throbber
Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 1 of 11 PageID 1
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 1 of 11 PageID 1
`
`UNITED STATES DISTRICT COURT
`MIDDLE DISTRICT OF FLORIDA
`
`FORT MYERS DIVISION
`
`SALUSCARE, INC.
`
`Plaintiff,
`
`V.
`
`AMAZON WEB SERVICES, INC.
`and JOHN DOE, In Possession of Stolen
`SalusCare, Inc. Confidential Information,
`Thereby Injuring SalusCare, Inc. and Its
`Customers, Clients, and Vendors,
`
`Defendants.
`
`VERIFIED COMPLAINT AND DEMAND FOR JURY TRIAL
`
`INJUNCTIVE RELIEF REQUESTED
`
`Plaintiff SalusCare,Inc. (“SalusCare” or “Plaintiff’) hereby complains and
`
`alleges against Amazon Web Services, Inc. (“Amazon”) and John Doe (“John Doe”),
`
`as follows:
`
`NATURE OF THE ACTION
`
`1. This is a civil action for injunctive relief and damages against Defendant
`
`John Doe and for injunctive relief against Amazon arising under the Computer Fraud
`
`and Abuse Act, 18 U.S.C. § 1030, and the Computer Abuse and Recovery Act,
`
`Section 668.801, et seq. Florida Statutes. As further alleged below, Defendant John
`
`Doe wrongfully accessed SalusCare’s computer systems and extracted SalusCare’s
`
`confidential business and patient financial and health-related information and other
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 2 of 11 PageID 2
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 2 of 11 PageID 2
`
`sensitive information. Defendant John Doe then contracted with Defendant Amazon
`
`for web-based storage “buckets,” into which the extracted data was uploaded.
`
`Unless both Defendants are enjoined immediately, Defendant John Doe will likely
`
`sell the stolen information on the “dark web” where it will likely be used to promote
`
`identity theft and possible online disclosure—any of which would cause substantial,
`
`imminent, and irreparable harm to Plaintiff.
`
`THE PARTIES
`
`2. Plaintiff SalusCare is a not—for-profit mental health and substance abuse
`
`service provider headquartered in Fort Myers, Florida.
`
`Incorporated in 2013,
`
`following the merger of Lee Mental Health Center and Southwest Florida Addiction
`
`Services (SWFAS), it is the most comprehensive provider of behavioral healthcare
`
`services in Southwest Florida.
`
`3. Amazon is a Delaware corporation which provides information storage
`
`services to individuals and companies. Amazon is the owner of the server containing
`
`the buckets of stolen information. Amazon routinely contracts with entities for such
`
`data storage services throughout the United States and the world, including the State
`
`of Florida. Amazon is headquartered in and a resident of the State of Washington.
`
`4. Defendant John Doe controls two web—based storage sites, or “buckets,”
`
`which it has created under contract with Amazon, in which the stolen information
`
`has been stored. SalusCare is informed and believes and thereupon alleges that John
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 3 of 11 PageID 3
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 3 of 11 PagelD 3
`
`Doe can likely be contacted via web portal available at s3://sa1uscare and
`
`s3://saulscare. SalusCare is unaware of the true name(s) of Defendant sued herein
`
`as John Doe and, therefore, sues this Defendant under a fictitious name. Plaintiff
`
`will amend this Complaint to allege the true name and capacity of Defendant John
`
`Doe when ascertained. Plaintiff has exercised due diligence and will continue to
`
`exercise due diligence to determine Defendant John Doe’s true name(s), capacity,
`
`and contact information, and to effect service on that Defendant.
`
`5. On information and belief, the fictitiously named Defendant is responsible
`
`for the occurrences herein alleged, and SalusCare’s injuries as herein alleged were
`
`proximately caused by such Defendant.
`
`6. On information and belief, the actions and omissions alleged herein to have
`
`been undertaken by Defendant and their agents were actions that Defendant
`
`authorized, controlled, directed, or had the ability to control, direct, and/or were
`
`actions and omissions Defendant assisted, participated in, or otherwise encouraged,
`
`and are actions for which Defendant is liable.
`
`JURISDICTION AND VENUE
`
`7. This Court has jurisdiction over the subject matter of this action pursuant
`
`to 28 U.S.C. § 1331, as the action arises under the federal Computer Fraud and Abuse
`
`Act (18 U.S.C. § 1030) (“CFAA”). This Court has subject-matter jurisdiction under
`
`28 U.S.C. § 1367 over the claims for violation of Florida’s Computer Abuse and
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 4 of 11 PageID 4
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 4 of 11 PageID 4
`
`Recovery Act (“FCARA”), Ch. 668.801 et seq. Fla. Stat, which forms part of the
`
`same case or controversy as the CFAA claim.
`
`8. This Court has personal jurisdiction over Defendant John Doe as a result of
`
`the Defendant’s unauthorized access into, and misappropriation of information from,
`
`a “protected computer” as defined in 18 U.S.C. § lO30(e)(2)(B) that is used for
`
`commerce and communication with persons and entities in Florida, and also as a
`
`result of Defendant’s wrongful conduct causing injurious effect in Florida.
`
`9.
`
`This Court has personal jurisdiction over Defendant Amazon because
`
`Amazon, through its web—based information storage business, provides web-storage
`
`services extensively to individuals and businesses which transmit data and payment
`
`therefore from Florida. Accordingly, Amazon operates, conducts, carries on, and a
`
`business or business venture in Florida, and is engaged in substantial and not isolated
`
`activity in this state.
`
`10. Venue is proper in this judicial district pursuant to 28 U.S.C. § 1391(b).
`
`A substantial part of the events or omissions giving rise to SalusCare’s claims
`
`occurred in this judicial district.
`
`FACTS
`
`11. On or about March 16, 2021, SalusCare learned of the unauthorized
`
`access to and exfiltration of its data when issues of “slowness” were detected in its
`
`computer network. A prompt forensic inspection revealed that the data had been
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 5 of 11 PageID 5
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 5 of 11 PagelD 5
`
`sent to one or two data storage “buckets” owned and managed by Amazon pursuant
`
`to “code” originating in Ukraine. SalusCare has no business in Ukraine and is
`
`unaware of any legitimate, non-fraudulent, explanation for such an exfiltration.
`
`12. The breached machines, or computers, are “protected computers” under
`
`18 U.S.C. § 1030(e)(2)(B), which defines a “protected computer” as a computer
`
`which is used in or affecting interstate or foreign commerce or
`communication, including a computer located outside the United States
`that is used in a manner that affects interstate or foreign commerce or
`communications to the United States.
`
`The breached computers are used for
`
`interstate and foreign commerce or
`
`communication.
`
`13. After discovering the incident, SalusCare acted promptly in contacting
`
`Amazon requesting that the buckets of stolen data be “locked.” Amazon responded
`
`that the bucket accounts had been “suspended.” However, Amazon has given no
`
`assurance of how long they will remain suspended. SalusCare, in spite of its forensic
`
`investigation, has yet been unable to determine the identity of the intruder, the
`
`precise scope of the intrusion, and the extent of the damages. This investigation is
`
`ongoing.
`
`14. Plaintiff has already been irreparably harmed by Defendant John Doe’s
`
`illegal misappropriation of SalusCare’s data. To date, Plaintiff has been forced to
`
`spend a substantial sum of money (in excess of $12,000.00) to investigate the
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 6 of 11 PageID 6
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 6 of 11 PageID 6
`
`incident and to remediate the damage Defendant John Doe has caused and is in the
`
`position to further cause.
`
`COUNT I —- JOHN DOE: VIOLATION OF THE
`
`COMPUTER FRAUD AND ABUSE ACT
`
`(18 U.S.C. § 1030)
`
`15. SalusCare realleges and incorporates by reference the allegations
`
`contained in paragraphs 1 through 14 above.
`
`16. Title 18, United States Code, Section 1030(g) provides that “any person
`
`who suffers damage or loss by reason of a violation of this section may maintain a
`
`civil action against the Violator to obtain compensatory damages and injunctive relief
`
`or other equitable relief.” Under 18 U.S.C. § 1030(g), (a)(2)(C), and (c)(4)(A)(i)(I),
`
`a civil action may be brought if the conduct involves a loss during any one-year .
`
`period aggregating at least $5,000 in value.
`
`17. Defendant John Doe violated the Computer Fraud and Abuse Act, 18
`
`U.S.C. § 1030(a)(2)(C), by knowingly and intentionally accessing SalusCare’s
`
`protected computers without authorization or in excess of any authorization and
`
`thereby obtaining information from the protected computers in a transaction
`
`involving an interstate or foreign communication.
`
`18. Defendant John Doe further violated the Computer Fraud and Abuse Act,
`
`18 U.S.C. 1030(a)(5)(B), by intentionally accessing protected computers without
`
`authorization, and as a result of such conduct, recklessly causing damage to Plaintiff.
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 7 of 11 PageID 7
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 7 of 11 PagelD 7
`
`19. Defendant John Doe again further violated the Computer Fraud and Abuse
`
`Act, 18 U.S.C. 103 0(a)(5)(C), by intentionally accessing protected computers
`
`Without authorization, and as a result of such conduct, causing damage and loss to
`
`Plaintiff.
`
`20. Defendant’s conduct has caused a loss to Plaintiff during a one-year period
`
`aggregating well in excess of the statutory minimum of $5,000 in value.
`
`21. Plaintiff has suffered damages resulting from Defendant John Doe’s
`
`conduct.
`
`22. Plaintiff seeks compensatory and punitive damages under 18 U.S.C. §
`
`1030(g) in an amount to be proven at trial.
`
`23. As a direct result of Defendant John Doe’s actions, Plaintiff has suffered
`
`and continues to suffer irreparable harm for which Plaintiff has no adequate remedy
`
`at law. Plaintiff will continue to suffer irreparable harm until an injunction issues
`
`against Defendant.
`
`COUNT II — JOHN DOE: COMPUTER ABUSE AND RECOVERY ACT
`
`(Ch. 668.801 et seq. Fla. Stat.)
`
`24. Plaintiff realleges and incorporates by reference the allegations contained
`
`in paragraphs 1 through 14 above.
`
`25. This is an action for damages and injunctive relief against John Doe
`
`under Florida’s Computer Abuse and Recovery Act (“FCARA”), Ch. 668.801 et
`
`seq. Fla. Stat.
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 8 of 11 PageID 8
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 8 of 11 PageID 8
`
`26. FCARA provides. a private right of action for damages against one who
`
`“[o]btains information from a protected computer without authorization and, as a
`
`result, causes harm or loss.” Fla. Stat. 668.8030). FCARA defines a “protected
`
`computer” as one which is:
`
`used in connection with the operation of a business and stores
`information, programs, or code in connection with the operation of the
`business in which the stored information, programs, or code can be
`accessed only by employing a technological access barrier.
`
`Fla. Stat. 668.802(6).
`
`27. At all times, SalusCare used the computer from which the subject data
`
`was stolen in the operation of its business, to store information, and protected from
`
`unauthorized access by a technological access barrier.
`
`28. John Doe’s theft ‘of SalusCare’s data has caused SalusCare to suffer
`
`harm and loss.
`
`29.
`
`In addition to harm and loss compensable with a monetary award, the
`
`theft has caused, and continues to cause SalusCare to suffer irreparable hann for
`
`which SalusCare has no adequate remedy at law. Plaintiff will continue to suffer
`
`irreparable harm until an injunction issues against Defendant John Doe.
`
`COUNT HI — AMAZON: INJUNCTION
`
`(Ch. 668.801 et seq. Fla. Stat.)
`
`30. Plaintiff realleges and incorporates by reference the allegations contained
`
`in paragraphs 1 through 14 and 26 through 29 above.
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 9 of 11 PageID 9
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 9 of 11 PageID 9
`
`31.
`
`This is an action for injunctive relief against Amazon under Florida’s
`
`Computer Abuse and Recovery Act (“FCARA”), Ch. 668.801 et seq. Fla. Stat.
`
`32. SalusCare has no adequate remedy at law. Rather, to protect SalusCare
`
`and its patients and employees from irreparable injury, Amazon must be
`
`immediately enjoined from allowing John Doe any further access to the Buckets.
`
`PRAYER FOR RELIEF
`
`WHEREFORE, Plaintiff SalusCare prays that the Court:
`
`a. Enter in favor of SalusCare and against the John Doe a money judgment
`
`that includes (a) disgorgement of the John Doe’s profits; (b) compensatory damages;
`
`(c) enhanced, exemplary, special, and punitive damages; ((1) attorney’s fees, costs,
`
`and expenses; and (e) interest.
`
`b. Enjoin Defendants John Doe and Amazon and their officers, directors,
`
`principals, agents, servants, employees, successors, and assigns, and all persons and
`
`entities in active concert or participation with them, from engaging in any of the
`
`activity complained of herein or from causing any of the injury complained of herein
`
`and from assisting, aiding or abetting any other person or business entity in engaging
`
`in or performing any of the activity complained of herein or from causing any of the
`
`injury complained of herein;
`
`0. Order that Amazon and its officers, directors, principals, agents, servants,
`
`employees, successors, and assigns, and all persons and entities in active concert or
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 10 of 11 PageID 10
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 10 of 11 PageID 10
`
`participation with them, deliver to Plaintiff a complete copy of the contents of the
`
`Buckets along with complete audit logs of all transfers of information into and out
`
`of the Buckets, and thereafter permanently purge all contents of the Buckets.
`
`(1. Order that John Doe and its officers, directors, principals, agents, servants,
`
`employees, successors, and assigns, and all persons and entities in active concert or
`
`participation with them, deliver to Plaintiff a complete copy of all files and data
`
`exfiltrated from the Buckets, along with complete audit logs of all such transfers of
`
`such data, and thereafter permanently purge from its system(s) all information stolen
`
`from plaintiff.
`
`6. Award Plaintiff any and all other relief to which Plaintiff is entitled.
`
`Respectfully submitted on March 3, 2021.
`
`

`

`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 11 of 11 PageID 11
`
`Case 2:21-cv-00250 Document 1 Filed 03/23/21 Page 11 of 11 PageID 11
`
`VERIFICATION
`
`STATE OF FLORIDA )
`) §
`)
`
`COUNTY OF LEE
`
`I hereby verify that I am the President and Chief Executive Officer of SalusCare,
`
`Inc. and that the contents of this Verified Complaint are true and accurate to the best
`
`of my knowledge and belief.
`
`4 S
`
`TACEY COOK, MSW, LCSW, CPNLP
`
`SWORN TO and SUBSCRIBED BEFORE ME, Via m physical presence or Cl
`
`online notarization, this
`23
`day of March
`, 2021, by STACEY COOK, who
`took an oath and who is personally known by me or who has produced
`0-
`'
`e
`'D
`as identification.
`
`
`
` ota _ Public
`
`
`LED—KI KNIéIIT
`
`
`2 MY COMMISSION # GG 084523
`'
`10:5
`EXPIRES: May II. 2021
`'
`"Jr-"I Bonded Thru Notary Public Underwriters
`
`
`
`,
`
`J. TOM SMOOT, III, P.A.
`Trial Counsel for Plaintiff
`
`1401 Lee Street, Suite D
`
`Fort Myers, Florida 33901
`Telephone: (239) 337—7037
`Facsimile: (239) 332-7825
`Primary email: tomgaltsmootcom
`Other email: sharonfatsmootcom
`
`
`
`By: CVWIE/Vflé
`
`
`
`James Thomas Smoot, III
`Florida Bar No.: 886874
`
`

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket