JohnsvSony Complaint FINAL
JohnsvSony Complaint FINAL
JohnsvSony Complaint FINAL
160029)
[email protected]
2 JARED R. SMITH (State Bar No. 130363)
[email protected]
3
ROTHKEN LAW FIRM
4 3 Hamilton Landing, Ste 280
Novato, CA 94949
5 Telephone: (415) 924-4250
Facsimile: (415) 924-2905
6
JOHN R. PARKER, JR. (State Bar No. 257761)
7
[email protected]
8 WILLIAM A. KERSHAW (State Bar No. 057486)
[email protected]
9 C. BROOKS CUTTER (State Bar No. 121407)
[email protected]
10 STUART C. TALLEY (State Bar No. 180374)
11 [email protected]
KERSHAW, CUTTER & RATINOFF, LLP
12 401 Watt Avenue
Sacramento, California 95864
13 (916) 448-9800 (voice)
(916) 669-4499 (fax)
14
11 I. OVERVIEW
1. This action is brought on behalf of plaintiff individually, as representative of the
12
common or general interest and as class representatives for all others similarly situated
13
nationwide against SONY to redress defendant’s breach of warranty, negligent data security,
14
violations of consumers’ rights of privacy, failure to protect those rights, and failure and on-going
15
refusal to timely inform consumers of unauthorized third party access to their credit card account
16
and other nonpublic and private financial information.
17
2. This action arises from SONY’s failure to maintain adequate computer data
18
security of consumer personal data and financial data, including, but not limited to credit card
19
data and the reasonably foreseeable exploitation of such inadequate security at defendant SONY
20
by computer “hackers,” causing the compromise of the privacy of private information of
21
approximately seventy-seven (77) Million consumer credit card account holders. Plaintiff is
22
informed and believes that this breach of security was caused by SONY’s negligence in data
23
security, including its failure to maintain a proper firewall and computer security system, failure
24
to properly encrypt data, its unauthorized storage and retention of data, its violation of Payment
25
Card Industry Data Standard(s) and rules and regulations it was bound to obey for the benefit of
26
consumers concerning the storage of consumers’ private identifying transaction and credit card
27
information, and its violation of California laws requiring the implementation and maintenance of
28
3 Defendant unduly delayed or failed to inform in a timely fashion the appropriate entities and
4 consumers whose data was compromised of their vulnerabilities and exposure to credit card (or
5 other) fraud such that consumers could make an informed decision as to whether to change credit
6 card numbers, close the exposed accounts, check their credit reports, or take other mitigating
7 actions. Defendant has failed to provide regular credit reports and credit monitoring at their own
8 expense to those whose private data was exposed and left vulnerable. This has caused, and
9 continues to cause, millions of consumers fear, apprehension, and damages including extra time,
10 effort, and costs for credit monitoring, and extra time, effort, and costs associated with replacing
11 cards and account numbers, and burden, and is harming both consumers’ and merchants’ ability
12 to protect themselves from such fraud. This lawsuit seeks to remedy this reprehensible situation.
13 4. Plaintiff and all other users of PlayStation® consoles and PlayStation® Network
14 ("PSN") service nationwide, were further damaged as a result of the disruption of service and loss
15 of data security. This suit seeks to redress SONY’s failure to adequately provide service to
18 and loss of personal data belonging to Plaintiff and Class members, Users experienced an inability
19 to access PSN services, including inability to use the online gaming network.
20 6. Defendant had not informed Plaintiff or all other users of PlayStation consoles and
21 PlayStation® Network ("PSN") service nationwide regarding the reason for suspension of service
22 or the fact of the security breach for a week after the security breach.
24 consumers and merchants have been exposed to what is one of the largest compromise of Internet
25 security and the greatest potential for credit card fraud to ever occur in United States history.
26 8. Plaintiffs seek damages to compensate themselves and the Class for their loss
27 (both temporary and permanent) of use of their PlayStation consoles and the PlayStation®
28 Network and Qriocity services (collectively referred to herein as "PSN" service), and their time
2 9. Furthermore, Plaintiff is informed and believes that Defendant has been aware for
3 a substantial period of time that PSN was prone to catastrophic loss of data from a security
4 breach. Nevertheless, Defendant failed to warn its customers of the problem or tried to prevent
5 them from suffering system suspension from security breaches and data losses. Defendant has
6 failed to effectively remedy the problems and defects inherent in the PSN. Unwilling to admit
7 fault, SONY sat silently while consumers purchased defective PlayStation consoles and PSN
8 service without warning customers about the risks inherent in purchasing and relying upon
10 10. Plaintiff asserts claims for breach of the Song-Beverly Consumer Warranty Act
11 (“Song-Beverly Act”), for breach of express warranty pursuant to Commercial Code §2313 and
12 pursuant to the Consumer Legal Remedies Act (“CLRA”), Civil Code §1750, for Negligence,
13 claims under Business and Professions Code §§17200 and 17500, et seq.
14 11. Plaintiff seeks actual and/or compensatory damages; restitution; equitable relief,
15 including the replacement and/or recall of the defective PlayStation consoles and the PSN service;
16 costs and expenses of litigation, including attorneys’ fees; and all additional and further relief that
17 may be available. Plaintiff reserves the right to amend his Complaint to add additional relief as
20 12. Plaintiff KRISTOPHER JOHNS, is a citizen of the State of Alabama and the
21 United States of America, who maintains a residence in Birmingham, Alabama, first purchased a
22 SONY PlayStation3 console, the PSN service and multiplayer games for use on the PSN service
23 in or around 2009. On or about April 17-18, 2011, Plaintiff noticed he had lost access to PSN, not
24 knowing of the security breach and loss of his personal and credit card data stored on SONY’s
25 servers.
28 liability company with its executive offices and principal place of business and corporate
3 (“SNEI”) is a Delaware limited liability company with its executive offices and principal place of
6 15. This case is subject to original jurisdiction in this court pursuant to the Class
7 Action Fairness Act of 2005. Pub. L. No. 109-2, 119 Stat. 4 (codified in scattered section of 28
8 U.S.C.)(“CAFA”) because at least one member of the proposed class has a different citizenship
9 from a defendant and the total matter in controversy exceeds $5,000,000 Thus, this court has
10 subject matter jurisdiction over this action pursuant to 28 U.S.C. §1332. Venue is proper in the
11 Northern District of California pursuant to 28 U.S.C. §1391 because this District is the district in
12 which defendant SCEA is located and a District in which a substantial part of the events or
17 17. Plaintiff brings this action pursuant to Fed. R. Civ. P. 23(b)(2) and Fed. R. Civ. P.
5 • whether Defendant’s conduct violates Cal. Bus. & Prof. Code § 17200;
6 • whether Defendant’s conduct violates Cal. Bus. & Prof. Code § 17500;
7
• whether Defendant’s breached the warranties alleged;
8
• whether Defendant misrepresented the PSN service capabilities to protect data;
9
• whether Defendant concealed and did not disclose the defects in the PSN service
10
capabilities to protect data;
11
• whether Defendant unreasonably delayed in remedying the suspension of service
12 and loss of data.
13
20. Plaintiff’s claims are typical of the claims of the members of the Class. Plaintiff
14
has no interests antagonistic to those of the Class and are subject to no unique defenses.
15
21. Plaintiff will fairly and adequately protect the interests of the Class and have
16
retained attorneys experienced in class and complex litigation.
17
22. A class action is superior to other available methods for the fair and efficient
18
adjudication of this controversy for the following reasons:
19
• It is economically impractical for each member of the Class to prosecute
20 individual actions.
21
• The Class is readily definable.
22
• Prosecution as a class action will eliminate the possibility of repetitious
23 litigation.
2 where all significant decision-making occurred with respect to the PSN service, is the center of
3 gravity for this action such that it is appropriate and consistent with existing law to certify the
5 24. Certification of such a class under the laws of California is appropriate because:
20 25. In addition to asserting class action claims in this action, Plaintiff also assert non-
21 class action claims on behalf of the common or general interest to sue for the benefit of all in
22 cases where the parties are numerous, and it is impracticable to bring them all before the court
23 pursuant to C.C.P. §382. The purpose of such claims is to require Defendant to disgorge and
24 restore all monies wrongfully obtained by Defendant through their false advertising and unfair
25 business practices. A common or general interest action is necessary and appropriate because
26 Defendant has engaged and continues to engage in the wrongful acts and false advertising
27 described herein as a general business practice. A case may be brought under C.C.P. §382
28 without a class being certified or where class certification is denied as long as the case involves a
2 jurisdiction over non-class common or general interest claims pursuant to C.C.P. §382, such
5 26. Defendant represents and advertises the PlayStation consoles and PSN and
6 Qriocity services as being an exceptionally powerful and secure gaming system and online
7 gaming network, offering games, music and movies to people with PlayStation consoles.
8 27. The PlayStation consoles and PSN service allow users to play games online and
9 buy content and services, such as new levels for games, movies, television shows or original
10 programs.
11 28. On information and belief, PSN’s security was breached between April 17-19,
12 2011, exposing names, addresses, email addresses, birthdates, usernames, passwords, logins,
13 security questions and possibly credit card data belonging to approximately seventy-seven (77)
15 29. On information and belief, Defendant shut down PSN upon learning of the breach,
16 but failed to advise Plaintiff or members of the Class until Tuesday, April 26, 2011.
17 30. Defendant’s shutdown of PSN prevented Plaintiff and the Class from buying and
18 downloading games or making use of their PlayStation consoles for multiplayer gaming over the
19 Internet.
20 31. On information and belief, children with accounts established by their parents also
22 32. SONY’s spokesperson reportedly announced that, "… we are advising you that
23 your credit card number (excluding security code) and expiration date may have been obtained."
24 33. On information and belief, members of the Class have begun to experience losses
25 from fraudulent use of credit card information believed compromised by the security breach
26 alleged herein.
27 34. Defendant has consistently misrepresented the quality and reliability of the PSN
28 service and its ability to keep data secure, including, but not limited to its representations in its
6 35. On information and belief, SONY failed to maintain proper and adequate backups
7 and/or redundant systems, failed to encrypt data and establish adequate firewalls to handle a
8 server intrusion contingency, failed to provide prompt and adequate warnings of security breaches
10 36. The harm caused by Defendant’s false and misleading statements and omissions
11 grossly outweigh any benefit that could be attributed to them.
12 37. On information and belief, Defendant is and has been aware of the scope of the
13 problems with the PSN service but has failed to take substantial corrective action. On
14 information and belief, Defendant has taken only minimal action in response to consumer
15 complaints.
16 38. Under a number of California consumer statutes and equitable provisions the
17 consumer product protections of California law are unwaivable by the use of any shrink-wrap
24 39. Unless notice is provided to the Class, and immediate remedial action taken, most
25 other users of the PlayStation and PSN service will eventually suffer the same fate, at
26 considerable cost, expense and loss as Plaintiff have suffered and continue to suffer to date.
27 40. On information and belief SONY was, at all times relevant herein, in violation of
28 the Payment Card Industry Data Security Standard by, including (without limitation), the
2 an unencrypted, unsecured, and unauthorized manner, failing to all reasonable steps to destroy, or
3 arrange for the destruction of a customer’s records within its custody or control containing
5 shred, erase, or otherwise modify the personal information in those records to make it unreadable
6 or undecipherable through any means; failing to properly install, implement, and maintain a
7 firewall to protect consumer data; failing to properly analyze and restrict IP addresses to and from
8 its computer systems; or properly perform dynamic packet filtering; failing to properly restrict
9 access to its computers; failing to properly protect stored data; failing to encrypt cardholder data
10 and other sensitive information; failing to properly implement and update adequate anti-virus and
11 anti-spyware software that would properly prevent unauthorized data transmissions caused by
12 viruses, executables or scripts, from its servers or computer systems; failing to track and monitor
13 all access to network resources and cardholder data; failing to regularly test security systems and
15 vulnerability scans.
17 “hackers” (unauthorized third parties) gained access to SONY’s computer data and compromised
18 the security of approximately seventy-seven (77) Million credit card accounts and related
19 security, identity and transaction data, including (without limitation) such data of California
20 residents.
21 42. On information and belief, one or more unauthorized persons who accessed
22 SONY’s computer data gained unauthorized access to the personal financial, credit and debit
24 43. The compromised and stolen data was private and sensitive in nature and, on
25 information and belief, was left unencrypted by SONY on its servers and included (without
26 limitation), on information and belief, consumers’ names, credit card account numbers, access
27 codes and other personal identifying information, including, but not limited to addresses,
7 45. Plaintiff brings this cause of action on behalf of himself, on behalf of the Class and
8 on behalf of the common or general interest. Plaintiff have suffered injury in fact and lost money
10 46. Defendant has engaged in unfair, unlawful and fraudulent business practices as set
11 forth above.
12 47. By engaging in the above-described acts and practices, Defendant has committed
13 one or more acts of unfair competition within the meaning of Bus. & Prof. Code §17200, et seq.
14 48. Defendant’s acts and practices have and/or are likely to deceive members of the
15 consuming public.
16 49. Defendant’s acts and practices are unlawful because they violate Civ. Code
17 §§1572, 1709, 1710, 1770(a)(5), 1770(a)(7) and 1770(a)(9). Defendant’s acts and practices are
18 also unlawful because they violate Bus. & Prof. Code §17500, et seq. Defendants unlawful and
19 unfair business practices include, without limitation, defendants’, and each of their, unlawful
20 negligence and violations of California Const., Art. I, Section I; Civil Code §§ 1798.81, 1798.81.5
21 and 1798.82; Finance Code §§ 4052.5 and 4057, the California Credit Reporting Act, the
22 prohibition against unreasonable penalties contained in Civil Code § 1671, and other laws of the
23 State of California.
24 50. The breach of SONY’s security was the direct and proximate result, on
25 information and belief, of SONY’s failure to implement and maintain security procedures and
26 practices reasonably designed to protect the credit card account and other nonpublic information
27 of consumers, including, without limitation, Plaintiff and the Class herein. Said breach of security
28
2 reasonably foreseeable.
3 51. Defendant, through its business relationship with Plaintiff and the Class herein,
4 and with each other, assumed the duty to keep the credit card account and other nonpublic
5 information of Plaintiff and the Class that is in their possession private and secure. By their acts
6 and omissions described herein, defendants, and each of them, unlawfully breached this duty.
7 52. Defendant was in a special and a fiduciary relationship with the Plaintiff and the
8 Class by reason of their entrustment with credit card account and other nonpublic information. By
9 reason of said special and fiduciary relationship, defendant had a duty of care to use reasonable
10 means to keep the credit card account and other nonpublic information of the Plaintiff and the
11 Class that is in their possession private and secure, and to inform Plaintiff and the Class members
12 forthwith when any compromise of the security of such information occurred. Defendant has
14 53. Pursuant to the right to privacy insured by California Const., Art. I, Section I,
15 defendants had a duty to use reasonable care to prevent the unauthorized access, use or
16 dissemination of the credit card account and other nonpublic information of the Plaintiff and the
17 Class herein. On information and belief, defendants unlawfully breached said duty.
18 54. Pursuant to California Civil Code § 1798.81.5, defendant had a duty to implement
19 and maintain reasonable security procedures and practices to with respect to the credit card
20 account and other nonpublic information of consumers, including, without limitation, the Plaintiff
21 and the Class herein, in order to protect such information from unauthorized access, use or
23 55. On information and belief, the Plaintiff’s and the Class’s information that was
24 disclosed to unauthorized third parties, due to the breach of SONY’s security was not encrypted.
25 Pursuant to California Civil Code § 1798.82, defendant had, and continues to have, a duty to
26 timely disclose the breach of security to Plaintiff and the Class whose personal information was,
28 breached this duty by, amongst other ways, delay and failure to properly disclose.
2 Code §§ 4050 et seq., defendant breached unlawfully the requirement to prevent the unauthorized
3 disclosure of nonpublic personal information of the Plaintiff and the Class to unaffiliated third
4 parties. Fin. C. § 4052.5. Defendant also unlawfully breached its duty to refrain from negligently
5 disclosing nonpublic information pertaining to the Plaintiff and the Class to third parties. Fin. C. §
6 4057.
7 57. Pursuant to the California Constitutional Right to Privacy and California law there
8 is an explicit public policy, creating and affirmative and continuing obligation on defendants
9 herein, to respect consumers’ privacy and to provide reasonable consumer computer data security
10 under the circumstances, including, without limitation, the Plaintiff and the Class herein, and to
11 protect the security and confidentiality of their nonpublic personal information. Such duties
12 include, without limitation, the duty to ensure security, protect against anticipated threats, and
13 protect against unauthorized access. Defendants, on information and belief, breached said duties.
14 58. Defendant’s acts and practices are also unlawful because they violate the Song-
16 59. Plaintiff, on behalf of himself, on behalf of the Class and on behalf of the common
17 or general interest, seeks an order of this Court awarding restitution, disgorgement, injunctive
18 relief and all other relief allowed under §17200, et seq., plus interest, attorneys’ fees and costs
20 60. Plaintiff meets the standing requirements of C.C.P. §382 to bring this cause of
21 action because, among other reasons, the question is one of a common or general interest, is a
22 question of many persons and/or the parties are numerous and it is impracticable to bring them all
24 B. Second Cause of Action for Violation of Bus. & Prof. Code §17500 by Plaintiff
Individually, as a Class Action and on Behalf of the Common or General
25 Interest
26 61. Plaintiff realleges and incorporates the above allegations by reference as if set forth
27 fully herein.
28
2 on behalf of the common or general interest. Plaintiff has suffered injury in fact and has lost
3 money or property as a result of Defendant’s violation of Bus. & Prof. Code §17500, et seq.
5 the public and offered the PlayStation consoles and PSN service for sale throughout the United
7 64. Defendant has engaged in the advertising and marketing alleged herein with intent
8 to directly or indirectly induce the purchase of the PlayStation consoles and PSN service.
10 and other characteristics of the PlayStation consoles and PSN service are false, misleading and
12 66. At the time Defendant made and disseminated the statements alleged herein, it
13 knew or should have known that the statements were untrue or misleading, and acted in violation
15 67. Defendant actively concealed its knowledge that the PlayStation consoles and PSN
17 68. Plaintiff has been harmed. Plaintiff, on behalf of himself, on behalf of the Class
18 and on behalf of the common or general interest, seeks restitution, disgorgement, injunctive relief
20 69. Plaintiff meets the standing requirements of C.C.P. 382 to bring this cause of
21 action because, among other reasons, the question is one of a common or general interest, is a
22 question of many persons and/or the parties are numerous and it is impracticable to bring them all
3 72. The PlayStation consoles are “consumer goods” within the meaning of Civ. Code
4 §1791(a).
5 73. Defendant’s implied warranty of merchantability arose out of and/or was related to
7 74. As set forth more fully above, Defendant has failed to comply with its obligations
9 75. Plaintiff and the Class have suffered and will continue to suffer damages as a result
10 of Defendant’s failure to comply with its warranty obligations. Accordingly, Plaintiff and the
11 Class are entitled to recover such damages under the Song-Beverly Act, including damages
13 76. Defendant’s breaches of warranty, as set forth above, were willful. Accordingly, a
14 civil penalty should be imposed upon Defendant in an amount not to exceed twice the amount of
15 actual damages.
19 77. Plaintiff realleges and incorporates the above allegations by reference as if set forth
20 fully herein.
21 78. Plaintiff brings this claim individually and on behalf of the Class against
22 Defendant.
24 and/or unfair acts as defined by Civ. Code §1750, et seq. to the detriment of Plaintiff, members of
25 general public and the Class. Plaintiff, the general public and members of the Class have suffered
26 harm as a proximate result of the violations of law and wrongful conduct of Defendant alleged
27 herein.
28 80. Defendant intentionally, knowingly and unlawfully perpetrated harm upon Plaintiff
2 to remedy these defects have violated the following provisions of the CLRA:
4 sponsorship, approval, characteristics, ingredients, uses, benefits or quantities which they do not
5 have.
7 particular standard, quality or grade, or that goods are of a particular style or model, if they are of
8 another.
9 (c) Civil Code §1770(a)(9): Advertising goods or services with intent not to
12 involves rights, remedies or obligations which it does not have or involve, or which are
13 prohibited.
15 contract.
16 81. The Defendant’s policies and practices are unlawful, unethical, oppressive,
17 fraudulent and malicious. The gravity of the harm to all consumers and to the general public from
18 Defendant’s policies and practices far outweighs any purported utility those policies and practices
19 have.
20 82. Pursuant to Civ. Code §1780(a), Plaintiff seeks an order enjoining Defendant from
22 83. Pursuant to Civ. Code §1782, if Defendant do not rectify its illegal acts within 30
24 a) actual damages;
26 c) punitive damages;
5 85. Defendant agreed to, among other things, properly maintain Plaintiffs’ and Class
6 members’ data and provide uninterrupted PSN service. In exchange, Class members agreed to
8 86. Valid consideration existed, as Plaintiff and Class members paid money in
9 exchange for Defendant’s agreement to, among other things, maintain Plaintiff’s and Class
11 87. The parties’ agreement is contained in customer contracts and related documents.
12 88. Defendant breached its contracts because Defendant did not properly maintain
13 Plaintiff’s and Class members’ electronic information or provide uninterrupted service.
14 89. Class members suffered and will continue to suffer damages including, but not
15 limited to, loss of their electronic information and an interruption in service.
16
2 users’ data would be adequately maintained, and that the PSN functionality would be
3 continuously available.
4 93. Valid consideration existed, as Plaintiff and Class members paid money to
5 Defendant in exchange for Defendant’s agreement to, among other things, maintain users’ data
7 94. Defendant breached their implied contracts because they did not properly maintain
8 Plaintiff and the Class members’ electronic information or provide uninterrupted service.
9 95. Plaintiff and Class members suffered and will continue to suffer damages
10 including, but not limited to, loss of their personal, private financial information and an
11 interruption in service.
16 97. Defendant unreasonably delayed informing anyone about the breach of security of
17 plaintiff’s personal, financial and other nonpublic information after they knew it had occurred.
18 98. On information and belief, the vast majority of the Class has not been directly
19 informed that the breach of security of their personal, financial and other nonpublic information
20 occurred.
21 99. Defendant failed to disclose to Plaintiff and the Class, in the most expedient time
22 possible and without unreasonable delay, the breach in security of unencrypted personal financial
23 and other nonpublic information of plaintiff when it knew or reasonably believed such
27 101. As a direct and proximate result of defendant’s acts and omissions described
28
2 invasion of privacy, loss of property, loss of money, loss of control of their personal financial and
3 other nonpublic information, fear and apprehension of fraud and loss of money and control over
4 their personal financial and other nonpublic information, and the burden of monitoring their
5 financial and credit accounts and taking other actions to protect themselves from fraud or
6 potential fraud, monetary loss, and injury to their credit and finances. The amount of such
7 damages will be proven at trial, but is in excess of the minimum jurisdiction of this court.
27
28
2 Wherefore, Plaintiff, on behalf of himself, all others similarly situated and the general
4 1) An order certifying this case as a class action and appointing Plaintiff and his
counsel to represent the Class.
5
2) Restitution and disgorgement of all amounts obtained by Defendant as a result
6 of its misconduct, together with interest thereon from the date of payment, to
7 the victims of such violations.
23
24
25
26
27
28
3
_____________________________
4 By: Ira P. Rothken, Esq., (State Bar #160029)
21
22
23
24
25
26
27
28
2 Pursuant to Civil L.R. 3-16, the undersigned certifies that the following listed persons,
3 associations of persons, firms, partnerships, corporations (including parent corporations) or other
4 entities (i) have a financial interest in the subject matter in controversy or in a party to the
5 proceeding, or (ii) have a non-financial interest in that subject matter or in a party that could be
8 Liability Company;
12
_____________________________
13 By: Ira P. Rothken, Esq., (State Bar #160029)
Attorneys for Plaintiff
14 KRISTOPHER JOHNS
15
Ira P. Rothken, Esq., (State Bar #160029)
16 Email: [email protected]
Jared R. Smith (State Bar No. 130363)
17 Email: [email protected]
ROTHKEN LAW FIRM
18 3 Hamilton Landing, Ste 280
Novato, CA 94949
19
Telephone: (415) 924-4250
20 Facsimile: (415) 924-2905