Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 1 of 19 1 2 3 4 5 6 7 8 9 10 11 KRONENBERGER ROSENFELD, LLP Karl S. Kronenberger (CA Bar No. 226112) (Application for admission Pro Hac Vice pending) Jeffrey M. Rosenfeld (CA Bar No. 222187) (Application for admission Pro Hac Vice pending) Virginia A. Sanderson (CA Bar No. 240241) (Application for admission Pro Hac Vice pending) 150 Post Street, Suite 520 San Francisco, CA 94108 Telephone: (415) 955-1155 Facsimile: (415) 955-1158 karl@KRInternetLaw.com jeff@KRInternetLaw.com ginny@KRInternetLaw.com Attorneys for Plaintiffs John Doe 1, John Doe 2, and John Doe 3 12 UNITED STATES DISTRICT COURT DISTRICT OF ARIZONA 13 14 15 John Doe 1, an individual; John Doe 2, an individual; and John Doe 3, an individual; Case No. 16 Plaintiffs, 17 18 19 20 21 22 23 v. COMPLAINT DEMAND FOR JURY TRIAL GoDaddy.com, LLC, a Delaware corporation; Amazon Web Services, Inc., a Delaware corporation; John Roe 1, d/b/a and ; John Roe 2, d/b/a ; John Roe 3, d/b/a ; and Roes 4–20, inclusive, 24 Defendants. 25 26 27 28 Case No. COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 2 of 19 1 2 Plaintiffs John Doe 1, John Doe 2, and John Doe 3 (collectively, “Plaintiffs”), by and through their undersigned counsel, hereby allege as follows: 3 NATURE OF THE ACTION 4 1. Plaintiffs’ claims arise out of the recent theft of massive amounts of private 5 consumer data, including private stored communications, from the adultery website and 6 dating service known as “Ashley Madison” by anonymous hackers. Due to the salacious 7 nature of Ashley Madison, this Internet crime has been widely reported in the media, both 8 in the United States and internationally. 9 2. While at least one class action has been filed by users against Ashley 10 Madison for its failure to property secure the hacked information, this action deals with a 11 different injury inflicted upon Ashley Madison users by persons and entities who have 12 obtained the stolen data, repurposed it such that it is more readily accessible and 13 searchable by the media and curious Internet users, and actively distributed it for their own 14 gain. 15 entrepreneurial rather than criminal, the fact remains that they are in willful possession of 16 stolen property. 17 3. While these persons and entities may labor under the belief that their actions are Indeed, in recognition of the fact that Ashley Madison data contains 18 confidential information and constitutes stolen property, a Canadian court, the Ontario 19 Superior Court of Justice, issued a restraining order requiring several websites and Internet 20 service providers to immediately disable the Ashley Madison data, deeming it “offence- 21 related property in respect of which order of forfeiture may be made under the [Ontario] 22 Criminal Code.” 23 4. By continuing to host and publish the stolen data despite their knowledge of 24 the pain and damage it is causing to those involved, these bad actors are intentionally 25 inflicting emotional distress upon Ashley Madison users. Two suicides have already been 26 attributed to the public dissemination of the Ashley Madison data. 27 28 5. Plaintiffs, who are proceeding anonymously in this action, are all former users of Ashley Madison who have been gravely affected by the stolen data and are now Case No. 1 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 3 of 19 1 subject to threats and extortion. The defendants are the website operators and Internet 2 Service Providers who are hosting the stolen data to facilitate public searches, often for a 3 fee. Through this action, Plaintiffs allege civil receipt of stolen property under California 4 law, violation of California’s Unfair Competition Law, intentional and negligent infliction 5 of emotional distress, and violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 6 1030 on behalf of Plaintiffs John Doe 1 through 3 and against GoDaddy.com, LLC 7 (“GoDaddy”), Amazon Web Services, Inc. (“Amazon”), and Roes 1 through 20 8 (collectively, the “Roe Defendants”). 9 10 11 12 JURISDICTION AND VENUE 6. This Court has subject matter jurisdiction over Plaintiffs’ federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030. 7. This Court has supplemental jurisdiction of Plaintiffs’ state law claims 13 pursuant to 28 U.S.C. § 1367(a) in that these state law claims are so related to the 14 Computer Fraud and Abuse Act claim raised in this Complaint that they form part of the 15 same case or controversy under Article III of the United States Constitution. 16 8. Alternatively, this Court has subject matter jurisdiction under 28 U.S.C. § 17 1332 because the matter in controversy exceeds the sum or value of $75,000, exclusive of 18 interest and costs, and the action is between citizens of different states. To wit, Plaintiffs 19 are citizens of and domiciled in California, New Jersey, and Maryland, while Defendants 20 are citizens of and domiciled in Delaware and Arizona. 21 9. Venue is proper under 28 U.S.C. § 1391 because many of the incidents, 22 events, or omissions complained of and giving rise to the instant claims and controversy 23 occurred within the State of Arizona and this District. 24 10. This Court has personal jurisdiction over Defendants because Defendants, 25 and each of them, do substantial business in Arizona and purposefully direct substantial 26 activities as the residents of Arizona by means of the Internet services and websites 27 described herein. Defendants, and each of them, have done substantial and continuous 28 business with Arizona residents and have purposefully directed substantial and pervasive Case No. 2 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 4 of 19 1 activities at the residents of Arizona such that each can and should reasonably expect to be 2 haled into the courts of Arizona. 3 4 5 6 7 8 9 10 PARTIES 11. Plaintiff John Doe 1 is an individual who, at all relevant times, was a citizen and resident of the state of California. 12. Plaintiff John Doe 2 is an individual who, at all relevant times, was a citizen and resident of the state of New Jersey. 13. Plaintiff John Doe 3 is an individual who, at all relevant times, was a citizen and resident of the state of Maryland. 14. If required, Plaintiffs will move for an order from this Court to proceed 11 anonymously. The judicial use of “Doe” plaintiffs to protect legitimate privacy rights has 12 gained wide currency, particularly given the rapidity and ubiquity of disclosures over the 13 World Wide Web, so long as the opposing parties’ rights are not prejudiced thereby. Here, 14 Plaintiffs’ anonymity is necessary to preserve privacy in a matter of sensitive and highly 15 personal nature—namely, the issue of extra-marital affairs. Plaintiffs can proceed in all 16 aspects of this litigation without prejudicing the rights of Defendants, or any of them. 17 15. Defendant GoDaddy.com, LLC (“GoDaddy”) is a Delaware corporation with 18 its principal place of business located in this state and District at 14455 North Hayden 19 Road, Scottsdale, Arizona. 20 Commission as a foreign entity doing business in Arizona. 21 16. GoDaddy has registered with the Arizona Corporation Defendant Amazon Web Services, Inc. (“Amazon”) is a Delaware 22 corporation doing business within this state and District. Amazon has registered with the 23 Arizona Corporation Commission as a foreign entity doing business in Arizona. 24 25 26 27 28 17. Because GoDaddy and Amazon are both Internet Service Providers, or ISPs, they are, at times, referred to collectively herein as the “ISP Defendants.” 18. Defendant John Roe 1 (“Roe 1”) is the owner and operator of the websites located at and . 19. Case No. Defendant John Roe 2 (“Roe 2”) is the owner and operator of the website 3 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 5 of 19 1 2 3 4 located at 20. Defendant John Roe 3 (“Roe 3”) is the owner and operator of the website located at . 21. Defendants Roes 4 through 20 are unknown at this time, but are believed to 5 be, among other persons or entities, additional Internet service providers and website 6 operators trafficking in the Stolen Data, as that term is described below. 7 22. The names and identities of the Roe Defendants, and each of them, are 8 presently unknown to Plaintiffs. Plaintiffs will amend this Complaint to allege the names 9 and identities of said Roe Defendants when they become known to Plaintiffs. Plaintiffs 10 may seek leave to conduct early discovery for the limited purpose of ascertaining the 11 identities of the Roe Defendants. 12 FACTUAL ALLEGATIONS 13 The Ashley Madison Internet Dating Service 14 15 16 23. Ashley Madison is the brand name of an Internet dating website and service specializing in adulterous affairs. 24. Ashley Madison is owned and operated by Canadian corporation Avid Life 17 Media, Inc. For purposes of this Complaint, Avid Life Media, the website located at 18 , and the services provided thereon are collectively referred to as 19 “Ashley Madison.” 20 25. According to the footer on Ashley Madison’s homepage, “Ashley Madison 21 is the most famous name in infidelity and married dating…. Ashley Madison is the most 22 successful website for finding an affair and cheating partners. Have an Affair today on 23 Ashley Madison. Thousands of cheating wives and cheating husbands signup everyday 24 looking for an affair [all sic].” As of the date of this Complaint, the homepage further 25 boasts a roster of “Over 40,330,000 anonymous members!” 26 26. Indeed, anonymity is one of the promises repeatedly made by Ashley 27 Madison to its members and prospective members. The homepage features the now-iconic 28 picture of a woman, wearing a wedding band and holding a finger to pursed lips in a Case No. 4 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 6 of 19 1 “Shhh…” fashion. Directly beneath her are the following attestations that the Ashley 2 Madison service is both private and secure: 3  A badge featuring four stars and the text “100% Like-minded people”; 4  The text “As see on: Hannity, Howard Stern, TIME, BusinessWeek, Sports 5 6 Illustrated, Maxim, USA Today”;  The text “Ashley Madison is the world’s leading married dating service for 7 discreet encounters”; 8  A graphic featuring a gold medal next to the text “Trusted Security Award”; 9  A badge featuring the text “100% DISCREET SERVICE”; and 10  A graphic featuring a lock with a green check on it and the text “SSL Secure 11 12 Site.” 27. In order to use the Ashley Madison dating service, “Users” must register by 13 inputting the following personal information, which is used to populate the user’s Ashley 14 Madison profile: a username and password, a personalized “greeting,” a country, zip code, 15 date of birth, email address, and physical attributes, such as height and weight. 16 28. To further populate their profiles, Users are permitted to input additional 17 “Preferences,” such as personal interests, qualities of a good match, and “Intimate 18 Desires,” which is a polite means of describing what can be graphic sexual interests. 19 Users also provide other intimate details and data with an expectation of complete privacy 20 within the membership base of Ashley Madison’s secure and controlled environment in 21 which personal identities were never disclosed. 22 29. While a User may create an Ashley Madison profile for free, payment is 23 required in order to use any of the services. Standard information is collected to process 24 credit and debit card payments, such as credit card number, cardholder name, and 25 associated billing address. 26 27 28 Plaintiffs’ Registration With Ashley Madison 30. At various times since 2008, but before July 2015, Plaintiffs, and each of them, registered as Users of Ashley Madison and provided personal and financial Case No. 5 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 7 of 19 1 2 information to Ashley Madison in the process. 31. At the time of registration, each Plaintiff reasonably expected that the data 3 provided to Ashley Madison would be managed with sufficient security protocols to 4 prevent hacking or other disclosure. 5 6 Theft and Dissemination of the Ashley Madison Data 32. The crime colloquially referred to as “hacking” is the unauthorized access of 7 a computer system without authorization and is a violation of federal law as well as that of 8 each of the fifty states. Hacking is the electronic equivalent of breaking and entering, and 9 any data acquired through such unlawful acts constitutes stolen property. 10 33. In or around July 2015, a group of hackers, who self-identify as The Impact 11 Team (the “Hackers”), released snippets of confidential User information stolen from 12 Ashley Madison’s servers, and publicly threatened to release much more if Ashley 13 Madison did not cease operation of its website and dating service. 14 34. When Ashley Madison refused to cave to the Hackers’ demands, on or about 15 August 18, 2015, the Hackers began a rolling release of User data stolen by the Hackers 16 from Ashley Madison. 17 35. In a README file appended to the Hackers’ first data dump, the Hackers 18 admitted that the released data was stolen from Ashley Madison’s servers through 19 unlawful hacking: 20 24 We are the Impact Team. We have hacked [Ashley Madison] completely, taking over their entire office and production domains and thousands of systems, and over the past few years have taken all customer information databases, complete source code repositories, financial records, documentation, and emails, as we prove here. And it was easy. For a company whose main promise is secrecy, it’s like you didn’t even try, like you thought you had never pissed anyone off. 25 36. 21 22 23 The data stolen and released by the Hackers includes names, passwords, 26 addresses, phone numbers, and Preferences submitted by users when they registered for 27 the site. 28 37. Case No. The data stolen and released by the Hackers also includes records of millions 6 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 8 of 19 1 of credit card transactions going back to 2008, including the cardholder names, billing 2 addresses, associated email addresses, and the last four digits of the credit card number(s) 3 used to pay for the User’s account. The release of this payment information has been 4 integral to public identification of Users in that, while Users could falsify personal 5 information, such as by using a fake name, payment information cannot be falsified 6 without the use of a stolen credit card number. 7 38. The data stolen and released by the Hackers also includes private stored 8 communications, such as chat logs and private messages exchanged between Users, many 9 of which include photographs or other identifying information. 10 11 39. The whole of the data stolen and released by the Hackers is collectively referred to herein as the “Stolen Data.” 12 40. The Stolen Data includes data pertaining to Plaintiffs, and each of them. 13 41. The Stolen Data was obtained by the Hackers without the authorization or 14 consent of either Ashley Madison or the Users. Plaintiffs, specifically, did not authorize or 15 consent to any access of their personal data. 16 42. The Hackers’ release of the Stolen Data ignited media frenzy, with news 17 outlets across the globe reporting on it and speculating about politicians and celebrities 18 that could be included within the User ranks. 19 43. However, the Stolen Data, as posted by the Hackers, is not easily accessed or 20 navigated by the average Internet user. The files containing the Stolen Data are each 21 several gigabytes in size, are comprised of massive strings of plain text, and are posted to 22 the so-called “Dark Web” at an address that is only accessible through the Tor browser.1 23 44. This inaccessibility, coupled with public interest, resulted in the immediate 24 creation of a cottage industry of websites that took the Stolen Data and parsed it into 25 databases that could be searched for specific names, email addresses, billing addresses, or 26 1 27 28 At the risk of oversimplification, content located on the Dark Web is located on the World Wide Web, but is not indexed by search engines and is not accessible through the same means as the public Internet. Instead, content on the Dark Web can only be accessed through specific software, browsers, or networks, such as Tor. Case No. 7 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 9 of 19 1 2 other User information. 45. Roe 1, Roe 2, and Roe 3 each own and/or operate a website within this 3 cottage industry, wherein the Roe Defendant has copied a portion and/or all of the Stolen 4 Data and made it searchable through the Roe Defendant’s website (collectively, the “Roe 5 Websites”). As such, each of these Roe Defendants is in willful and knowing possession 6 of stolen property—namely, the Stolen Data. 7 46. On information and belief, Roe 1, Roe 2, and Roe 3 each employ the 8 services of an ISP Defendant to host its Roe Website. This means that the Stolen Data, as 9 obtained by the Roe Defendant, is located on the servers belonging to and in the 10 11 possession of the corresponding ISP Defendant. 47. Because the theft of the Stolen Data has been widely reported in the media, 12 both in the United States and internationally, each of the Roe Defendants and ISP 13 Defendants has actual notice that the Stolen Data is stolen property. 14 15 16 48. Indeed, each of the Roe Defendants admits on their website that they know the Stolen Data they possess was procured through criminal hacking. 49. Moreover, as detailed below, Plaintiffs have provided written notice to each 17 of the ISP Defendants that the Stolen Data is (a) stolen property and (b) located on the ISP 18 Defendant’s servers at the Roe Website. 19 50. Because the ISP Defendants and Roe Defendants each have actual notice and 20 knowledge that the Stolen Data is (a) stolen property and (b) within their possession, each 21 Defendant is in willful and knowing possession of stolen property in violation of 22 California Penal Code section 496(a). 23 51. Because the ISP Defendants and Roe Defendants have each received, 24 possessed, stored, or sold the Stolen Data, knowing the same to have been unlawfully 25 taken, each Defendant has violated 18 U.S.C. § 2315. 26 52. Like most users, Plaintiffs have suffered damages, including severe emotion 27 distress, due to the ability of Plaintiffs’ spouses, children, family members, community 28 connections, business associates, and the public at large to identify Plaintiffs as Users of of Case No. 8 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 10 of 19 1 Ashley Madison. By this action, Plaintiffs seek compensatory damages in an amount to be 2 proven at trial, but not less than three million dollars ($3,000,000). 3 Defendants GoDaddy and Roes 1 and 2 4 53. Roe 1 is the owner and operator of the Roe Websites located at 5 and (the “Roe 1 Websites”). 6 Aside from their domain names, the Roe 1 Websites are identical to one another and, on 7 information and belief, an Internet user who visits is redirected to 8 . 9 54. By their own terms, the Roe 1 Websites enable Internet users to “Search the 10 Ashley MadisonTM Data PRIVATELY AND SECURELY.” Different price packages are 11 provided for individuals, private investigators, attorneys seeking “leads for identifying 12 class members,” journalists and members of the media, marketing consultants, and 13 marriage counselors. 14 15 55. The following is a screenshot taken on September 1, 2015 of the homepage of the Roe 1 Websites: 16 17 18 19 20 21 22 23 24 25 26 27 28 56. Case No. According to WHOIS records, the Roe 1 websites are hosted by ISP 9 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 11 of 19 1 Defendant GoDaddy. Accordingly, the Stolen Data obtained by Roe 1 and made available 2 on the Roe 1 Websites is located on the servers of GoDaddy. 3 4 5 57. Roe 2 is the owner and operator of the Roe Website located at (the “Roe 2 Website”). 58. The Roe 2 Website purports that “We will protect you from the hackers and 6 people trying to disseminate negative information about you on the world wide web.” At 7 the same time, the Roe 2 Website sells several packages that enable such dissemination, 8 such as a “Spouse Investigation” package to “help you find the information you are 9 looking for about your spouse.” 10 11 59. The following is a screenshot taken on September 3, 2015 of the homepage of the Roe 2 Website: 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 60. According to WHOIS records, the Roe 2 website is also hosted by GoDaddy. Accordingly, the Stolen Data obtained by Roe 2 and made available on the Roe 2 Websites Case No. 10 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 12 of 19 1 2 is located on the servers of GoDaddy. 61. On August 31, 2015, Plaintiffs sent written notice to GoDaddy of the 3 existence of stolen property—namely the Stolen Data—on its servers at these Roe 4 Websites and demanded its removal. As of the filing of this Complaint, GoDaddy has not 5 acted upon Plaintiffs’ demands and the Stolen Data remains accessible through these Roe 6 Websites. 7 62. 8 Stolen Data. 9 10 11 12 GoDaddy, Roe 1, and Roe 2 are each in willful, knowing possession of the Defendants Amazon and Roe 3 63. Roe 3 is the owner and operator of the Roe Website located at (the “Roe 3 Website”). 64. By its own terms, the Roe 3 Website enables Internet users to search the 13 Stolen Data for a fee, stating that “Due to the fact that analyzing these database dumps 14 requires a bit of technical savvy, providing the functionality here on this website allows 15 people to be informed.” The Roe 3 Website further promises that “Turn around time from 16 verified payment to information delivered as discretely as possible is around 24-72 hours.” 17 The fee for conducting a search on the Roe 3 Website is $149.99. 18 19 65. The following is a screenshot taken on September 2, 2015 of the “About” page of the Roe 3 Website, including the payment popup window: 20 21 22 23 24 25 26 27 28 Case No. 11 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 13 of 19 1 66. According to WHOIS records, the Roe 3 Website is hosted by ISP 2 Defendant Amazon. Accordingly, the Stolen Data obtained by Roe 3 and made available 3 on the Roe 3 Website is located on the servers of Amazon. 4 67. On August 31, 2015, Plaintiffs sent written notice to Amazon of the 5 existence of stolen property—namely the Stolen Data—on its servers at the Roe 3 Website 6 and demanded its removal. As of the filing of this Complaint, GoDaddy has not acted 7 upon Plaintiffs’ demands and the Stolen Data remains accessible through the Roe 3 8 Website. 9 10 68. Both Amazon and Roe 3 are in willful, knowing possession of the Stolen Data. 11 FIRST CLAIM FOR RELIEF 12 (Violation of California Penal Code § 496—Receipt of Stolen Property 13 By John Doe 1 Against All Defendants) 14 15 16 17 18 19 20 21 22 69. Plaintiff John Doe 1 incorporates by reference the allegations contained in Paragraphs 1 through 68. 70. The Stolen Data procured and posted by the Hackers is stolen property in that it was obtained in a manner constituting theft. 71. Defendants, and each of them, have obtained or received stolen property— namely, the Stolen Data. 72. Defendants, and each of them, know the Stolen Data to be stolen or obtained in a manner constituting theft. 73. By receiving and possessing the Stolen Data, knowing it to be stolen or 23 obtained in a manner constituting theft, Defendants, and each of them, have violated 24 California Penal Code section 496(a). 25 26 27 28 74. Plaintiff John Doe 1 has been damaged by Defendants’ receipt and use of the Stolen Data in an amount to be proven at trial, but not less than $3,000,000. 75. Pursuant to California Penal Code section 496(c), Plaintiff John Doe 1 is entitled to three times the amount of actual damages sustained by Plaintiff, costs of suit, Case No. 12 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 14 of 19 1 2 3 and reasonable attorneys’ fees for prosecuting this action. 76. There is no adequate remedy at law, and enjoining Defendants’ unlawful possession and publication of the Stolen Data is necessary and in the public interest. 4 SECOND CLAIM FOR RELIEF 5 (Violation of California Business & Professions Code § 17200 6 By John Doe 1 Against All Defendants) 7 8 9 10 11 77. Plaintiff John Doe 1 incorporates by reference the allegations contained in Paragraphs 1 through 68. 78. Plaintiff John Doe 1 asserts this Second Cause of Action for violation of California’s Unfair Competition Law. 79. Defendants, and each of them, have engaged in a pattern of unlawful conduct 12 directed at Plaintiff by receiving, possessing, storing and selling the Stolen Data, which 13 they know to be stolen property that has been transmitted across state and United States 14 boundaries. 15 80. Defendants’ above-described misconduct is an unlawful business practice, as 16 that term is used in Business and Professions code section 17200, because Defendants’ 17 conduct violates California Penal Code section 496(a) and 18 U.S.C. § 2315, as well as 18 other state and federal laws prohibiting hacking and theft. 19 20 21 81. As a result of Defendants’ misconduct, Plaintiff John Doe has been damaged in an amount to be proven at trial, but not less than $3,000,000. 82. Plaintiff John Doe hereby seeks a judicial order of an equitable nature 22 against Defendants including, but not limited to, enjoining Defendants and their agents, 23 employees, representatives, and successors and predecessors in interest from possessing, 24 hosting, publishing, or otherwise making available the Stolen Data. 25 THIRD CLAIM FOR RELIEF 26 (Intentional Infliction of Emotional Distress 27 By All Plaintiffs Against Roes 1–20, Inclusive) 28 83. Case No. Plaintiffs incorporate by reference the allegations contained in Paragraphs 1 13 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 15 of 19 1 2 through 68. 84. By making the Stolen Data available and searchable through the Roe 3 Websites with an eye toward profiting off the implication that Plaintiffs and other Users 4 are adulterers, the Roe Defendants engaged in outrageous misconduct. Indeed, the Roe 5 Defendants’ misconduct was so extreme that it went beyond all possible bounds of 6 decency and a reasonable person would regard the Roe Defendants’ misconduct as 7 intolerable in a civilized community. 8 85. In engaging in their misconduct, the Roe defendants intended to cause 9 Plaintiffs emotional distress and/or acted with reckless disregard of the probability that 10 Plaintiffs would suffer emotional distress, knowing that Plaintiffs would be directly 11 affected by their misconduct. 12 13 14 15 16 17 86. On information and belief, the Roe Defendants engaged in this misconduct willfully and maliciously. 87. As a result of the Roe Defendants’ misconduct, Plaintiffs have suffered severe emotional distress. 88. The Roe Defendants’ misconduct was a substantial factor in causing Plaintiffs’ severe emotional distress. 18 FOURTH CLAIM FOR RELIEF 19 (Negligent Infliction of Emotional Distress 20 By All Plaintiffs Against All Defendants) 21 22 23 89. Plaintiffs incorporate by reference the allegations contained in Paragraphs 1 through 68. 90. As to the Roe Defendants only, Plaintiffs allege this cause of action in the 24 alternative to their Second Claim for Relief for Intentional Infliction of Emotional 25 Distress. 26 27 28 91. Defendants, and each of them, owed Plaintiffs a general duty of care to avoid taking actions that would injure Plaintiffs. 92. Case No. Defendants, and each of them, breached their duty of care to Plaintiffs by 14 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 16 of 19 1 making the Stolen Data available and searchable through the Roe Websites, knowing that 2 it would imply that Plaintiffs and other Users are adulterers. 3 4 5 6 93. As a result of Defendants’ negligence, Plaintiffs have suffered severe emotional distress. 94. Defendants’ negligence was a substantial factor in causing Plaintiffs’ severe emotional distress. 7 FIFTH CLAIM FOR RELIEF 8 (Violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 9 By All Plaintiffs Against All Defendants ) 10 11 12 13 14 95. Plaintiffs incorporate by reference the allegations contained in Paragraphs 1 through 68. 96. Ashley Madison’s server constitutes a “protected computer,” as that term is defined in 18 U.S.C. §1030(e)(2). 97. The Hackers, without authorization, intentionally accessed Ashley 15 Madison’s server and thereby obtained confidential information about Plaintiffs, in 16 violation of 18 U.S.C. §1030(a)(2)(C). 17 98. Thereafter, the Hackers publicly threatened on multiple websites to publish 18 and expose the confidential information about Plaintiffs unless Ashley Madison ceased 19 operation of its website. 20 99. In making these threats, the Hackers, with the intent to extort a thing of 21 value, threatened to impair the confidentiality of the information obtained from a protected 22 computer without authorization, in violation of 18 U.S.C. §1030(a)(7)(B). 23 100. Moreover, in making these threats, the Hackers, with the intent to extort a 24 thing of value, demanded the thing of value in exchange for not causing further damage, in 25 violation of 18 U.S.C. §1030(a)(7)(C). 26 27 28 101. The Hackers provided the unlawfully-obtained confidential information about Plaintiffs to the Roe Defendants. 102. Case No. The Roe Defendants accepted the unlawfully obtained information from the 15 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 17 of 19 1 2 Hackers and published that information on the publicly-viewable Roe Websites. 103. The Roe Defendants engaged in this conduct knowing that the Hackers had 3 obtained the information through the unlawful means described herein and had made the 4 threats described herein. 5 6 7 104. The Roe Defendants thereby conspired to commit and attempted to commit violations of 18 U.S.C. §1030(a)(7)(B) and (C) in violation of 18 U.S.C. §1030(b). 105. The Roe Defendants provided the unlawfully obtained confidential 8 information about Plaintiffs to the ISP Defendants to host on the ISP Defendants’ servers 9 and to display on the publicly-viewable Roe Websites. 10 106. The ISP Defendants accepted the unlawfully obtained information from the 11 Roe Defendants and assisted the Roe Defendants in displaying that information on 12 publicly-viewable Internet websites. 13 107. The ISP Defendants engaged in this conduct knowing that the Hackers had 14 obtained the information through the unlawful means described herein and had made the 15 threats described herein. 16 17 18 19 20 108. The ISP Defendants thereby conspired to commit and attempted to commit violations of 18 U.S.C. §1030(a)(7)(B) and (C) in violation of 18 U.S.C. §1030(b). 109. Defendants’ conduct described herein has caused loss to 1 or more persons during any 1-year period aggregating at least $5,000. 110. As a result of these violations of the Computer Fraud and Abuse Act, 18 21 U.S.C. § 1030, Plaintiffs have suffered damage or loss in an amount to be determined at 22 trial, but not less than $3,000,000. 23 24 25 26 PRAYER FOR RELIEF WHEREFORE, Plaintiffs respectfully request judgment in their favor and against Defendants on each and every claim in this Complaint and for relief as follows: 1. That the Court preliminarily and permanently enjoin Defendants and their 27 agents, employees, representatives, and successors and predecessors in interest from 28 possessing, hosting, publishing, or otherwise making available the Stolen Data. Case No. 16 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 18 of 19 1 2. 2 That the Court award damages and monetary relief as follows: a. Plaintiffs’ actual damages in an amount to be determined at trial, but not less 3 than three million dollars ($3,000,000); 4 b. Treble damages, where applicable; 5 c. Punitive and exemplary damages, where applicable; 6 d. Plaintiffs’ attorneys fees pursuant to Cal. Penal Code § 496(c); and 7 e. Plaintiffs’ costs and applicable interest. 8 9 10 3. Such other relief that the Court determines is just and proper. Respectfully submitted, DATED: September 3, 2015 KRONENBERGER ROSENFELD, LLP 11 By: 12 s/ Karl S. Kronenberger Karl S. Kronenberger 13 Attorneys for Plaintiffs 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case No. 17 COMPLAINT Case 2:15-cv-01768-DJH Document 1 Filed 09/03/15 Page 19 of 19 1 2 REQUEST FOR JURY TRIAL Plaintiffs hereby demand a trial of this action by jury. 3 Respectfully Submitted, 4 DATED: September 3, 2015 KRONENBERGER ROSENFELD, LLP 5 By: 6 s/ Karl S. Kronenberger Karl S. Kronenberger 7 Attorneys for Plaintiffs 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case No. 18 COMPLAINT Case 2:15-cv-01768-DJH Document 1-1 Filed 09/03/15 Page 1 of 2 UNITED STATES DISTRICT COURT DISTRICT OF ARIZONA Civil Cover Sheet This automated JS­44 conforms generally to the manual JS­44 approved by the Judicial Conference of the United States in September 1974. The data is required for the use of the Clerk of Court for the purpose of initiating the civil docket sheet. The information contained herein neither replaces nor supplements the filing and service of pleadings or other papers as required by law. This form is authorized for use only in the District of Arizona. The completed cover sheet must be printed directly to PDF and filed as an attachment to the Complaint or Notice of Removal. GoDaddy.com, LLC ; Amazon John Doe 1 ; John Doe 2 ; John Doe Web Services, Inc. ; John Roe 1 ; Plaintiff(s): Defendant(s): 3 John Roe 2 ; John Roe 3 ; Roes 4 ­ 20 County of Residence: Outside the State of Arizona County of Residence: Maricopa County Where Claim For Relief Arose: Maricopa     Plaintiff's Atty(s): Defendant's Atty(s): Karl Stephen Kronenberger , Attorney Kronenberger Rosenfeld, LLP 150 Post St. San Francisco, California  94108 4159551155     Virginia Anne Sanderson , Attorney Kronenberger Rosenfeld, LLP 150 Post St. San Francisco, California  94108 4159551155     Jeffrey Michael Rosenfeld , Attorney Kronenberger Rosenfeld, LLP 150 Post St. San Francisco, California  94108 4159551155     II. Basis of Jurisdiction:   III. Citizenship of Principal 3. Federal Question (U.S. not a party) Case 2:15-cv-01768-DJH Document 1-1 Filed 09/03/15 Page 2 of 2 Parties (Diversity Cases Only) Plaintiff:­ N/A Defendant:­ N/A   IV. Origin : 1. Original Proceeding   V. Nature of Suit: 890 Other Statutory Actions   VI.Cause of Action: 18 USC § 1030   VII. Requested in Complaint Class Action: No Dollar Demand: 3,000,000 Jury Demand: Yes VIII. This case is not related to another case. Signature:  Karl S. Kronenberger         Date:  09/03/2015 If any of this information is incorrect, please go back to the Civil Cover Sheet Input form using the Back button in your browser and change it. Once correct, save this form as a PDF and include it as an attachment to your case opening documents. Revised: 01/2014