv erelief, including butnotlim it
edt
o:(i) t
h eprov ision of

14

creditm onit
oring a nd/orcreditca rd m onit
oring serv icesfort
h eC la ssfora tlea st

15
16

fiv eyea rs;(ii) t
h eprov ision of ba nkm onit
oring a nd/orba nkm onit
oring serv ices

17

fort
h eC la ssfora tlea stfiv eyea rs;(iii) t
h eprov ision of ident
it
yt
h eftinsura ncefor

18

t
h eC la ssfora tlea stfiv eyea rs;(iv ) t
h eprov ision of creditrest
ora t
ion serv icesfor

19
20

t
h eC la ssfora tlea stfiv eyea rs;(v ) a w a rding P la int
iffsa ndt
h eC la sst
he

21

rea sona blecost
sa ndexpensesof suit
, including a t
t
orneys’fees, filing fees, a nd

22

insura ncefort
h eC la ss;a nd(v i) requiring t
h a tSonyreceiv eperiodic com plia nce

23
24

a udit
sbya t
h irdpa rt
yreg a rding t
h esecurit
yof it
scom put
ersyst
em sused for

25

st
oring currenta nd form erem ployeeda t
a, t
o ensurea g a instt
h erecurrenceof a

26
27
28

da t
a brea ch bya dopt
ing a ndim plem ent
ing bestsecurit
yda t
a pra ct
ices;
E.

A w a rding t
h eda m a g esrequest
ed h erein t
o P la int
iffsa ndt
h eC la ss;
C la ssA ct
ion C om pla int–P a g e43

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 44 of 45 Page ID #:44

1
2

F.

A w a rding a llcost
s, including expert
s’feesa nda t
t
orneys’fees, a nd

t
h ecost
sof prosecut
ing t
h isa ct
ion;

3
4
5
6

G.

A w a rding pre-j
udg m enta ndpost
-j
udg m entint
eresta sprescribedby

la w ;a nd
H.

G ra nt
ing a ddit
iona lleg a lorequit
a blerelief a st
h isC ourtm a yfindj
ust

7
8
9
10

a ndproper.
JURYTRI A L D EM A N D E D
P la int
iffsh erebydem a nda t
ria lbyj
uryon a llissuesso t
ria ble.

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
C la ssA ct
ion C om pla int–P a g e44

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 45 of 45 Page ID #:45

1
2

D A TED t
h is15t
h da yof D ecem ber, 2014.
K E L L E RRO H RB A C K L .L .P .

3
4
5
6
7
8

B y s/ K h esra w K a rm a nd
K h esra w K a rm a nd(SB N 28 027 2)
M at
t
h ew J. P reusch (SB N 29 8 144)
kka rm a nd@ kellerroh rba ck.com
m preusch @ kellerroh rba ck.com
1129 St
at
eSt
reet
, Suit
e8
Sa nt
a B a rba ra , C a lifornia 9 3101
Tel.:(8 05) 456 -149 6 , F a x(8 05) 456 -149 7

9
10
11
12
13
14
15
16
17
18

L ynn L incoln Sa rko, pro h a c v ice
fort
h com ing
lsa rko@ kellerroh rba ck.com
G ret
ch en F reem a n C a ppio, pro h a c v ice
fort
h com ing
g ca ppio@ kellerroh rba ck.com
C a riC a m pen La ufenberg , pro h a c v ice
fort
h com ing
cla ufenberg @ kellerroh rba ck.com
A m yN .L. H a nson, pro h a c v icefort
h com ing
a h a nson@ kellerroh rba k.com
1201Th ird A v e., Suit
e3200
Sea t
t
le, W a sh ing t
on 9 8 101
Tel:(206 ) 6 23-19 00/ F a x:(206 ) 6 23-338 4

19
20

Attorneys for Plaintiffs Michael Corona
and Christina Mathis

21
22
23
24
25
26
27
28
C la ssA ct
ion C om pla int–P a g e45