Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 1 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 1 of 43
`
`
`
`
`
`
`EXHIBIT A
`EXHIBIT A
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 'Page 2 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 2 of 43
`
`.
`
`ES1
`
`Commonwealth of Massachusetts
`
`TRIAL COURT OF THE COMMONWEALTH
`SUPERIOR COURT DEPARTMENT
`CIVILDOCKEI‘NO SUCV2019— CV_037—18 BLS’I
`
`SUFFOLK, SS.
`
`ROBERT HARTIGAN,
`on behalf of himself and
`all others similarl ’
`PLAINTIFHS),
`Situated
`MAdts,INc
`
`, DEFENDANT(S)
`
`THIS su'IVII’I/IONS lS DIRECTED To
`
`MACYS ,
`
`son/moms
`
`INC
`
`You are being sued. The Plaintiffls) named above has started a lawsuit against youm opfizofIH'ejgfi:
`Plaintiff‘s Cosmplléiéfnt Tiled against you is attached to this summons and the original complaI‘ffi has been
`u
`filedIn the
`O k suPeriorcOurt. you MUST ACT PROMPTLY To PROTECT YOUR RIGHTS.
`
`You must respond to this lawsuit in writing within 20 days. If you do" not respond, the court may decide
`
`the case against you and award the Plaintiff everything asked for in the complaint. You will also lose'the
`opportunity to'tell your side of the story. You must respond to this lawsuit in writing even if you expect
`to resolve this matter with the Plaintiff- if you need more time to respond, you may request an .
`
`a.
`
`30fi£onb
`02108
`
`3.
`
`-
`extension of time in writing from the Court.
`' How to Respond. To respond to this lawsuit, .you must file a written response with the court and mail a
`copy to the Plaintiff’s Attorney (or the Plaintiff, if unrepresented) You can do this by: -
`Filing your signed original responsewith the Clerk's Office for Civil Business, SUf f0 1k Court,
`Superior
`3 Pemberton Square
`(address) bymaIl or In person, AND
`Delivering ozr mailing a coogy of your response to the Plaintiff's Attorney/Plaintiff at the following
`Salem reen, Suite 2, Salem MA IQT97O
`.
`address:
`.23
`What to includein your response. An "Answer” is one type of response to a Complaint. Your Answer
`must state whether you agree or disagree with the fact(s) alleged in each paragraph of the Complaint.
`Some defenses, called affirmative defenses, must be statedIn your Answer oryou maylose your right to .
`use themIn court. if you have any claims against the Plaintiff (referred to as counterclaims) that are
`"
`based on the same facts or transaction described'In the Complaint, thenyou must include those claims ,
`in your Answer. Otherwise, you may lose your right to sue the Plaintiff about anything related to this
`lawsuit. if you want to have your case heard by a jury, you must specifically request a jury trial'In your
`Answer or in a written demand for a jury trial that you must send to the other side and file with the
`court no more than 10 days after sending your Answer. You can also respond to a Complaint byIfiling a
`"Motion to Dismiss," if you believe that the complaint is legally invalid or legally insufficient. A Motion
`to Dismiss must be based on one of the legal deficiencies or reasons listed under Mass. R. Civ. P. 12. if
`you are filing a Motion to Dismiss, you must also comply with the filing procedures for ”Civil Motions”
`described in the rules of the Court in which the complaint was filed, available at
`www.mass.gov.courts/case—Iegal—res/rules of Court.
`
`,.
`
`F
`
`F
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 3 of 43
`Case 1:.20-cv-10551-PBS Document 1-_1 Filed 03/19/20 Page 3 of 43
`
`Legal Assistance. You maywish to get legal help from a lawyer. if you cannot get legal help, 'some basic
`wwvv.mass.gov/courts/selfhelp.
`information for people who represent themselves is available at
`Required information on all filings: The "civil docket number” appearing at the top of this notice is the
`case number assignedto this case and must appear on the front of your Answer or Motion to Dismissj
`You should refer to yourself'as the f’D'efendant.”
`
`Witness i-ion. Judith Fabricant, Chiefiustice on
`
`
`ep Donovan
`Clerk—Magistrate
`
`.
`
`’
`
`February 14
`-
`
`20 20
`
`' Note: Tlre‘rmmber‘assigned to theContplaint by the Clerk-Magistrate at thebeginning of the’lawsuit‘sh‘ould be‘indicated on the
`summons before it is served on the Defendant.
`
`EROOF OF SERVICE OF PROCESS
` i hereby certify that on: February 1 9
`20 '29 l served a copy of this summons,
`together-with a copy of the complaint in this action, on the defendant namedin this-summons, in the
`following manner (See Mass. R. Civ. P. 4 (d)(1—5)):
`.
`Certlfied Mail; Retutn Receipt Requested.
`
`
`'
`
`
`
`
`
`
`
`i E
`
`
`
`
`
`. I Complete items 1. 2, and 3.
`lANT.
`l Agent
`
`
`I Print your name and address on the reverse
`X
`'
`y
`
`- so that we can return the card to you.
`.
`' "d
`
`Tit
`w
`I Attach this card to the back of the mailpi‘ece,
`- or- on the front if space permits.
`
`I. s delivery address different from item 1? El Yes
`1. Article Addressed to:
`if YES, enter delivery address below:
`[I No
`
`
`
`
`
`3- Service Type
`D Priority Mail Express®
`i
`
`D Adult Signature
`El Registered Mail7M
`:
`e
`El Adult Signature Restricted Delivery
`El Sadistered Mail Restricted:
`E’Certlfied Mail®
`Ivery
`9590 9402 4944 9063 0200 32
`c1 Certified Mail Restricted Delivery
`Return Repeiptfor
`.
`'
`..
`-
`-
`|
`.
`D 0°"th on Delivery
`El gefirrticg‘ézwrmatlonm '
`
`9_Articlr=..Number_Mansfecfromsen/iqe label) _.._M iggollfignalfiellvery REStrICtEd Delivery El Signature Confirmation
`Restricted Delivery
`
`70115 anal] BUD], Ella]: 313??
`)ailFiestrictedDelivery
`: PS Form 3811, July 2015 PSN 7530-02-000-9053
`thy/+15 M M Mub‘j S
`
`M wav‘sfifljflx L
`
`3
`
`{x Illlllllllllllllllllllllilllll |||||||||llll|l|
`
`
`
`
`
`.
`
`Domestic Return Receipt
`
`;
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 4 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 4 of 43
`
`.fl'
`
`COMMONWEALTH OF MASSACHUSETTS
`
`SUFF LK, ss.
`
`SUPERIOR COURT
`DEPARTMENT OF THE TRIAL COURT
`
`ROBERT HARTIGAN, on behalf of
`himself and all others similarly
`situated,
`
`Plaintiff,
`
`
`
`
`
`l
`MACY’S, INC.,
`
`5
`
`
`
`
`Defendant.
`
`t ,,
`_
`—
`FEE} E 29:
`‘
`'
`1.:
`(1:11
`31-1
`‘2‘
`2‘
`N 5%.;
`3’“
`G—
`5 .7]:
`{j
`]>
`:5:
`:_J
`7:13
`:32}:
`PLAINTIFF’S CLASS ACTION COMPLAINT mg;
`33
`:22;
`I
`I.
`-—i
`AND DEMAND FOR JURY TRIAL
`
`flaintiff, Robert Hartigan (“Plaintiff’ or “Hartigan”) seeks to represent himself and all
`
`other similarly situated individuals (“Class” or “Class Members”) in claims against Macy’s,- Inc.
`
`(“Macy’s” or “Defendant”).
`
`
`
`In October 2019, Macy’s, a well-known department store chain, had its data security
`
`breached, impacting and disclosing thousands of customers’ financial information (“The Breach”).
`
`‘Vtore precisely, between October 7, 2019 and October 15, 2019, hackers stole personal
`
`customer information from Macy’s website. Macy’s website was hacked by an unauthorized third-
`
`party which permitted the third-party to capture customer’s checkout and wallet-page information.
`
`i he information unlawfully accessed and disclosed included customers’ first and last
`
`names; ddresses; phone numbers; email addresses; and credit card numbers (with security codes
`
`and expfration dates).
`
`As Macy’s described in a public statement issued shortly after The Breach, “we are aware
`
`of a highly sophisticated and targeted data security incident related to www.macys.com.”
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 5 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 5 of 43
`
`LnaletterdatedNovember 14,2019, Macy’s explainedthat Mr. Hartigan’s andthe Class’s
`
`personail information was the subject of a recent data breach and that Macy’s would provide a year
`
`of cred't monitoring (“Breach Notification Letter”).
`
`
`
`The Breach Notification Letter informed customers that identify theft and financial crimes
`
`were pbssible as a result of Macy’s loss of sensitive financial information it had collected from
`
`Mr. HTigan and others.
`
`Macey’s went on to task Mr. Hartigan, and other customers, with being vigilant and taking
`
`myriad steps to avoid identity theft.
`
`However, Macy’s neither offered financial compensation nor an opportunity to obtain, free
`
`of charge, certain professional monitoring for the purposes of preventing the victims from identity
`
`theft beyond one year’s time.
`
`
`
`
`Plaintiff alleges that Macy’s unlawfully, negligently, and unfairly failed to ensure the
`
`security of, and protect, Plaintiff and Class Member’s information.
`
`As such, Plaintiff contends that Macy’s actions constituted violations of the Massachusetts
`
`comm n-law, statutory law and regulations.
`
`TBy way ofthis action, Plaintiffasserts that: (1) Macy’s breached its duty and obligationto
`
`keep cpstomer’s information confidential; (2) Macy’s negligently violated the privacy rights of
`
`Plaintif and the putative class by failing to protect sensitive information in conformity with its
`
`duties; and (3) Macy’s did not adequately fulfill its duty to prevent and mitigate actual or potential
`
`damages caused by The Breach.
`
`Plaintiff contends that
`
`Massaihusetts law; and further, that Plaintiffand all Class Members have suffered cognizable
`
`the foregoing acts and omissions constitute violations of
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 6 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 6 of 43
`
`injuries due to the acts and omissions of Macy’s.
`
`PARTIES
`
`Plainti r , Robert Hartigan is an individual with a principal residence in Suffolk County,
`
`Massacfiusetts.
`
`Defendant, Macy’s, Inc. is a corporation organized and existing under the laws of the State of
`
`Delaw re, with a principal place of business in Cincinnati, Ohio.
`
`JURISDICTION AND VENUE
`
`This
`
`curt has personal jurisdiction over Macy’s by virtue of its continuous transactions,
`
`conducting of trade and business throughout the Commonwealth at all times relevant hereto.
`
`This Crurt hasjurisdiction over the claims contained herein as they relate to Plaintiffbecause the
`
`for damages for Plaintiff and the putative class exceed twenty-five thousand dollars "
`
`claims
`
`
`
`($25,000.00).
`
`. Venue in this matter is proper as Plaintiff resides Suffolk County, Massachusetts.
`
`FACTUAL ALLEGATIONS ~ THE BREACH
`
`Plaintii‘frepeats and re-alleges the allegations set forth above.
`
`On OIOber 10, 2019 at 9:46:43 P.M. EDT, Plaintiffpurchased items from Macy’s through its
`
`websit , www.macys.com, order #1816647941
`
`(“Purchases”).
`
`flee Exhibit
`
`1
`
`(“e-mail
`
`confirmation ofPlamtzfis purchasefiom Macy’s”)(redacted).
`.l
`. Plainti f‘ s Purchases were made using a Visa Credit Card.
`
`10.
`
`11.
`
`Plainti f’s Purchases were to be sent to his home address, with premium shipping.
`
`Plainti f and the Class were customers of Macy’s who purchased items from Macy’s via
`
`In October of2019 Plaintiff and the Class purchased items from Macy’s through Macy’s website;
`
`www.T'ww..macys.com'.
`Macy’iscom.
`
`
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 7 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 7 of 43
`
`In October of 2019, Plaintiff and the Class entered into a contract-with Macy’s to purchase items
`
`from its website.
`
`
`
`
`
`In Octher of2019, Macy’s offered Plaintiffand the Class certain items from its online store in
`
`exchange for a price.
`
`In Octdber of2019, Plaintiff and the Class accepted Macy’s offers for certain items from its store
`
`in exci‘ange for a price.
`
`In October of 2019, Plaintiff and the Class and Macy’s entered into binding contracts for the
`
`exchange of currency for goods and/or services.
`
`In October of 2019, Plaintiff and the Class provided personal information to Macy’s through its
`
`website; www.macys.com.
`.-.
`In Octhber of 2019, Plaintiff and the Class provided Macy’s their respective first names for the
`
`purpose of buying items from Macy’s through its website.
`
`In October of 2019, Plaintiff and the Class provided Macy’s their respective last names for the
`
`purpose of buying items from Macy’s through its website.
`
`In October of 2019, Plaintiff and the Class provided “Macy’s their respective addresses for the
`
`12.
`
`13.
`
`14.
`
`15.
`
`l6.
`
`17.
`
`718.
`
`19.
`
`purpose of buying items from Macy’s through its website.
`
`20.
`
`In October of 2019, Plaintiff and the Class provided Macy’s their respective phone numbers for
`
`the pu pose of buying items from Macy’s through its website.
`
`21.
`
`In October of 2019, Plaintiff and the Class provided Macy’s their respective credit card numbers
`
`forth purpose of buying items from Macy’s through its website.
`
`In Oclber of2019, Plaintiffand the Class provided Macy’s security codes to their respective
`
`22.
`
`credit cards for the purpose of buying items from Macy’s through its website.
`
`

`

`23.
`
`24.
`
`25.
`
`26.
`
`27.
`
`28.
`
`29.
`
`30.
`
`31.
`
`32.
`
`33.
`
`34.
`
`35.
`
`36.
`
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 8 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 8 of 43
`
`In October of 201 9, Plaintiff and the Class provided Macy’s the expiration dates to their respective
`
`credit cards for the purpose of buying items from Macy’s through its website.
`
`Macy’s collected and maintained personal and financial information about Plaintiff and the Class.
`
`Macy’s collected and maintained information about Plaintiff and the Class, including first and last
`
`names, fddresses, phene numbers and credit card information, including the numbers, the security
`codes ard the expiration dates (“Class Information”)
`
`Macy’s collected and maintained Class Information in its computer system.
`
`
`
`
`
`Macy’s collected andmaintained Class Information on its website.
`
`Macy’s collected and maintained Class Information on its servers.
`
`Plaintiff and the Class had the expectation that Macy’s would protect Class Information.
`
`
`
`Plaintiff and the Class had the expectation that Macy’s would not share Class Information with
`
`anyone other than authorized persons.
`
`Macy’d had the duty to protect Class Information.
`
`Macy’s had the duty to prevent disclosure of Class Information.
`
`Macy’T had the duty to prevent disclosure of Class Information personal
`
`information to
`
`unauthorized and/or nefarious individuals.
`
`Macy ad the duty to prevent disclosure of Class Information against known and unknown risks.
`
`Macy ad the duty to prevent disclosure of Class Information against malicious third parties,
`
`insiders, third party hackers and malware (software intentionally designed to cause damage to
`
`a computer, server, client, or computer network).
`
`.
`
`.2
`
`Macy had the duty to prevent disclosure of Class Information through web skimming (a form of
`
`internet fraud whereby a payment page on a website is compromised when malware is injected
`
`
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 9 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 9 of 43
`
`
`
`onto the page via a third-party script service in order to steal payment information).
`
`On or before October 7, 2019, hackers installed malware on Macy’s website.
`
`Between October 7, 2019 and October 15, 2019, hackers stole data, including Class Information,
`
`from Macy’s website.
`
`Betweer October 7, 2019 and October 15, 2019, hackers stole Class Information from Macy’s
`
`website to perpetrate identity theft.
`
`Betwee October 7, 2019 and October 15, 2019, malicious third parties accessed and obtained
`
`Class Information.
`
`Between October 7, 2019 and October 15, 2019, malicious third parties were permitted by Macy’s
`
`to acce s Class Information.
`
`Unknown third parties were not authorized access or view Class Information.
`
`Macy’d allowed Class Information to be accessed in an unauthorized manner.
`
`Macy’d allowed Class Information to be accessed andfor disseminated in an unauthorized manner.
`
`Unknovm third—party access, receipt, and/or review of Class Information constituted unauthorized
`
`- disclosures of the same.
`
`37.
`
`38.
`
`39.
`
`40.
`
`41.
`
`42.
`
`43.
`
`44.
`
`45.
`
`46.
`
`47.
`
`48.
`
`49.
`
`50.
`
`
`
`Macy’s has breached Plaintiff and the Class“ interest in privacy.
`
`Macy’T has made private facts regarding Plaintiffand the Class public.
`
`Third arties’ access of Class Information constituted an unauthorized disclosure by Macy’s.
`
`Plainti
`
`and the Class did not consent to the disclosure of their information to any unauthorized
`
`individual.
`
`Macy’s maintained a policy whereby its customers’ personal information would not be disclosed
`
`to una thorized parties (“Macy’s Privacy Policy”). fie Exhibit 2 (“Macy ’s and www.macys. com
`
`Notice ofPrivacy Practices”).
`
`
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 10 of 43
`ase 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 10 of 43
`
`
`
`Macy’s Privacy Policy states, “we at Macy’s understand that you entrust your data to us. We value
`
`that trust. Our collection and use of customer data is guided by our corporate principle of
`
`Customers First and subject to our Macy’s Responsible Information Management program.”
`
`Macy’s Privacy Policy states, “macys.com, macysbackstage.com, and mx.macys.com have put in
`
`place various procedural, technical, and administrative measures to safeguard the information we
`
`collect and use.”
`
`Macy'j Privacy Policy states, “[w]e designed our technology-enabled services to accept orders
`
`only fr m Web and mobile browsersthat permit communication through a Secure Socket Layer
`
`(SSL). SSL is an encryption standard that provides a layer of security while information is being .
`
`transmitted over the Internet...”
`
`Macy’s Privacy Policy states, “[a]s a matter of policy, we do not disclose details regarding our
`
`security measures as this could be beneficial information to criminals and other bad actors.”
`
`Macy’s Privacy Policy states, “sometimes bad actors attempt to use our brand to create fake web
`
`pages, [send fake texts or emails, and conduct other illegal activities to commit fraud or attempt to
`
`breach consumers’ security. *We actively monitor for these illegal scams and-Shams.”
`
`Macy’s did not comply with its policy to ensure that its customers personal information not -be
`
`
`
`disclojed to unauthorized parties.
`
`Macy’s promulgated rules to protect customers’ personal information.
`
`Macy’s did not comply with its own rules enacted to protect customers’ personal information.
`
`Macy’s promulgated rules to be followed by its employees in order to ensure the confidentiality
`
`of customers’ personal information.
`
`Macy’s did not enSure employees followed the rules pr0mulgated to ensure the confidentiality of
`
`51.
`
`52.
`
`53.
`
`54.
`
`55.
`
`56.
`
`57.
`
`58.
`
`59.
`
`60.
`
`
`
`

`

`iiase 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 11 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 11 of 43
`
`
`
`customers” personal information.
`
`Macy’s had contractual relationships with Plaintiff and the Class that it would protect Class
`
`Information.
`
`Macy’s did not comply with its contractual duties to Plaintiff and the Class.
`
`FACTUAL ALLEGATIONS — THE BREACH NOTIFICATION
`
`On or a‘bout November 14, 2019, Macy’s sent a breach notification (“Breach Notification Letter”)
`to PlaiTtiffand Class Members. & Exhibit 3 (Redacted).
`
`61.
`
`62.
`
`63.
`
`64.
`
`The Breach Notification Letter informed Plaintiff and the Class that Macy’s had a recent incident
`
`that'imiolved personal information about Plaintiffand the Class on www.macys.com.
`
`65.
`
`The Breach Notification Letter informed Plaintiff and the Class that Macy’s deeply regretted the
`
`incident occurred.
`
`‘.
`
`
`
`‘-66.
`
`2 ‘ 67.
`
`68.
`
`69.
`
`t!
`
`70.
`
`The Breach Notification Letter informed Plaintiff and the Class that Macy’s takes security of
`
`personal information seriously.
`
`The Breach Notification Letter informed Plaintiff and the Class that Macy’s recommended
`
`Plaintiff and the Class review the letter and take steps to protect against misuse of Class
`
`Information.
`
`The Breach Notification Letter informed Plaintiff and the Class that Macy’s. arranged for
`
`compl mentary identity monitoring services for 12 months.
`
`
`
`The Breach Notification Letter informed Plaintiff and the Class that Macy’s arranged for Internet
`
`Surveillance Services, which protects against dark web scanning for identity and credit card
`
`information.
`
`a
`
`a
`
`The Breach Notification Letter informed Plaintiff and the Class they could only receive identity
`
`monitoring within 12 months from the date of the Breach Notification Letter.
`
`
`
`

`

`base 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 12 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 12 of 43
`
`
`
`The Breach Notification Letter informed Plaintiff and the Class they should remain vigilant by
`
`regularly reviewing account statements and credit reports.
`
`The Breach Notification Letter informed Plaintiff and the Class they should report suspicious or
`
`unusual activity to their respective financial institutions.
`
`The Breach Notification Letter informed Plaintiff and the Class they should contact the Federal
`
`Trade Commission or law enforcement to report incidents of identity theft and to learn about the
`
`steps to protect themselves.
`
`The BrLachNotification Letter informed Plaintiffand the Class they could visit the Federal Trade
`
`74.
`
`Commission website to research identity theft.
`
`71.
`
`72.
`
`73.
`
`75.
`
`76.
`
`77.
`
`78.
`
`79.
`
`80.
`
`81.
`
`The Breach Notification Letter informed Plaintiff and the Class they could periodically obtain
`
`credit ieports from each nationwide reporting agency.
`
`The Breach Notification Letter informed Plaintiff and the Class they could contact Equifax,
`
`Experihn and TransUnion to obtain free copies of their credit reports.
`
`The Breach Notification. Letter informed Plaintiff and the Class they could add a fraud alert to
`
`help protect credit information.
`
`..
`
`
`
`The B each Notification Letter informed Plaintiff and the Class they could obtain a police report
`
`in regTd to the incident.
`The BrachNotification Letter informed Plaintiffand the Class they should place a security freeze
`
`on their credit.
`
`The Bleach Notification Letter informed Plaintiff and the Class that Macy’s would “provide as
`
`much assistance as we can.”
`
`I
`Macy s was required to protect Class Information from unauthorized access.
`
`
`
`
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 13 of 43
`
`fase 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 13 of43
`As a resiilt ofThe Breach, Plaintiffand the Class have been harmed.
`
`As a result of The Breach, Plaintiff and the Class have been subjected to a heightened risk for
`
`identity theft and harm.
`
`Neither Plaintiff nor members of the Class consented to the disclosure of Class Information to any
`
`third party or any other unauthorized individual.
`
`As a refult of The Breach, Plaintiff and the Class have been exposed to the heightened risk of
`person 1 identity theft which will require individuals to undertake continuing efforts and to invest
`
`
`
`82.
`
`83.
`
`84.
`
`85.
`
`signifi ant money in order to monitor their personal identity profile.
`
`86.
`
`One year 'of credit monitoring is not satisfactory to protect Plaintiff and..the Class from the
`
`. heightened-risk of personal identity theft.
`
`87.
`
`As a r sult* of the acts and omissions of Macy’s, Plaintiff and the Class.have suffered harm,
`
`including but not limited to, emotional distress, a breach in interest-in privacy, public disclosure
`
`
`
`of private facts and loss of time.
`
`~. ‘
`
`-
`
`‘
`
`- -
`
`CLASS ALLEGATIONS
`
`Plaintiff repeats and re-alleges the allegations set forth above.
`
`88.
`
`89.
`
`Plaintiff, on behalf of himself and similarly situated individuals, brings this action as a class action
`
`in accrirdance with Massachusetts Rule ofCivil Procedure 23.
`
`Plainti f and the Class are defined as follows:
`
`90.
`
`All individuals whose Class Information was stolen, distributed or aCCessed by
`unauthorized third parties as a result of The Breach.
`
`91.
`
`92.
`
`93.
`
`The m mbers of the Class are so numerous that joinder of all members would be impracticable.
`31
`G
`
`The Lmbers ofthe Class are easily ascertainable through Macy’s records.
`
`Plainjff‘s claims are typical of the claims of other members of the Class, as all members of the
`
`Class have been similarly affected by Macy’s unlawful acts and omissions.
`
`10
`
`
`
`

`

`hase 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 14 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 14 of 43
`
`94. Plaintiff will fairly and adequately protect the interests of the Class and is represented by counsel
`
`95.
`
`96.
`
`97.
`
`98.
`
`99.
`
`
`
`experienced in complex class action litigation.
`
`Common questions of law and fact exist and predominate over any questions of law or fact which
`
`may affect only individual Class Members. Common questions of law and fact include:
`
`A. Whether the acts and omissions of Macy’s constituted violations of: (l) M.G.L. c. 214, §
`
`1B;
`
`B. thther the acts and omissions of Macy’s constituted (I) Negligence; and/or (2) Breach
`
`of Contract;
`
`C. What is the applicable statute of limitations on any and all of the causes of action; and
`
`D. Whether Plaintiff and the Class are. entitled to damages, and if so, the proper measure of
`
`damages.
`
`‘
`
`_—..
`
`A class action will cause an orderly and expeditious administration of the claims of Class
`
`Members.
`
`A class action will foster economies of time, effort and expense to ensure uniformity of decisions, *
`
`presenting the most efficient manner of adjudicating the claims set forth herein.
`
`COUNT I
`
`.
`
`VIOLATION OF M.G.L. c. 214
`
`1B
`
`Plaintiff repeats and re-alleges the allegations set forth above.
`Macy’L had a legal duty to protect Class Information.
`
`100.Macy’f had a legal duty to diligently protect against and monitor and detect potential or actual
`
`breaches of Class Information.
`a
`
`, 101. Macy’s had a legal duty to ensure Class Information was not stolen.
`
`102. Macy’ had a legal duty to ensure Class Information was not distributed to third parties.
`
`103. Macy’s had a legal duty to ensure that its agents/employees complied with all applicable state laws
`
`11
`
`
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 15 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 15 of 43
`
`
`
`pertaining to the protection and confidentiality of Class Information.
`
`104. Class Information was stolen while under the protection of Macy’s.
`
`105. Class quormation was distributed to third parties while under the protection of Macy’s.
`
`106. Macy’s did not adequately protect Class Information.
`
`107. Macy’s did not detect and/or prevent unauthorized access to Class Information.
`
`108.Macy’s failure to protect Class Information led to an unreasonable, substantial and serious
`
`interferrnce oftheirprivacy.
`109.The actr and omissions ofMacy’s as described above constitute aviolation ofM.G.L. c 214, § 1B.
`
`110.The acts and omissions of Macy’s have caused unreasonable, substantial and/0r serious
`
`interference with Plaintiff’s and Class Members’ interest in privacy.
`111.The acis and omissions of Macy’s exposed Plaintiffand Class Members to the heightened risk of
`
`personalidentity theft as a result of Macy’s actions and omissions as described herein.
`
`112.The acis and omissions of Macy’s have exposed Plaintiff and Class Members to the heightened
`
`risk of serious financial detriment.
`
`1 13. The acjs and omissions ofMacy’s shall require Plaintiffand Class Members to incur costly identity "
`
`monitoring to ensure they are not victims of identity theft.
`
`114.As a result of the acts and omissions of Macy’s, Plaintiff and the Class Members-have suffered .
`
`
`
`harm, 'ncluding but not limited to, the costs associated with credit monitoring, a breach in their
`
`interesiinprivacy,public disclosureofprivate factsandlossoftime.
`WHEREFORE, Plaintiffand the Class respectfully request that this Court enter Judgment
`againsi Macy’s for its violations of M.G.L. c. 214, § 1B and award damages to adequately
`
`compensate Plaintiff and the Class.
`
`COUNT II
`
`NEGLIGENCE
`
`12
`
`
`
`3
`
`
`
`;
`
`I
`l
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 16 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 16 of 43
`
`115. Plaintif repeats and re-alleges the allegations set forth above.
`
`116.Macy’sfowedPlaintiffandthe Class adutyto protect ClassInformation.
`
`117. Macy’ had a duty to monitor Class Information.
`
`118.Macy’]had a duty to ensure Class Informationwas not stolen.
`
`119. Macy’s had a duty to ensure Class Information was not distributed to third parties.
`
`120.Macy’s had a duty to take action to protect against known risks which could lead to Class
`
`Information being accessed in an unauthorized manner.
`
`121.Macy’s had a duty to ensure that its employees comply with any and all state laws pertaining to
`
`the protection and confidentiality of Class Information.
`
`122. Macy’T failed to monitor Class Information.
`
`123. Macy’s failed to ensure Class Information was not stolen.
`
`
`
`
`
`124. Macy’s failed to ensure Class Information was not distributed to third parties.
`
`125.Macy’s failed to take action to protect against known risks which led Class Information being
`
`accessed in an unauthorized manner.
`
`126.Macy’s failed to ensure that its employees comply with any and all state laws pertaining to the
`
`protection and confidentiality of Class Information.
`
`127.All of the aforementioned acts and omissions constitute breaches of Macy’s duties.
`
`128. As a direct and proximate cause of Macy’s breach of its duties, Class information was stolen.
`
`129. As a direct and proximate cause of Macy’s breach of its duties, Class information was distributed
`
`to third parties.
`
`C“.
`
`a
`
`130. As a direct and proximate cause of Macy's negligence, Plaintiff and members of the Class have
`
`suffered breaches of their interest in privacy.
`
`131. As a direct and proximate cause of Macy’s negligence, Plaintiff and members of the Class have
`
`13
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 17 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 17 of 43
`
`
`
`been eTposed to unauthorized disclosure of Class Information.
`
`132.As a direct and proximate cause of Macy’s negligence, Plaintiff and members of the Class have
`
`been eitposed to an uunreasonable, substantial and/or serious interference with their interest in
`
`privacy.
`
`133.As a direct and proximate cause of Macy’s negligence, Plaintiff and members of the Class have
`
`been eirposed to the heightened risk ofpersonal identity theft.
`
`134.As a d rect and proximate cause of Macy’s negligence, Plaintiff and members of the Class have
`
`been eTposed to the heightened risk ofserious financial detriment.
`
`I35.As a dlrect and proximate cause of Macy’s negligence, Plaintiff and members of the Classmay
`
`incur jostly identity monitoring to ensure they are not victims ofidentity theft.
`
`136.As a direct and proximate-cause of Macy’s negligence, Plaintiff and members of the Class-have
`
`suffered‘harm, including but not limited to, the costs associated with credit monitoring, a breach
`
`
`
`in their interest in-privacy, public disclosure of private facts and loss of time.
`
`WHEREFORE, Plaintiffand the Class respectfully request that this Court enter Judgment
`
`against Macy’s for its negligence and award damages to adequately compensate Plaintiff and the
`
`Class.
`
`*
`
`*
`
`COUNT III
`
`BREACH OF CONTRACT
`
`137.Plaintiff repeats and re-alleges the allegations set forth above.
`
`138. Plaint ff and the Class sought to purchase items from Macy’s through its website.
`
`139. Macy 5 provided items to Plaintiff and the Class in consideration of payment for said items.
`a
`
`
`
`140.P1aint1ff and the Class Members each had a binding and enforceable contract with Macy's,
`
`whereby Plaintiff and Class Members received items in exchange for payment.
`
`141.Protecting and ensuring the confidentiality of Class Information was a term and condition of the
`
`14
`
`

`

`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 18 of 43
`Case 1:20-cv-10551-PBS Document 1-1 Filed 03/19/20 Page 18 of 43
`
`
`
`contracts between Macy’s and Plaintiff and members of the Class.
`
`142.Protect1ng and ensuring the confidentiality of Class Information was ensured by Macy’s Privacy
`
`Policy. E Exhibit 2.
`
`143. Macy” failed to maintain the security and protection of Class Information as prescribed by its own
`
`policie and Massachusetts law.
`
`144. Macy’ breached its contracts with Plaintiff and Class Members.
`
`145.Macy’i failure to maintain the security and protection of Class Information as prescribed by its
`ownpr%liciesandMassachusettslawconstitutedbreachesofcontract.
`
`146. As a result of Macy’s acts and omissions, Macy’s breachedthe terms of the contract with Plaintiff
`
`and m mbers of the Class.
`
`' 147.As a rTult ofMacy’s breaches ofcontracts, Plaintiffand members ofthe Class have been harmed.
`
`148. As a direct and proximate cause of Macy’s breaches of contract, Plaintiff and members ofthe Class
`
`have s ffered damages.
`
`149.—As a direct and proximate cause of Macy’s breaches of contract, Class Information was lost.
`
`- 150.As a direct and proximate cause of Macy’s breaches of contract, Class Infor