Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 1 of 11 Michael Fuller, OSB No. 09357 Lead Attorney for Plaintiff Olsen Daines PC US Bancorp Tower 111 SW 5th Ave., Suite 3150 Portland, Oregon 97204 michael@underdoglawyer.com Direct 503-201-4570 UNITED STATES DISTRICT COURT DISTRICT OF OREGON PORTLAND DIVISION MEDHI SEIFIAN, individually and on behalf of all others, Plaintiff, v. Case No. 3:17-cv-1879 CLASS ACTION ALLEGATION COMPLAINT Negligence UBER TECHNOLOGIES, INC., Defendant. COMPLAINT – Page 1 of 11 28 U.S.C. § 1332 Demand for Jury Trial Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 2 of 11 1. THE PARTIES Defendant Uber Technologies, Inc. is a billion-dollar global transportation technology company and a Delaware corporation. On November 21, 2017, Uber announced for the first time that a data breach in late 2016 compromised the personal information of 57 million Uber users. Rather than promptly notify the public of its breach as Oregon law required, Uber instead attempted to pay its hackers $100,000 in hopes of keeping the breach under wraps. 2. Plaintiff Medhi Seifian is an individual consumer residing in the Portland, Oregon area who provided his personal information to Uber in order to purchase its transportation services in 2016. He later had his information compromised by Uber, causing him identity theft and credit harm. He could have prevented this harm had Uber notified him that his information was compromised in “the most expeditious manner possible” as required by Oregon law. He is not aware that his personal information has been compromised by any source other than Uber. COMPLAINT – Page 2 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 3 of 11 3. JURISDICTION AND VENUE This Court has jurisdiction under 28 U.S.C. § 1332 because the parties are citizens of different states and the amount in controversy for the Oregon class exceeds $240 million exclusive of penalties. Venue is proper under 28 U.S.C. § 1391 because the bulk of Oregon consumers with personal information stored by Uber live in the Portland area. 4. FACTUAL ALLEGATIONS Plaintiff files this complaint as a class action on behalf of an estimated 500,000 Oregon consumers harmed by Uber’s failure to adequately protect their personal information. This complaint requests Uber provide fair compensation in an amount that will ensure every consumer harmed by its data breach will not be out-of-pocket for the costs of independent third-party credit repair and monitoring services. This complaint’s allegations are based on personal knowledge as to plaintiff’s conduct and made on information and belief as to the acts of others. 5. Throughout 2015 and 2016, Uber collected and stored personal and credit information from plaintiff and thousands of other Oregon consumers who used its transportation services. COMPLAINT – Page 3 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 4 of 11 6. Uber owed a legal duty to plaintiff to use reasonable care to protect his personal information from unauthorized access by third parties. Uber knew that its failure to protect plaintiff’s personal information from unauthorized access would cause serious risks of credit harm and identify theft for years to come. 7. On November 21, 2017, Uber announced for the first time that its data system had been hacked in late 2016 by unauthorized third parties, subjecting plaintiff to credit harm and identify theft and other economic losses. Uber unjustifiably failed to timely notify consumers of its data breach in the most expeditious manner possible, and only chose to notify consumers of its breach over a year later, after the damage to their credit was already done. 8. In an attempt to increase profits, Uber negligently failed to maintain adequate technological safeguards to protect plaintiff’s information from unauthorized access by hackers. Hackers targeted plaintiff’s information for the sole purpose of using the information to commit fraud. Uber knew and should have known that failure to maintain adequate technological safeguards would eventually result in a massive data breach. Uber could have and should have substantially COMPLAINT – Page 4 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 5 of 11 increased the amount of money it spent to protect against cyber-attacks but chose not to. Consumers should not have to bear the expense caused by Uber’s negligent failure to safeguard their personal information from cyber-attackers. 9. As a direct result of Uber’s negligence as alleged in this complaint, plaintiff suffered economic losses including the actual loss of his personal information to hackers seeking to use his information for fraudulent illegal purposes, and economic losses including lost credit opportunities, and suffered economic loss, confusion and wasted time monitoring and responding to fraudulent credit activities. The economic losses Uber caused consumers throughout Oregon could have been mitigated had Uber notified them that their information was compromised in the most expeditious manner possible. Uber’s failure to timely notify Oregon consumers of its data breach also constituted negligence. COMPLAINT – Page 5 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 6 of 11 10. CLASS ALLEGATIONS Plaintiff files this complaint as an Oregon class action lawsuit. The class consists of: 1. Consumers like plaintiff who reside in Oregon and who had personal information collected and stored by Uber prior to October 1, 2016, and who were subject to economic losses including risk of data loss and credit harm and identity theft as a result of Uber’s negligent data breach, and who could have prevented or mitigated their harm had Uber notified them that their information was compromised in the most expeditious manner possible. 11. Excluded from the class are all attorneys for the class, officers and members of Uber, including officers and members of any entity with an ownership interest in Uber, any judge who sits on the case, and all jurors and alternate jurors who sit on the case. 12. The exact number of aggrieved Oregon consumers, estimated at 500,000, can be determined based on Uber’s customer data. COMPLAINT – Page 6 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 7 of 11 13. Every aggrieved consumer suffered economic losses as alleged in this complaint directly and proximately caused by Uber’s negligent failure to adequately protect its database from unauthorized access by third-party hackers and failure to notify consumers that their information was compromised in the most expeditious manner possible. 14. The class is so numerous that joinder is impracticable. Upon information and belief, the Oregon class includes 500,000 consumers based on Oregon’s population and Uber’s initial estimate that 57 million of its users were affected by the breach. 15. Common questions of fact and law predominate over any questions affecting only individual class members. Common questions include whether plaintiff and class members are entitled to equitable relief, whether Uber acted negligently, and whether plaintiff and class members are entitled to recover money damages. 16. Plaintiff’s claims are typical of the claims of the class because each suffered risk of loss or credit harm or identity theft or economic losses caused by Uber’s negligent failure to safeguard their personal information, the injuries suffered by plaintiff and the class members COMPLAINT – Page 7 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 8 of 11 are identical (i.e. the costs to monitor and repair their credit through a third-party service for at least 24 months, the amounts of economic losses caused by identity theft and credit harm and unauthorized use), and plaintiff’s claim for relief is based upon the same legal theories as are the claims of the other class members. Plaintiff will fairly and adequately protect and represent the interests of the class because his claim is typical of the claims of the class, he is represented by nationally known and locally respected attorneys who have experience handling class action litigation and consumer protection cases who are qualified and competent, and who will vigorously prosecute this litigation, and their interests are not antagonistic or in conflict with the interests of the class. 17. A class action is superior to other methods for fair and efficient adjudication of this case because common questions of law and fact predominate over other factors affecting only individual members, as far as plaintiff knows, no class action that purports to include consumers protected by Oregon’s data breach notification law suffering the same injury has been commenced in Oregon, individual class members have little interest in controlling the litigation, due to the high cost of actions, the relatively small amounts of damages, and because plaintiff and his attorneys will vigorously pursue the claims. COMPLAINT – Page 8 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 9 of 11 The forum is desirable because the bulk of consumers in Oregon who suffered injury caused by Uber’s negligence reside in the Portland metropolitan area. A class action will be an efficient method of adjudicating the claims of the class members who have suffered relatively small damages, as a result of the same conduct by Uber. In the aggregate, class members have claims for relief that are significant in scope relative to the expense of litigation. The availability of Uber’s customer data will facilitate proof of class claims, processing class claims, and distributions of any recoveries. COMPLAINT – Page 9 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 10 of 11 18. CLASS CLAIM FOR RELIEF NEGLIGENCE As alleged in this complaint, Uber undertook care of personal information belonging to plaintiff and the putative Oregon class, then breached its legal duty by failing to maintain adequate technological safeguards, falling below the standard of care in the technological industry, directly and proximately causing foreseeable risk of data loss and credit harm and identity theft and other economic losses, in amounts to be decided by the jury. Uber’s failure to comply with laws requiring it to notify consumers of its data breach in the most expeditious manner possible constituted negligence per se. 19. Plaintiff and the Oregon class are entitled to equitable relief in the form of an accounting of exactly how their personal information was accessed without authorization by third parties, restitution, and unless agreed upon by Uber, an order to preserve all documents and information (and electronically stored information) pertaining to this case. 20. Demand for jury trial. COMPLAINT – Page 10 of 11 Case 3:17-cv-01879-AC Document 1 Filed 11/22/17 Page 11 of 11 PRAYER FOR RELIEF Plaintiff seeks relief for himself and the proposed class as follows: A. Unless agreed upon by Uber, an order to preserve all documents and information (and electronically stored information) pertaining to this case, B. An order certifying this matter as a class action, C. Judgment against Uber for fair compensation in an amount to be decided by the jury, and costs, D. And other relief the Court deems necessary. November 22, 2017 RESPECTFULLY FILED, s/ Michael Fuller Michael Fuller, OSB No. 09357 Lead Attorney for Plaintiff Olsen Daines PC US Bancorp Tower 111 SW 5th Ave., Suite 3150 Portland, Oregon 97204 michael@underdoglawyer.com Direct 503-201-4570 COMPLAINT – Page 11 of 11