Sony Pictures Entertainment Suit

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 1 of 45 Page ID #:1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
K h esra w K a rm a nd(C a l. B a rN o. 28 027 2)

M at
t
h ew J. P reusch (C a l. B a rN o. 29 8 144)
kka rm a nd@ kellerroh rba ck.com
m preusch @ kellerroh rba ck.com
K E L L E RRO H RB A C K L .L .P .
1129 St
at
eSt
reet
, Suit
e8
Sa nt
a B a rba ra , C a lifornia 9 3101
Tel.:(8 05) 456 -149 6 / F a x(8 05) 456 -149 7
L ynn L incoln Sa rko, pro h a c v icefort
h com ing
lsa rko@ kellerroh rba ck.com
G ret
ch en F reem a n C a ppio, pro h a c v icefort
h com ing
g ca ppio@ kellerroh rba ck.com
C a riC a m pen La ufenberg , pro h a c v icefort
h com ing
cla ufenberg @ kellerroh rba ck.com
A m yN .L. H a nson, pro h a c v icefort
h com ing
a h a nson@ kellerroh rba k.com
1201Th ird A v e., Suit
e3200
Sea t
t
le, W a sh ing t
on 9 8 101
Tel:(206 ) 6 23-19 00/ F a x:(206 ) 6 23-338 4
15
16
17
18
At
t
orneysforP la int
iffs
UN I TE D STA TE S D I STRI C T C O URT
C E N TRA L D I STRI C T O F C A L I F O RN I A
19
20
21
22
23
24
25
26
27
M ich a elC orona a ndC h rist

ina M a t
h is,
indiv idua llya ndon beh a lf of ot
h ers
sim ila rlysit
ua t
ed,
)
)
)
)
P la int
iffs, )
)
v.
)
)
SonyP ict
uresEnt
ert
a inm ent
, I nc.,
)
)
D efenda nt
. )
C A SE N O .
C L A SS A C TI O N C O M P L A I N T
JURYTRIA L D EM A N D ED
28
C la ssA ct
ion C om pla intP a g e1
1
2
3
4
I.
I N TRO D UC TI O N
P la int
iffsM ich a elC orona a ndC h rist
ina M a t
h is(P la int
iffs), indiv idua lly
a ndon beh a lf of a llot
h erssim ila rlysit
ua t
ed, a lleg est
h efollow ing a g a instSony
P ict
uresEnt
ert
a inm ent
, I nc. (D efenda nt
orSony), ba sedw h erea pplica bleon
persona lknow ledg e, inform a t

ion a ndbelief, a ndt
h einv est
ig a t
ion a ndresea rch of
7
8
counsel.
II.
9
10
11
1.
N A TURE O F TH E A C TI O N
A n epic nig h t
m a re, m uch bet
t
ersuit
edt
o a cinem a t
ic t
h rillert
h an t
o
rea llife, isunfolding in slow m ot

ion forSonyscurrenta nd form erem ployees:
12
13
Th eirm ostsensit
iv eda t
a , including ov er47 ,000Socia lSecurit
ynum bers,
14
em ploym entfilesincluding sa la ries, m edica linform a t

ion, a nda nyt
h ing elset
h at
15
t
h eirem ployerSonyt
ouch ed, h a sbeen lea kedt
ot
h epublic, a nd m a yev en bein t
he
16
17
18
19
h a ndsof crim ina ls.

2.
A tit
score, t
h est
oryof w h a tw entw rong a tSonyboilsdow n t
ot
wo
inexcusa bleproblem s:(1) Sonyfa iledt

o secureit
scom put
ersyst
em s, serv ers, a nd
20
21
da t
a ba ses(N et
w ork), despit
ew ea knessest
h a tith a sknow n a boutforyea rs,
22
beca useSonym a dea businessdecision t

o a cceptt
h eriskof lossesa ssocia t
ed
23
w it
h being h a cked;a nd(2) Sonysubsequent
lyfa iledt
ot
im elyprot
ectconfident
ia l
24
25
inform a t
ion of it
scurrenta nd form erem ployeesfrom la w -brea king h a ckersw h o
26
(a ) foundt
h esesecurit
yw ea knesses, (b) obt
a inedconfident
ia linform a t
ion of
27
28
Sonyscurrenta nd form erem ployeesst

oredon SonysN et
w ork, (c) w a rnedSony
C la ssA ct
1
2
t
h a titw ouldpubliclydissem ina t
et
h isinform a t
ion, a nd(d) repea t
edlyfollow ed
t
h roug h bypubliclydissem ina t
ing port
ionsof t
h einform a t
ion t
h a tt
h eycla im t
o
3
4
5
6
h a v eobt
a ined from SonysN et
w orkt
h roug h m ult
ipledum psof int
erna lda t
a from
SonysN et
w ork.
3.
Th esecurit
yw ea knessesin SonysN et
w orkexposedsensit
iv e
7
8
persona lident
ifying inform a t
ion (P I I ) t
o cybercrim ina ls, w h o obt
a inedt
h a tP I I
(t
h eD a t
a B rea ch ). Th isP I I includes, butisnotlim it
edt
o, currenta nd form er
10
em ployeena m es, h om ea ddresses, t

eleph onenum bers, birt
h da t
es, Socia lSecurit
y
11
12
num bers, em a ila ddresses, sa la riesa ndbonuspla ns, h ea lt

h ca rerecords,
13
perform a nceev a lua t

ions, sca nsof pa ssport
sa ndv isa s, rea sonsfort
erm ina t
ion,
14
det
a ilsof sev era ncepa cka g esa ndot
h ersensit
iv eem ploym enta ndpersona l
15
16
17
18
inform a t
ion.
4.
Sonyow eda leg a ldut

yt
o P la int
iffsa ndt
h eot
h erC la ssm em berst
o
m a int
a in rea sona blea nda dequa t
esecurit
ym ea surest
o secure, prot
ect
, a nd
19
20
sa feg ua rdt
h eirP I I st
oredon it
sN et
w ork. Sonybrea ch edt
h a tdut
ybyoneorm ore
21
of t
h efollow ing a ct
ionsorina ct
ions:fa iling t
o desig n a nd im plem enta ppropria t
e
22
firew a llsa ndcom put

ersyst
em s, fa iling t
o properlya nda dequa t
elyencryptda t
a,
23
24
losing cont
rolof a nd fa iling t
ot
im elyre-g a in cont
rolov erSonyN et
w orks
25
crypt
og ra ph ic keys, a nd im properlyst
oring a ndret
a ining P la int
iffsa ndt
h eot
h er
26
27
C la ssm em bersP I I on it
sina dequa t
elyprot
ect
edN et
w ork.
28
C la ssA ct
1
2
5.
A st
h eresultof Sonysfa iluret
o secureit
sN et
w ork, P la int
iffsa nd
t
h eot
h erC la ssm em bersP I I w a scom prom ised, pla cing t
h em a ta n increa sedrisk
3
4
5
6
of fra uda nd ident

it
yt
h eft
, a ndca using directfina ncia lexpensesa ssocia t
edw it
h
creditm onit
oring , repla cem entof com prom isedcredit
, debita ndba nkca rd
num bers, a ndot
h erm ea suresneededt
o prot
ecta g a instt
h em isuseof t
h eirP I I
7
8
9
10
a rising from t
h eD a t
a B rea ch .
6.
Sonyisno st
ra ng ert
o da t
a brea ch es, m a king it
sv ulnera bilit
yt
ot
h is
la t
esta t
t
a ckpa rt
icula rlysurprising a ndeg reg ious. F orexam ple, in A pril2011,
11
12
SonysP la ySt
at
ion v ideo g a m enet
w orksuffereda m a j
orbrea ch w h en h a ckers
13
st
olem illionsof usera ccount
sfrom t
h eonlineg a m ing serv ice.
14
7.
G iv en t
h erepea t
edda t
a brea ch essufferedbySony, a sw ella srecent
15
16
sig nifica ntda t

a brea ch ev ent
sin t
h eret
a ilercont
ext
, Sonyknew orsh ouldh a v e
17
know n t
h a tsuch a securit
ybrea ch w a slikelya ndt
a ken a dequa t
epreca ut
ionst
o
18
prot
ectit
scurrenta nd form erem ployeesP I I .
19
20
21
22
8.
I n fa ct
, recent
lylea kedem a ilsa nd int
erna la ssessm ent
srev ea lt
h at
Sonysow n inform a t
ion t
ech nolog y(IT) depa rt
m enta nd, sepa ra t
ely, it
sg enera l
counselbeliev edt
h a tit
st
ech nolog ica lsecurit
ya ndem a ilret
ent
ion policiesra n t
he
23
24
riskof m a king t
oo m uch da t
a v ulnera blet
o at
t
a ck. I f onlySonyh a d h eededit
sow n
25
a dv icein t
im e.
26
27
28
C la ssA ct
1
2
3
4
I I I . JURI SD I C TI O N
9.
Th isC ourth a sdiv ersit

yj
urisdict
ion ov ert
h isa ct
ion pursua ntt
ot
he
C la ssA ct
ion F a irnessA ct(C A F A ), 28 U.S.C . 1332(d)(2). P la int
iff C orona a nd
D efenda nta recit

izensof differentst
at
es. Th ea m ountin cont
rov ersyexceeds$5
m illion, a ndt
h erea rem oret
h a n 100put
at
iv ecla ssm em bers.
7
8
9
10
10.
Th isC ourth a spersona lj

urisdict
ion ov ert
h eD efenda ntbeca use
D efenda ntislicensedt
o do businessin C a lifornia orot
h erw iseconduct
sbusiness
in C a lifornia .
11
12
11.
Venueisproperin t
h isC ourtpursua ntt
o 28 U.S.C . 139 1(b) beca use
13
unla w fulpra ct
icesa rea lleg edt
o h a v ebeen com m it
t
ed in t
h isfedera lj
udicia l
14
dist
ricta ndD efenda ntreg ula rlyconduct
sbusinessin t
h isdist
rict
.
15
I V.
16
17
18
19
12.
P A RTI E S
P la int
iff M ich a elC orona iscurrent
lya residentof t
h eSt
at
eof
Virg inia . P la int

iff C orona isa form erem ployeeof SonyP ict
uresEnt
ert
a inm ent
.
Sonyem ployedC orona from 2004t
o 2007 in C ulv erC it
y, C a lifornia . P la int
iff
20
21
C orona sP I I w a scom prom isedw h en h a ckersa ccessedSonysN et

w ork, including
22
butnotlim it
edt
o h isfullna m e, Socia lSecurit
yN um ber, birt
h da t
e, form era ddress,
23
sa la ryh ist
ory, a ndrea son forresig ning . I n a ddit
ion, t
h eP I I of P la int
iff C orona s
24
25
w ifea ndda ug h t
erw a sa lso com prom ised in t
h eD a t
a B rea ch . To da t
e, P la int
iff
26
C orona h a sincurredcost
s, including spending ov er$7 00fora yea rof ident
it
yt
h eft
27
28
prot
ect
ion from L ifeL ockforh im a ndh isfa m ily. H eh a sexpended40-50h ours
C la ssA ct
1
2
at
t
em pt
ing t
o sa feg ua rdh im self a nd h isfa m ilym em bersfrom ident
it
yt
h eftor
ot
h erh a rm sca usedbyt
h erelea seof t
h eirP I I a sa resultof t
h eD a t
a B rea ch . G oing
3
4
5
6
forw a rd, P la int

iff C orona a nt
icipa t
esspending considera blet
im eea ch da yin a n
effortt
o cont
a in t
h eim pa ctof SonysD a t
a B rea ch on h im self a nd h isfa m ily
m em bers.
7
8
9
10
13.
P la int
iff C h rist
ina M a t
h isisa residentof t
h eSt
at
eof C a lifornia w h o
ist
em pora rilyw orking on a n a ssig nm entoutof st
at
e. P la int
iff M a t
h isisa form er
em ployeeof SonyP ict
uresC onsum erP roduct
s, a subsidia ryof Sony. Sony
11
12
em ployedP la int
iff M a t
h isfrom 2000t
o 2002in C ulv erC it
y, C a lifornia . D espit
e
13
t
h efa ctt
h a tsh eh a snotw orked forSonyin 12yea rs, P la int
iff M a t
h issP I I w a s
14
com prom isedw h en h a ckersa ccessedSonysN et

w ork, including butnotlim it
edt
o
15
16
h erSocia lSecurit
yN um bera nd form era ddress. To da t
e, P la int
iff M a t
h ish a s
17
h ea rdnot
h ing from Sonya boutt
h ebrea ch ot
h ert
h a n a form let
t
erresponset
o h er
18
em a ilinquirya boutt
h eD a t
a B rea ch . P la int
iff M a t
h ish a sincurredcost
s, including
19
20
spending ov er$300fora yea rof ident

it
yt
h eftprot
ect
ion from L ifeL ockfor
21
h erself. Sh eh a sa lrea dyexpended10h oursa t

t
em pt
ing t
o sa feg ua rd h erself from
22
ident
it
yt
h efta ndot
h erelea seof h erP I I a sa resultof t
he
23
24
D at
a B rea ch . G oing forw a rd, P la int
iff M a t
h isa nt
icipa t
esspending considera ble
25
t
im eea ch da yin a n effortt
o cont
a in t
h eim pa ctof SonysD a t
a B rea ch on h erself.
26
27
28
C la ssA ct
1
2
14.
D efenda ntSonyP ict

uresEnt
ert
a inm ent
, I nc. isa C orpora t
ion
org a nized undert

h ela w sof D ela w a re, w it
h principa lofficesloca t
ed in C ulv er
3
4
C it
y, C ount
yof L osA ng eles, C a lifornia .
5
6
V.
F A C TUA L A L L E G A TI O N S
SonysD a t
a B rea ch E x
posedt
h eP I I of I t
sC urrenta ndF orm er
E m ployees
15.
A.
O n inform a t
ion a ndbelief, on N ov em ber24, 2014, a h a ckerg roup
t
h a tca llst
h em selv esG ua rdia nsof P ea ce(G O P ) t
ookov erSonysN et
w ork,
10
11
displa yedt
h eirow n m essa g esa ndskelet
on im a g e, seizedcont
rolof prom ot
iona l
12
Tw it
t
era ccount
sforSonym ov ies, a ndw a rnedSonyt
h a tith a dobt
a inedsecret
s
13
a ndt
h rea t
enedt
o lea kt
h em t
ot
h eW eb:
14
15
16
17
18
19
20
21
22
16 .
In t
h eda ysfollow ing t
h eD a t
a B rea ch , P I I of currenta nd form erSony
23
24
em ployees, a sw ella sa ct
orsa nd film m a kersw erepubliclypublish edon t
he
25
int
ernet
.
26
27
28
17 .
Specifica lly, on D ecem ber2, 2014, da t

a cont
a ining t
h eP I I of
t
h ousa ndsof Sonyem ployees, including , forexam ple, t
h eirna m es, socia lsecurit
y
C la ssA ct
1
2
num bers, birt

h da t
es, h om ea ddresses, j
ob t
it
les, perform a nceev a lua t
ions, sca nsof
pa ssport
sa nd v isa s, sa la riesa ndbonuspla ns, rea sonsfort
erm ina t
ion a nddet
a ilsof
3
4
5
6
sev era ncepa cka g es, w a spost

edonline.
18 .
Securit
yresea rch erB ria n K rebs, w h o w a st
h efirstt
o uncov erot
h er
recenth ig h -profileda t
a brea ch esa tcom pa niessuch a sTa rg etC orpora t
ion a nd
7
8
H om eD epotInc., report
ed in a D ecem ber2, 2014blog postt
h a tsev era lof h is
sourcesh a dconfirm edt

h a tt
h eh a ckersof SonysN et
w orkh a dst
olen m oret
h a n 25
10
g ig a byt
esof sensit
iv eda t
a , including Socia lSecurit
ynum bersa nd m edica la nd
11
12
13
14
sa la ryinform a t
ion, on t
ensof t
h ousa ndsof Sonyem ployees.
19 .
K rebsreport
edt
h a th eh a dpersona llyseen sev era lfilescont
a ining
persona linform a t
ion on Sonyem ployeesbeing t
ra dedon onlinet
orrentnet
w orks.
15
16
Th efilesincludea M icrosoftExceldocum entt

h a tcont
a inst
h ena m e, loca t
ion,
17
em ployeeI D , net
w orkuserna m e, ba sesa la rya ndda t
eof birt
h form oret
h a n 6 ,8 00
18
people;a st
at
usreportfrom A pril2014list
ing t
h ena m es, da t
esof birt
h , Socia l
19
20
Securit
ynum bersa ndh ea lt
h sa v ing sa ccountda t
a on m oret
h a n 7 00Sony
21
em ployees;a nda filet

h a ta ppea rst
o bet
h eproductof a n int
erna la uditfrom
22
P ricew a t
erh ouseC oopers, m a deup of screen sh ot
sof dozensof em ployeesfedera l
23
24
t
a xrecordsa ndot
h ercom pensa t
ion da t
a . K rebsfoundt
h a ta com preh ensiv e
25
sea rch on L inkedI n fordozensof na m esin t

h e[M icrosoftExcel]listindica t
e[d]
26
27
t
h a tv irt
ua llya llcorrespond[ed]t
o currentorform erSonyem ployees.
28
C la ssA ct
1
2
20.
O nt
h eev ening of D ecem ber2, 2014, sourcesreport
edt
h a tSonyC EO
M ich a elL ynt

on a ndco-ch a irm a n A m yP a sca la tSonysenta n int
erna lm em o t
o
3
4
5
6
6 ,500currentem ployeest
h a tconfirm edt
h a ta la rg ea m ountof confident
ia lSony
P ict
uresEnt
ert
a inm entda t
a h a sbeen st
olen byt
h ecybera t
t
a ckers, including
personnelinform a t
ion,st
at
edt
h a tt
h epriv a cya ndsecurit
yof ourem ployeesa re
7
8
of rea lconcern t
o us,w a rnedt
h a tw ea renotyetsureof t
h efullscopeof
inform a t
ion t
h a tt
h ea t
t
a ckersh a v eorm ig h trelea sea ndunfort
una t
elyh a v et
o
10
a skyou t
o a ssum et
h a tinform a t
ion a boutyou in t
h epossession of t
h ecom pa ny
11
12
m ig h tbein t
h eirpossession,a ndprom ised em ployeest
h a tt
h eyw ouldreceiv ea n
13
em a ilon D ecem ber3, 2014t

h a tout
linedst
epst
o sig n up forident
it
yprot
ect
ion
14
serv ices.
15
16
17
18
21.
O n D ecem ber5, 2014, sourcesreport

edt
h a tSonyscurrentD a t
a
B rea ch h a d lea kedev en m oreP I I t

h a n h a d been report
edprev iously, consist
ing of
47 ,426 uniqueSocia lSecurit
ynum bersa nd na m es, da t
esof birt
h , h om ea ddresses,
19
20
em a ila ddresses, sa la ryinform a t

ion, including Socia lSecurit
ynum bersof m ore
21
t
h a n 15,200currentorform erSonyem ployees. Th eSocia lSecurit
ynum bersw ere
22
copied m oret
h a n 1.1m illion t
im est
h roug h outt
h e6 01filesst
olen byh a ckers
23
24
a ccording t
o I dent
it
yF inderL LC , w h osecom pa nya na lyzedt
h ebrea ch edda t
a . Th e
25
persona linform a t
ion w a sfound in m oret
h a n 500sprea dsh eet
s, 7 5P D F sa nd
26
27
28
sev era lW orddocum ent

s, noneof w h ich w ereprot
ect
edbypa ssw ords. I dent
it
y
F inderL L C C EO Todd F einm a n expla ined t
h a tpersona linform a t
ion such a s
C la ssA ct
1
2
Socia lSecurit
ynum berssh ouldbest
ored in onepla cew it
h pa ssw ordprot
ect
ion
a nd[l]ea v ing t
h esefilesopen isnotm a king t
h eh a ckersj
ob difficult
.Th efiles
3
4
5
6
h a v esincebeen publiclypost
edonlineon m ult
iplefilesh a ring w ebsit
es.
22.
A lso on D ecem ber5, 2014, h a ckersw erereport

edt
o h a v esenta n
em a ilt
o em ployeest
h a tt
h rea t
enedt
h eirfa m iliesif t
h eydid notsupportG ua rdia ns
7
8
of P ea ceg oa ls, st
at
ing :P lea sesig n yourna m et
o obj
ectt
h efa lse[sic]of t
he
com pa nya tt
h eem a ila ddressbelow if you dontw a ntt
o sufferda m a g e. I f you
10
dont
, notonlyyou butyourfa m ilyw illbein da ng er.
11
12
13
14
23.
A sof D ecem ber8 , 2014, h a ckersh a drelea seda round140g ig a byt

es
of a ca ch eof int
erna lSonyfilesa nd film st
h eycla im t
ot
a lsa tlea st100t
era byt
es
a pproxim a t
ely10t
im est
h ea m ountof inform a t
ion st
ored in t
h eL ibra ryof
15
16
C ong ress.
17
24.
18
M oreov er, B usinessI nsiderreport

edt
h a tSonyC EO M ich a elL ynt
on
senta secondcom pa ny-w idem em o t

o currentem ployeeson D ecem ber8 , 2014
19
20
a ssuring t
h em t
h a tSonyw a sdoing ev eryt
h ing itcouldt
o prot
ectem ployeesa ft
era
21
seriesof cyber-a t
t
a ckst
h a trev ea ledt
h eirpersona linform a t
ion, including Socia l
22
Securit
ynum bersa nda ddresses, st
at
ing t
h a tt
h eF edera lB urea u of I nv est
ig a t
ion
23
24
h a sdedica t
edt
h eirseniorst
a ff t
ot
h isg loba linv est
ig a t
iona ndt
h a trecog nized
25
expert
sa rew orking on t
h ism a t
t
era nd looking outforoursecurit
y.
26
27
28
25.
W h ilem oret
h a n 117 ,000cyber-a t
t
a cksh itbusinessesea ch da y, t
he
LosA ng elesTim esreport

edt
h a tP h illip L ieberm a n, t
h epresidentof securit
y
C la ssA ct
1
2
m a na g em entprog ra m m a kerL ieberm a n Soft

w a re, sa id few of t
h osea t
t
a cksa reon
t
h esca leof t
h eblow dea ltt
o Sony. It
sobv iousfrom t
h escopeof w h a t
sbeen
3
4
5
6
donet
h a tt
h eint
rudersow nedt
h eent
ireenv ironm ent. . . Sonylostcont
rolof t
h eir
env ironm ent
,L ieberm a n sa id.
26 .
N o definit
iv eev idencea boutt
h eperpet
ra t
orsh a sbeen disclosed, but
7
8
sev era lsecurit

yfirm sh a v efocusedon t
h efa ctt
h a tda t
a relea sedbyt
h ea t
t
a ckers
includea num berof Sonyspriv a t

ecrypt
og ra ph ic keys. K ev in B ocek, v ice
10
presidenta tVena fi, expla inedt

o B usinessw eekt
h a tlosing cont
rolof t
h ese
11
12
crypt
og ra ph ic keyst
ot
h eking dom isa big dea l.O ncea n a t
t
a ckerh a sa ccesst
o
13
t
h ecrypt
og ra ph ic keys, a n a t
t
a ckerca n g etont
o encrypt
edserv ersw it
h out
14
t
rig g ering int
rusion det
ect
ion syst
em sbeca uset
h esesyst
em sa ssum et
h a tencrypt
ed
15
16
17
18
da t
a issa fe.
27 .
B usinessw eekreport
edt
h a ta n a t
t
a ckusing crypt
og ra ph ic keys
indica t
est
h a tt
h eh a ckerlikelyspenta sig nifica nta m ountof t
im ew it
h in t
he
19
20
com pa nysnet
w ork. Th isisbeca usecom pa niesa reoft
en slow t
o ch a ng et
h eir
21
crypt
og ra ph ic keys, ev en w h en t
h eyknow t
h eya rev ulnera ble.
22
28 .
Som ereport
sh a v esug g est
edt
h a tt
h ea t
t
a ckersof SonysN et
w ork
23
24
m a yh a v einit
ia t
edt
h eira t
t
a cka sea rlya sa yea rpriort
ot
h epublic disclosures
25
reg a rding t
h eD a t
a B rea ch in N ov em ber, 2014.
26
27
28
29 .
Th us, a nyonew it
h a ccesst
ot
h ecrypt
og ra ph ic keysw ould h a v e
a ccesst
o SonysN et
w orkunt
ilt
h ecom pa nym a na g edt
o ch a ng et
h em a process
C la ssA ct
1
2
t
h a toft
en becom esdifficultw h en com pa niesloset
ra ckof a llt
h ew a yst
h at
crypt
og ra ph ic keysa reused. F orexam ple, K a sperskyLa b point
soutt
h a ta sa m ple
3
4
5
6
of t
h em a lw a ret
h a th a ckersinst
a lledon t
h eSonyN et
w orkduring t
h eD a t
a B rea ch
sh ow edt
ra cesof being sig nedbya v a liddig it
a lcert
ifica t
efrom Sony. A ccording
t
ot
h ecybersecurit
yfirm :
7
8
Th est
olen Sonycert
ifica t
es(w h ich w erea lso lea kedbyt
h ea t
t
a ckers)
ca n beusedt
o sig n ot
h erm a licioussa m ples. I n t
urn, t
h eseca n be
10
furt
h erused in ot
h era t
t
a cks. . . . B eca uset
h eSonydig it
a lcert
ifica t
es
11
12
a ret
rust
edbysecurit
ysolut
ions, t
h ism a kesa t
t
a cksm oreeffect
iv e. . .
13
W ev eseen a t
t
a ckerslev era g et
rust
edcert
ifica t
esin t
h epa st
, a sa
14
m ea nsof bypa ssing w h it

elist
ing soft
w a rea nddefa ult
-denypolicies.
15
16
17
18
30.
Th us, if Sonyscrypt
og ra ph ic keysw erea m ong t
h eda t
a relea sed,
Sonysa bilit
yt
o prev entfurt
h eruna ut
h orizeda ccesst
o it
sN et
w orkw ouldbe
sev erelycom prom iseda nda ddit
iona l, if notong oing , brea ch esof it
sN et
w ork
19
20
w ouldbelikely.
21
31.
22
I nform a t
ion t
ech nolog yonlinepublica t
ion A RS Tech nica not
a bly
report
edt
h a tt
h eh a ckersw erea blet
o collectsig nifica ntint
ellig enceon t
h eSony
23
24
N et
w orkfrom Sonysow n inform a t
ion t
ech nolog ydepa rt
m ent
. A m ong stt
h efiles
25
publiclydisclosedt
h esecondw eekof D ecem ber2014w a sa corpora t
ecert
ifica t
e
26
27
28
a ut
h orit
yt
h a tw a sint
endedt
o beusedin crea t
ing serv ercert
ifica t
esfor
D efenda nt
sI nform a t
ion Syst
em sServ ice(I SS). Th iscorpora t
ecert
ifica t
e
C la ssA ct
1
2
a ut
h orit
ym a yh a v ebeen usedt
o crea t
et
h eserv ercert
ifica t
et
h a tw a susedt
o sig n a
la t
erv ersion of t
h em a lw a ret
h a tt
ookSonysN et
w orkofflinein N ov em ber2014.
D espit
eSonysL ong st
a nding K now ledg eof I t
sN et
w orksSecurit
y
W ea kness, I tM a dea B usinessD ecision t
o A cceptTh isRiskD espit
e
P rev iousD a t
a B rea ch es
32.
B .
Sonyh a sbeen a long st

a nding a nd frequentt
a rg etforh a ckers, butit
7
8
9
10
a ppa rent
lym a dea businessdecision t
o a cceptt
h eriskof lossesa ssocia t
edw it
h
being h a cked.
33.
P utsim ply, Sonyknew a boutt

h erisksitt
ookw it
h it
spa sta ndcurrent
11
12
13
14
em ployeesda t
a . Sonyg a m bled, a nd it
sem ployeespa sta ndcurrentlost
.
34.
F orexam ple, a sreport

edon t
h eG izm odo w ebsit
e, j
ustt
w o m ont
hs
beforet
h eD a t
a B rea ch beca m epublic, Sonyrelea seda sca t
h ing int
erna lI T
15
16
a ssessm ent
.In t
h ereportSonysI T personnelfoundba sic securit
yprot
ocolw ent
17
unh eededa ndw h a tlit

t
leI T securit
yitdidh a v ew a spla g uedw it
h unm onit
ored
18
dev ices, m iscom m unica t

ion, a nda la ckof a ccount
a bilit
y.
19
20
21
22
35.
F urt
h erm ore, t
o Sonysch a g rin, em a ilsfrom t
h eD efenda nt
sg enera l
counsel, Lea h W eil, w erereport

edlylea ked a sw ell. A m ong ot
h ert
opics, t
he
em a ilsv oicedconcernsa boutt
h ev olum eof da t
a a v a ila bleon em a ils. F orexam ple,
23
24
25
26
onereport
edlyst
at
ed, W h ileundoubt
edlyt
h erew illbeem a ilst
h a tneedt
o be
ret
a inedorst
oredelect
ronica llyin a syst
em ot
h ert
h a n em a il, m a nyca n bedelet
ed,
a ndI a m inform edbyourI T collea g uest
h a tourcurrentuseof t
h eem a ilsyst
em for
27
28
v irt
ua llyev eryt
h ing isnott
h ebestw a yt
o do t
h is.
C la ssA ct
1
2
36 .
A ccording t
o a n a na lysisbysecurit
yfirm P a cketN inj
a s, m oret
h an
9 00dom a inst
h a ta ppea rt
o berela t
edt
ot
h ecom pa nyh a v ebeen com prom isedov er
3
4
5
6
t
h ela stt
w elv eyea rs.
37 .
Sonyh a dt
h ea bilit
ya ndknow -h ow t
o im plem enta nd m a int
a in
sufficientonlinesecurit
yconsist
entw it
h indust
ryst
a nda rdsa sa lea derin t
he
7
8
9
10
com put
ert
ech nolog yindust
ry.
38 .
N ev ert
h eless, a sreport
edbyt
h et
ech nolog ya ndbusinessw ebsit
e
C I O , Sonysexecut
iv edirect
orof inform a t
ion securit
y, Ja son Spa lt
ro, m a dea
11
12
businessdecision in N ov em ber2005nott
o ensuret
h esecurit
yof SonysN et
w ork.
13
A tt
h a tt
im e, a n a udit
orw h o h a dj
ustcom plet
eda rev iew of Spa lt
rossecurit
y
14
pra ct
icest
oldh im t
h a tSonyh a dsev era lsecurit
yw ea knesses, including
15
16
17
18
insufficient
lyst
rong a ccesscont
rols, w h ich isa keySa rba nes-O xleyrequirem ent
.
39 .
Spa lt
ro subsequent
lysa id in a 2007 int
erv iew w it
h CIO t
h a th ew a s
notw illing t
o putup a lotof m oneyt
o defendSonyssensit
iv einform a t
ion, st
at
ing :
19
20
21
22
It
sa v a lidbusinessdecision t
o a cceptt
h erisk.
40.
C I O report
edon A pril6 , 2007 , t
h a tC ent
erforD em ocra cya nd
Tech nolog ypriv a cyexpert

, A riSch w a rt
z, believ edSpa lt
rosrea soning t
o be
23
24
sh ort
sig h t
edbeca uset
h ecostof not
ifica t
ion isonlya sm a llport
ion of t
he
25
pot
ent
ia lcostof a da t
a brea ch .
26
27
28
41.
I n M a y2009 , report
ssurfa cedt
h a tuna ut
h orizedcopiesof Sonys
cust
om erscreditca rdsw ereem a iledt
o a n out
sidea ccount
.
C la ssA ct
1
2
42.
I n Ja nua ry2011, h a ckersm a det

h eP la ySt
at
ion g a m eM odern W a rfa re
2unpla ya blet
h roug h t
h eP la ySt
at
ion N et
w ork.
3
4
5
6
C.
SonysM a jorD a t
a B rea ch in A pril2011
43.
I n A pril2011, SonysP la ySt

at
ion v ideo g a m enet
w orksuffereda
m aj
orbrea ch in A pril2011in w h ich h a ckersst
olem illionsof usera ccount
sfrom
7
8
9
10
t
h eonlineg a m ing serv ice.
44.
Tw o w eekspriort
ot
h eA pril2011da t
a brea ch , Sonyw a s
a nonym ouslyw a rnedof t

h eim pending brea ch :
11
12
You h a v ea busedt
h ej
udicia lsyst
em in a n a t
t
em ptt
o censor
13
inform a t
ion on h ow yourproduct
sw ork. . . N ow you w illexperience
14
t
h ew ra t
h of A nonym ous. You sa w a h ornet
snesta ndst
uckyour
15
16
[explet
iv e]in it
. You m ustfa cet
h econsequencesof youra ct
ions,
17
A nonym ousst
yle. . . Expectus(em ph a sisa dded).
18
45.
D espit
et
h isdirectt
h rea tt
o im m inent
lybrea ch t
h eSonyN et
w ork,
19
20
21
22
Sonyfa iledt
o im plem enta dequa t
esa feg ua rdst
o prot
ectit
.
46 .
A sreport
edbyEng a dg et
.com , on M a y1, 2011, SonyC orpora t
ion
C h ief I nform a t
ion O fficer, Sh inj
iH a sej
im a , a dm it
t
edduring a pressconference
23
24
25
t
h a tSonysN et
w orkw a snotsecurea tt
h et
im eof t
h eA pril2011da t
a brea ch a nd
st
at
edt
h a tt
h ea t
t
a ckw a sa know n v ulnera bilit
y.
26
27
28
C la ssA ct
1
2
47 .
I n a ddit
ion, on June8 , 2011, SonysD eput
yP resident
, report
edly
a dm it
t
edSonysN et
w orkfa iledt
o m eetm inim um securit
yst
a nda rdsa tt
h et
im eof
3
4
5
6
t
h eA pril2011da t
a brea ch .
48 .
A sreport
edbyt
h eG ua rdia n, SonysK a zH ira ist
at
edt
h a tSonyh a s
doneev eryt
h ing t
o bring ourpra ct
icesa tlea stin linew it
h indust
ryst
a nda rdsor
7
8
bet
t
erw h en a skedw h et
h erSonyh a drev isedit
ssecurit
ysyst
em sfollow ing t
he
A pril2011da t
a brea ch .
10
49 .
I n responset
ot
h eA pril2011da t
a brea ch , Sonyrepresent
edt
h a tit
11
12
im plem ent
edba sic m ea surest
o defenda g a instnew a t
t
a cks, including t
h efollow ing
13
syst
em st
h a tsh ould h a v ebeen in pla cepriort
o A pril2011:a ut
om a t
edsoft
w a re
14
m onit
oring ;enh a ncedda t
a encrypt
ion;enh a nceda bilit
yt
o det
ectint
rusionst
ot
he
15
16
N et
w ork, such a sa n ea rly-w a rning syst
em t
o det
ectunusua la ct
iv it
ypa t
t
erns;a nd
17
a ddit
iona lfirew a lls. A ddit
iona lly, Sonyh ireda C h ief I nform a t
ion Securit
yO fficer.
18
50.
N ev ert
h eless, Joh n B um g a rner, C h ief Tech nolog yO fficerof t
he
19
20
independent
, non-profitresea rch inst
it
ut
eUnit
edSt
at
esC yber-C onsequencesUnit
,
21
foundt
h a ta sof M a y10, 2011, una ut
h orizeduserscouldst
illa ccessint
erna lSony
22
resources, including securit

y-m a na g em entt
ools. B um g a rnersresea rch a lso
23
24
sh ow edt
h a tt
h eproblem sw it
h Sonyssyst
em sw erem orew idesprea dt
h a n Sony
25
h a da cknow ledg eda tt

h a tt
im e.
26
27
28
51.
A ft
ert
h eA pril2011brea ch , Sonyoffered freeident
it
yt
h eft
prot
ect
ion, a m ong ot
h erbenefit
s, t
o P la ySt
at
ion users.
C la ssA ct
1
2
52.
B usinessw eekreport
edt
h a tt
h eca useof t
h eA pril2011brea ch w a s
t
h a tSonylostcont
rolof it
scrypt
og ra ph ic keys w h ich isa lso t
h efocusof sev era l
3
4
5
6
securit
yfirm sinv est
ig a t
ing t
h epresentD a t
a B rea ch of SonysN et
w ork a nd
not
edt
h a tif Sonyh a sa g a in lostcont
rolof it
scrypt
og ra ph ic keys, itra isest
he
quest
ion w h yith a d notprot
ect
edt
h em m orecloselyt
h reeyea rsla t
er.
7
53.
8
9
10
C la ssa ct
ion lit
ig a t
ion on beh a lf of g a m ersfollow edt
h eA pril2011
brea ch a ndSonya g reedt

o set
t
let
h osecla im sin June2014in exch a ng efor$15
m illion in g a m es, onlinecurrencya nd ident
it
yt
h eftreim bursem ent
.
11
12
13
14
D.
SonysF a iluret
o P rev entD a t
a B rea ch esC ont
inuedA ft
erA pril2011
54.
C onsist
entw it
h M r. B um g a rnersresea rch on t
h eext
entof problem s
w it
h t
h esecurit
yof SonysN et
w ork, Sonysba dinform a t
ion t
ech nolog ysecurit
y
15
16
17
18
h a bit
scont
inued.
55.
SonysN et
w orkw a sa g a in brea ch ed in June2011, com prom ising ov er
1m illion userspersona linform a t

ion, including na m es, birt
h da t
es, em a il
19
20
21
22
a ddresses, passw ords, h om ea ddresses, a ndph onenum bers.

56 .
Th eh a ckerscla im edt
h a titw a snotdifficultt
o brea ch Sonys
N et
w orkin June2011a ndt
h a tt
h est
olen da t
a w a sunencrypt
ed.
23
24
25
26
57 .
N um erousexpert
sin t
h efielda g reea nda t
t
ribut
et
h eJune2011da t
a
brea ch t
o a n unsoph ist
ica t
ed m et
h odof h a cking t
h a tw ould noth a v ebeen
successfulif Sonyh a dev en t
h em ostba sic securit
ym ea suresin pla ce.
27
28
C la ssA ct
1
2
58 .
F orexam ple, P C W orldt

ech nolog yj
ourna listTonyB ra dlyobserv ed
t
h a tSonyseem st
o ig norecom plia ncerequirem ent
sa ndba sic securit
ybest
3
4
5
6
pra ct
ices, so itisba sica llybeg g ing t
o bea t
t
a cked.B ra dleyfurt
h era dv isedt
h at
com pa niessh ould follow securit
ybestpra ct
icesa ndda t
a securit
ycom plia nce
requirem ent
s a nd in sh ort
[d]ontbea Sony.
7
8
9
10
59 .
L ikew ise, F redTouch et

t
eof A ppRiv erst
at
ed:[t
]h ereisno doubtt
h at
Sonyneedst
o spendsom em a j
oreffortin t
ig h t
ening up it
snet
w orksecurit
y. Th is
la t
esth a cka g a instt
h em w a sa seriesof sim pleSQ L I nj
ect
ion a t
t
a cksa g a instit
s
11
12
13
14
w eb serv ers. Th issim plysh ould noth a v eh a ppened.

6 0.
I n F ebrua ry2014, Sonysexecut

iv edirect
orof inform a t
ion securit
y
Ja son Spa lt
ro not
ifiedSonyC h ief F ina ncia lO fficerD a v id H endlert
h a ta
15
16
sig nifica nta m ountof pa ym entinform a t

ion h a dbeen st
olen off of SonysN et
w ork
17
rela t
ing t
o 7 59 indiv idua lsa ssocia t
edw it
h t
h ea t
ersin B ra zil. Th est
olen pa ym ent
18
inform a t
ion h a dbeen st
oreda s.t
xtt
extfilesa ndSonyh a dbeen st
oring t
h ist
ypeof
19
20
21
22
inform a t
ion t
h isw a ysince2008 .
6 1.
Spa lt
o brush edoff t
h esig nifica nceof t
h eF ebrua ry2014a t
t
a ckfrom
t
h est
a ndpointof leg a lexposurea ndrecom m endeda g a instprov iding a ny
23
24
25
26
27
not
ifica t
ion of t
h isbrea ch t
o indiv idua ls.
6 2.
I n cont
ra st
, Sonyt
ookv eryseriouslyt
h et
h rea tof denia lof serv ice
at
t
a ckson it
sbusiness, pa rt
icula rlya ft
erw h a th a d h a ppenedt
ot
h eSony
28
C la ssA ct
1
2
P la yst
at
ion N et
w orka ndissuedw a rning sof likelyfut
urea t
t
a cksin M a rch 2014
a nd A pril2014.
3
6 3.
4
5
6
I n A ug ust2014, a m ont
h a ft
erSonyset
t
led t
h ecla ssa ct
ion lit
ig a t
ion
broug h tbyP la ySt

at
ion g a m ersa sa resultof t
h eA pril2011brea ch a ndj
ust
m ont
h sbeforet
h eG O P h a ckerst
ookresponsibilit
yfort
h ecurrentD a t
a B rea ch
7
8
h a ckersa g a in t
ookdow n t
h eP la ySt
at
ion N et
w orka nda lso t
ookdow n Sonys
Ent
ert
a inm entN et
w orkbyov erw h elm ing SonysN et
w orkw it
h denia lof serv ice
10
at
t
a cks.
11
6 4.
12
13
14
A lso in A ug ust2014, inform a t

ion t
ech nolog yonlinepublica t
ion A RS
Tech nica report

edSonysC h ief I nform a t
ion Securit
yO fficerP h ilReit
ing er
a nnouncedh ew ouldbest
epping dow n, not
ing t
h a tt
h erew erea num berof a rch a ic
15
16
syst
em st
h a th a dbeen in pla cea tSonyfora g esw it
h plent
yof pot
ent
ia la t
t
a ck
17
point
s.
18
6 5.
At
t
a ckson SonysN et
w orkh a v econt
inued t
o bereport
eda srecent
ly
19
20
a sD ecem ber7 , 2014.
21
E.
22
Th eF edera lG ov ernm entisC urrent

lyI nv est
ig a t
ing SonysL a t
estD a t
a
B rea ch
23
66.
24
O n D ecem ber1, 2014, t

h eF edera lB urea u of I nv est
ig a t
ion (F B I )
la unch eda n inv est

ig a t
ion int
o Sonyscyber-int
rusion.
25
26
27
28
C la ssA ct
1
2
67.
Th eF B I confirm edon D ecem ber8 , 2014t

h a titw illa dv iseSonys
em ployeeson h ow t
o m a na g et
h elea kof t
h eirpersona linform a t
ion in t
h em a ssiv e
3
4
SonyN et
w orkD a t
a B rea ch .
5
6
68.
O n D ecem ber10, 2014, t

h eSena t
eC om m it
t
eeon B a nking , H ousing
a ndUrba n A ffa irsh elda cybersecurit

yh ea ring in w h ich N ew YorkSena t
or
7
8
9
C h a rlesSch um erra isedconcernsov ert

h eorig in of SonyscurrentD a t
a B rea ch .
10
Th eH a ckedP I I of SonysC urrenta ndF orm erE m ployeesw a s

Va lua ble
11
69.
12
F.
A sa resultof t
h eD a t
a B rea ch , cyber-crim ina lsnow possesst
h eP I I of
Sonyscurrenta nd form erem ployees.
13
7 0.
14
A st
h eF edera lTra deC om m ission h a sst
at
ed, P I I such a sSocia l
15
Securit
ynum bers, fina ncia linform a t
ion, a ndot
h ersensit
iv einform a t
ion a rew h a t
16
t
h iev esusem ostoft
en t
o com m itfra udorident
it
yt
h eft
.I n a ddit
ion, onceident
it
y
17
18
19
20
t
h iev esh a v epersona linform a t
ion, t
h eyca n dra in yourba nka ccount
, run up your
creditca rds, open new ut
ilit
ya ccount
s, org etm edica lt
rea t
m enton yourh ea lt
h
insura nce.
21
7 1.
22
23
24
L eg it
im a t
eorg a niza t
ionsa ndt
h ecrim ina lunderg rounda like
recog nizet
h ev a lueof such da t
a. O t
h erw ise, t
h eyw ould notpa yfororm a int
a in it
,
ora g g ressiv elyseekit
. C rim ina lsseekpersona la nd fina ncia linform a t
ion of
25
26
27
consum ersbeca uset

h eyca n usebiog ra ph ica lda t
at
o perpet
ua t
em orea nd la rg er
t
h eft
s.
28
C la ssA ct
1
2
3
4
G .
SonyF a iledt
o Tim elya ndA dequa t
elyP rot
ectC urrenta ndF orm er
E m ployeesP I I
7 2.
Sonyh a sa lrea dya ct

edt
o prot
ectit
self byusing h a cking m et
h odsof
it
sow n t
o com ba tilleg a ldow nloa dsof it
sm ov iest
h a th a ckerspubliclyrelea sed
5
6
a ft
ert
h eD a t
a B rea ch , a ccording t
o Recode. Specifica lly, itish a rnessing A m a zon
W eb Serv ices(t
h eba ckendt
h a th ost
sN et
flix,I nst
a g ra m a nd m a nyot
h ers) t
o
la unch a dist
ribut
eddenia lof serv ice(D D oS) a t
t
a ckon w ebsit
esh ost
ing t
h est
olen
9
10
11
12
a sset
s.
7 3.
Sonyh a snot
, h ow ev er, sim ila rlya ct
edt
o prot
ectit
scurrenta nd
form erem ployees.
13
14
7 4.
Th isisim port
a ntbeca use, a ccording t
o expert
s, oneoutof fourda t
a
15
brea ch not
ifica t
ion recipient
sbeca m ea v ict
im of ident
it
yfra ud, in w h ich a n
16
ident
it
yt
h ief usesa not
h erspersona la nd fina ncia linform a t
ion such a st
h at
17
18
19
20
personsna m e, a ddress, a ndot

h erinform a t
ion, w it
h outperm ission, t
o com m it
fra udorot
h ercrim es.
7 5.
F orinst
a nce, ident
it
yt
h iev esm a ycom m itv a rioust
ypesof crim es
21
22
23
24
such a sim m ig ra t
ion fra ud, obt
a ining a driv erslicenseorident
ifica t
ion ca rdin t
he
v ict
im sna m ebutw it
h a not
h erspict
ure, using t
h ev ict
im sinform a t
ion t
o obt
a in
g ov ernm entbenefit
s, orfiling a fra udulentt
a xret
urn using t
h ev ict
im s
25
26
inform a t
ion t
o obt
a in a fra udulentrefund.
27
28
C la ssA ct
1
2
76.
I n a ddit
ion, ident
it
yt
h iev esm a yg etm edica lserv icesusing
consum erslostinform a t
ion orcom m ita nynum berof ot
h erfra uds, such a s
3
4
5
6
obt
a ining a j
ob, procuring h ousing orev en g iv ing fa lseinform a t
ion t
o police
during a n a rrest
.
77.
F urt
h erm ore, t
h eP I I t
h a tSonyfa iledt
o a dequa t
elyprot
ecta ndt
h at
7
8
w a sst
olen in t
h eD a t
a B rea ch isasg ooda sg oldt
o ident
it
yt
h iev esbeca use
ident
it
yt
h iev esca n usev ict
im spersona lda t
at
o open new fina ncia la ccount
sa nd
10
incurch a rg esin a not

h erpersonsna m e, t
a keoutloa nsin a not
h erpersonsna m e,
11
12
13
14
a nd incurch a rg eson exist

ing a ccount
s.
78.
F ina lly, t
h eG O P h a ckersh a v ea lrea dyused t
h isP I I t
o h a ra ssSonys
em ployeesbyt
h rea t
ening h a rm t
ot
h eirfa m iliesif t
h eydidnotcoopera t
eby
15
16
sig ning a docum entev idencing supportfort

h eG O P m ission a ndsubst
a nt
ia lly
17
im pa iring t
h eira bilit
yt
o w orkw h ilem a lw a rew a sinst
a lledon t
h eSonyN et
w ork.
18
79.
Th eUnit
edSt
at
esg ov ernm enta ndpriv a cyexpert
sa cknow ledg et
h at
19
20
21
22
itm a yt
a keyea rsforident
it
yt
h eftt
o com et
o lig h ta ndbedet
ect
ed.
8 0.
A ccording ly, a sI dent

it
yF inderL L C C EO Todd F einm a n t
old
L a w 36 0, t
h erea lv ict
im sa reSonysem ployeesa ndex-em ployees:Th eyrenow
23
24
25
26
27
a triskforident
it
yt
h eftfort
h erestof t
h eirliv es.
8 1.
O n inform a t
ion a ndbelief, t
h eP I I post
edt
ot
h eI nt
ernetpert
a ining t
o
Sonyem ployeesw a snotlim it

edt
o currentem ployeesa ndda t
esba ckt
o em ployees
28
C la ssA ct
1
2
t
h a tleftSonya slong a g o a s2000, a ndt
o a ct
orsa nd film m a kersw h o w orked for
Sonya sfa rba cka s19 8 4.
3
4
5
6
8 2.
N ot
a bly, w h ilesev era lform erSonyem ployeesreport
edseeing t
h eir
persona lda t
a in lea keddocum ent
sbyD ecem ber8 , 2014, oneform erh ig h -ra nking
Sonyem ployeew h o leftt
h ecom pa nyea rliert
h isyea rt
oldC N ET t
h at
:Th e
7
8
9
10
st
udiosdonea bsolut
elynot
h ing t
o rea ch outt
o us.
8 3.
O n D ecem ber9 , 2014, on inform a t

ion a nd belief, Sonybeg a n
g enera llyresponding t
o inquiriesbyform erSonyem ployeesconcerneda boutt
he
11
12
SonyN et
w orkD a t
a B rea ch a ndpublic dissem ina t
ion of form erSonyem ployeeP I I
13
st
olen byt
h eh a ckers.
14
8 4.
Sonysbela t
edresponsedid notconfirm w h et
h erspecific currentor
15
16
form erem ployeesP I I h a dbeen com prom ised, a ndinst

ea dputt
h eburden on t
he
17
inquiring currentorform erem ployeest

o a ctt
o m inim izeyourriskof ident
it
y
18
t
h eft
.Sonysresponsenot
edt
h a tform erSonyem ployeescouldexpectt
o receiv e
19
20
a n em a ilw it
h in t
h enextsev era lda yst
h a tw ould includeinst
ruct
ionson h ow t
h ey
21
couldsig n up for12m ont

h sof ident
it
yprot
ect
ion serv icesa tno ch a rg ew it
h at
h ird
22
pa rt
yprov iderof Sonysch oosing .
23
24
25
26
27
28
8 5.
I n conj
unct
ion w it
h it
sbela t
eddisclosure, Sonyputt
h eburden on
P la int
iffsa ndt
h eot
o m onit
orforda m a g esca usedbyt
h eD a t
a
B rea ch , ca ut
ioning t
h em t
o w at
ch outforuna ut
h orized useof t
h eircreditca rdda t
a
a nd ident
it
y-t
h eftsca m s. I m plicit
lyrecog nizing t
h eda m a g eca usedbyt
h eD a t
a
C la ssA ct
1
2
B rea ch , Sonyencoura g edP la int

iffsa ndt
h eot
o rem a in
v ig ila nt
,t
o rev iew youra ccountst
at
em ent
sa ndt
o m onit
oryourcreditreport
s.
3
4
5
6
86.
O n D ecem ber10, 2014, Tw in C it

ies.com ech oedt
h econcern of
form erSonyem ployees, report

ing t
h a tnea rly4,000peopleh a dj
oineda recent
ly
form ed F a cebookg roup ca lledSonyEx-Em ployeesW orrieda boutt
h eI nfo
7
8
B rea ch ,a ndt
h a tm a nyof t
h oseform erem ployeesw ereconcernedt
h a tt
h eya re
una blet
o g etinform a t
ion from t
h est
udio a bouth ow t
o reg ist
erforcredit
10
m onit
oring a ndt
h eident
it
yprot
ect
ion t
h a tt
h est
udio h a snow a rra ng edt
o offert
o
11
12
13
14
a llcurrenta ndpot
ent
ia llya ffect
ed form erem ployeesa ndt
h eirdependent
s.
87.
O n inform a t
ion a ndbelief, on ora boutD ecem ber12, 2014, Sonys
t
h irdpa rt
yident
it
yprot
ect
ion prov iderA llC lea rI D beg a n prov iding form er
15
16
em ployeesw it
h a ct
iv a t
ion codest
h a tt
h eycoulduset
o sig n up forcredit
17
m onit
oring a nda n ident
it
yt
h eftinsura ncepolicy.
18
88.
Sonyslim it
edofferof 12m ont
h sof creditm onit
oring a nd insura nce
19
20
isina dequa t
e. N eit
h erdoesa nyt
h ing t
o prev entident
it
yfra ud. C reditm onit
oring
21
onlyinform sa consum erof inst

a ncesof fra udulentopening of new a ccount
s, not
22
fra udulentuseof exist

ing creditca rds. A g enciesof t
h efedera lg ov ernm enta nd
23
24
priv a cyexpert
sa cknow ledg et
h a tst
olen da t
a m a ybeh eld form oret
h a n a yea r
25
beforebeing usedt
o com m itident
it
yt
h efta ndoncest
olen da t
a h a sbeen soldor
26
27
post
edon t
h eI nt
ernet
, fra udulentuseof st
olen da t
a m a ycont
inueforyea rs.
28
C la ssA ct
1
2
89.
O n inform a t
ion a ndbelief, t
h eD a t
a B rea ch t
ot
h eSonyN et
w ork
a nd/ora ccept
ing creditm onit
oring a nd ident
it
yprot
ect
ion m a yresultin credit
3
4
5
reporta g enciespla cing red fla g son currenta nd form erSonyem ployeecredit
report
s, w h ich subst
a nt
ia llyim pa irsv ict
im sa bilit
yt
o obt
a in a ddit
iona lcredit
.
VI .
C L A SS A C TI O N A L L E G A TI O N S
7
8
9
10
9 0.
P la int
iffsbring t
h issuita sa cla ssa ct
ion pursua ntt
o Rule23of t
he
F edera lRulesof C iv ilP rocedure, on beh a lf of h im self a nda llot

h erssim ila rly
sit
ua t
ed, a sm em bersof a C la ssinit
ia llydefineda sfollow s:
11
12
A llform era ndcurrentem ployeesin t

h eUnit
edSt
at
esof Sonyw h ose
13
P ersona llyI dent

ifia bleI nform a t
ion w a scom prom isedbySonys
14
securit
ybrea ch est
h a tbeca m epublic st
a rt
ing in N ov em ber2014, a nd
15
16
17
18
a nyrela t
edsecurit
ybrea ch es.
9 1.
P la int
iffsa lso seekt
o cert
ifya C a lifornia Subcla ssconsist
ing of a ll
m em bersof t
h eC la ssw h o a reresident
sof C a lifornia undert
h erespect
iv eda t
a
19
20
21
22
brea ch st
at
ut
eof C a lifornia setfort
h in C ountII I . Th iscla ssisdefineda sfollow s:
A llform era ndcurrentem ployeesof Sonyw h o a reresident
sof
C a lifornia w h oseP ersona llyI dent
ifia bleI nform a t
ion w a s
23
24
25
com prom isedbySonyssecurit

ybrea ch est
a rt
ing
in N ov em ber2014, a nda nyrela t
edsecurit
ybrea ch es.
26
27
28
C la ssA ct
1
2
9 2.
P la int
iffsa lso seekt
o cert
ifya Virg inia Subcla ssconsist
ing of a ll
m em bersof t
h eC la ssw h o a reresident
sof Virg inia undert
h erespect
iv eda t
a
3
4
brea ch st
at
ut
eof Virg inia setfort
h in C ountIV. Th iscla ssisdefineda sfollow s:
A llform era ndcurrentem ployeesof Sonyw h o a reresident

sof
Virg inia w h oseP ersona llyI dent

ifia bleI nform a t
ion w a scom prom ised
7
8
bySonyssecurit
ybrea ch est
a rt
ing in N ov em ber
2014, a nda nyrela t

edsecurit
ybrea ch es.
10
9 3.
N um erosit
y. Th eC la ssissufficient
lynum erous, a sa pproxim a t
ely
11
12
15,000Sonyem ployeesa nd form erem ployeesh a v eh a dt

h eirP I I com prom ised.
13
Th eP ut
at
iv eC la ssm em bersa reso num erousa nddispersedt
h roug h outt
h eUnit
ed
14
St
at
est
h a tj
oinderof a llm em bersisim pra ct
ica ble. P ut
at
iv eC la ssm em bersca n be
15
16
ident
ifiedbyrecordsm a int
a inedbyD efenda nt
.
17
18
9 4.
C om m on Q uest
ionsof F a cta ndL a w . C om m on quest
ionsof fa ct
a nd la w exista st
o a llm em bersof t
h eC la ssa ndpredom ina t
eov era nyquest
ions
19
20
a ffect
ing solelyindiv idua lm em bersof t
h eC la ss, pursua ntt
o Rule23(b)(3).
21
A m ong t
h equest
ionsof fa cta ndla w t
h a tpredom ina t
eov era nyindiv idua lissues
22
a re:
23
24
25
26
27
28
(1)
W h et
h erSonyfa iledt
o exerciserea sona bleca ret
o prot
ect
P la int
iffsa ndt
h eC la ssP I I ;
(2)
W h et
h erSonyt
im ely, a ccura t
ely, a nda dequa t
elyinform ed
P la int
iffsa ndt
h eC la sst
h a tt
h eirP I I h a dbeen com prom ised;
C la ssA ct
1
2
(3)
W h et
h erSonysconductw it
h respectt
ot
h eda t
a brea ch w a s
unfa ira nddecept

iv e;
3
(4)
4
5
W h et
h erSonyow eda leg a ldut
yt
o P la int
iffsa ndt
h eC la sst
o
prot
ectt
h eirP I I a ndw h et
h erD efenda ntbrea ch edt
h isdut
y;
(5)
W h et
h erSonyw a sneg lig ent
;
(6 )
W h et
h erSonyret
a insem ployeesda t
a fora rea sona blet
im e;
(7 )
W h et
h erP la int
iffsa ndt
h eC la ssa rea ta n increa sedriskof
10
ident
it
yt
h efta sa resultof Sonysbrea ch esa nd fa iluret
o prot
ectP la int
iffs
11
12
a ndt
h eC la ssP I I ;a nd
13
14
(8 )
W h et
h erP la int
iffsa nd m em bersof t
h eC la ssa reent
it
ledt
ot
he
relief soug h t
, including inj
unct
iv erelief.
15
16
17
18
9 5.
Typica lit
y. P la int
iffscla im sa ret
ypica lof t
h ecla im sof m em bersof
t
h eC la ssbeca useP la int
iffsa ndt
h eC la sssust
a inedda m a g esa rising outof
D efenda nt
sw rong fulconducta sdet
a iled h erein. Specifica lly, P la int
iffsa ndt
he
19
20
C la sscla im sa risefrom Sonysfa iluret

o inst
a lla nd m a int
a in rea sona blesecurit
y
21
m ea surest
o prot
ectP la int
iffsa ndt
h eC la sssP I I , a ndt
ot
im elynot
ifyt
h em w h en
22
t
h esecurit
ybrea ch occurred.
23
24
25
26
27
28
96.
A dequa cy. P la int

iffsw illfa irlya nda dequa t
elyprot
ectt
h eint
erest
s
of t
h eC la ssa nd h a sret
a inedcounselcom pet
enta ndexperienced in cla ssa ct
ion
la w suit
s. P la int
iffsh a v eno int
erest
sa nt
a g onist
ic t
o orin conflictw it
h t
h oseof t
he
C la ssa ndt
h ereforeisa n a dequa t
erepresent
at
iv eforC la ss.
C la ssA ct
1
2
97.
Superiorit
y. A cla ssa ct
ion issuperiort
o ot
h era v a ila blem et
h odsfor
t
h efa ira ndefficienta dj
udica t
ion of t
h iscont
rov ersybeca uset
h ej
oinderof a ll
3
4
5
6
m em bersof t
h eput
at
iv eC la ssisim pra ct
ica ble. F urt
h erm ore, t
h ea dj
udica t
ion of
t
h iscont
rov ersyt
h roug h a cla ssa ct
ion w illa v oidt
h epossibilit
yof a n inconsist
ent
a ndpot
ent
ia llyconflict
ing a dj
udica t
ion of t
h ecla im sa ssert
edh erein. Th erew illbe
7
8
no difficult
yin t
h em a na g em entof t
h isa ct
ion a sa cla ssa ct
ion.
VI I . C A USE S O F A C TI O N
10
11
C O UN T I :N eg lig ence
98.
P la int
iffsa ndt
h eC la ssrea lleg ea nd incorpora t
ebyreferencet
he
12
13
a lleg a t
ionscont
a ined in ea ch of t
h epreceding pa ra g ra ph sof t
h isC om pla inta sif
14
fullysetfort
h h erein.
15
99.
D efenda ntow eda dut

yt
ot
h eC la sst
o exerciserea sona bleca rein
16
17
obt
a ining , securing , sa feg ua rding , delet
ing a ndprot
ect
ing P la int
iffsa ndt
h eC la ss
18
P I I w it
h in it
spossession orcont
rolfrom being com prom ised, lost
, st
olen, a ccessed
19
a nd m isusedbyuna ut
h orizedpersons. Th isdut
yincluded, a m ong ot
h ert
h ing s,
20
21
desig ning , m a int

a ining a ndt
est
ing Sonyssecurit
ysyst
em st
o ensuret
h at
22
P la int
iffsa ndC la ssm em bersP I I in Sonyspossession w a sa dequa t
elysecured
23
a ndprot
ect
ed. Sonyfurt
h erow eda dut
yt
o P la int
iffsa ndt
h eC la sst
o im plem ent
24
25
processest
h a tw oulddet
ecta brea ch of it
ssecurit
ysyst
em in a t
im elym a nnera nd
26
t
ot
im elya ctupon w a rning a nda lert
sincluding t
h oseg enera t
edbyit
sow n securit
y
27
28
syst
em s.
C la ssA ct
1
2
100. Sonyow eda dut

yt
o P la int
iffsa ndt
h em em bersof t
h eC la sst
o
prov idesecurit
y, including consist
entw it
h of indust
ryst
a nda rdsa ndrequirem ent
s,
3
4
5
6
t
o ensuret
h a tit
ssyst
em sa nd net
w orks, a ndt
h epersonnelresponsiblefort
h em ,
a dequa t
elyprot
ect
edt
h eP I I of it
scurrenta nd form erem ployees.
101. Sonyow eda dut
yof ca ret
o P la int
iffsa ndt
h em em bersof t
h eC la ss
7
8
beca uset
h eyw ereforeseea blea ndproba blev ict
im sof a nyina dequa t
esecurit
y
pra ct
ices. Sonyknew orsh ouldh a v eknow n ith a d ina dequa t
elysa feg ua rded it
s
10
N et
w ork, pa rt
icula rlyin lig h tof it
sm ult
iplepriorbrea ch es, a snot
eda bov e, a ndyet
11
12
Sonyfa iledt
ot
a kerea sona blepreca ut
ionst
o sa feg ua rdcurrenta nd form er
13
em ployeesP I I .
14
102. Sonyow eda dut

yt
ot
im elya nda ccura t
elydiscloset
o P la int
iffsa nd
15
16
m em bersof t
h eC la sst
h a tt
h eirP I I h a dbeen orw a srea sona blybeliev edt
o h ave
17
been com prom ised. Tim elydisclosurew a srequired, a ppropria t

ea nd necessa ryso
18
t
h at
, a m ong ot
h ert
h ing s, P la int
iffsa ndt
h em em bersof t
h eC la sscouldt
a ke
19
20
a ppropria t
em ea surest
o a v oid ident
ifyt
h eftorfra udulentch a rg es, including ,
21
m onit
ort
h eira ccountinform a t
ion a ndcreditreport
sforfra udulenta ct
iv it
y, cont
a ct
22
t
h eirba nksorot
h erfina ncia linst
it
ut
ions, obt
a in creditm onit
oring serv ices, file
23
24
report
sw it
h la w enforcem enta ndot
h erg ov ernm ent
a la g enciesa ndt
a keot
h erst
eps
25
t
o m it
ig a t
eora m eliora t
et
h eda m a g esca usedbySonysm isconduct
.
26
27
28
103. P la int
h eC la ssent
rust
edSonyw it
h t
h eirP I I on
t
h eprem isea ndw it
h t
h eunderst
a nding t
h a tSonyw ouldsa feg ua rdt
h eir
C la ssA ct
1
2
inform a t
ion, a ndSonyw a sin a posit
ion t
o prot
ecta g a instt
h eh a rm sufferedby
P la int
h eC la ssa sa resultof t
h eD a t
a B rea ch .
3
4
5
6
104. Sonyknew , orsh ouldh a v eknow n, of t

h einh erentrisksin collect
ing
a ndst
oring t
h eC la ssa ndof t
h ecrit
ica l
im port
a nceof prov iding a dequa t
esecurit
yof t
h a tinform a t
ion.
7
8
9
10
105. Sonysow n conducta lso crea t

eda foreseea bleriskof h a rm t
o
P la int
h eC la ss. Sonysm isconductincluded, butw a snot
lim it
edt
o, it
sfa iluret
ot
a ket
h est
epsa ndopport
unit
iest
o prev enta ndst
op t
he
11
12
D at
a B rea ch a ssetfort
h h erein. Sonysm isconducta lso includedit
sdecision nott
o
13
com plyw it
h indust
ryst
a nda rdsfort
h esa fekeeping a nd m a int
ena nceof t
h eP I I of
14
P la int
h eC la ss.
15
16
17
18
106 . Th roug h it
sa ct
sa ndom issionsdescribedh erein, Sonyunla w fully
brea ch ed it
sdut
yt
o userea sona bleca ret
o prot
ecta ndsecureP la int
iffsa ndt
he
C la ssP I I w it
h in it
spossession orcont
rol. M orespecifica lly, D efenda ntfa iledt
o
19
20
m a int
a in a num berof rea sona blesecurit
yproceduresa ndpra ct
icesdesig nedt
o
21
prot
ectt
iffsa ndt
h eC la ss, including , butnotlim it
edt
o, est
a blish ing
22
a nd m a int
a ining indust
ry-st
a nda rdsyst
em st
o sa feg ua rdit
scurrenta nd form er
23
24
em ployeesP I I . G iv en t
h eriskinv olv eda ndt
h ea m ountof da t
a a tissue, Sonys
25
brea ch of it
sdut
iesw a sent
irelyunrea sona ble.
26
27
28
C la ssA ct
1
2
107 . Sonybrea ch ed it
sdut
iest
ot
im elya nda ccura t
elydiscloset
h at
P la int
iffsa ndC la ssm em bersP I I in Sonyspossession h a dbeen orw a s
3
4
5
6
rea sona blybeliev edt

o h a v ebeen, st
olen orcom prom ised.
108 . A sa directa ndproxim a t
eresultof D efenda nt
sbrea ch of it
sdut
ies,
P la int
h eC la ssh a v ebeen h a rm edbyt
h erelea seof t
h eirP I I ,
7
8
ca using t
h em t
o expendpersona lincom eon creditm onit
oring serv icesa ndput
t
ing
t
h em a ta n increa sedriskof ident
it
yt
h eft
. P la int
h eC la ssh a v e
10
spentt
im ea nd m oneyt
o prot
ectt
h em selv esa sa resultof D efenda nt
sconduct
, a nd
11
12
w illcont
inuet
o berequiredt
o spendt
im ea nd m oneyprot
ect
ing t
h em selv es, t
h eir
13
ident
it
ies, t
h eircredit
, a ndt
h eirreput
at
ions.
14
15
C O UN T I I :Viola t
ion of C a lifornia C onfident
ia lit
yof
M edica lI nform a t
ion A ct
, C a l. C iv . C ode 56 , et seq.
16
109 . P la int
iffsa ndt
ebyreferencet
he
17
18
19
20
a lleg a t
ionscont
fullysetfort
h h erein.
110. C a lifornia C iv ilC ode 56 , etseq., know n a st
h eC onfident
ia lit
yof
21
22
23
24
M edica lI nform a t
ion A ct(M edica lI nform a t
ion A ct
), requiresem ployersw h o
receiv em edica linform a t
ion t
o est
a blish a ppropria t
eprocedurest
o ensuret
he
confident
ia lit
ya ndprot
ect
ion from una ut
h orizedusea nddisclosureof t
h at
25
26
27
inform a t
ion. Th eseproceduresm a yinclude, buta renotlim it
edt
o, inst
ruct
ion
reg a rding confident
ia lit
yof em ployeesa nd a g ent
sh a ndling filescont
a ining
28
C la ssA ct
1
2
m edica linform a t
ion, a ndsecurit
ysyst
em srest
rict
ing a ccesst
o filescont
a ining
m edica linform a t
ion.
3
4
5
6
111. F urt
h erm ore, t
h eM edica lI nform a t
ion A ctproh ibit
sem ployersfrom
disclosing m edica linform a t
ion reg a rding a pa t
ientw it
h outfirstobt
a ining w rit
t
en
a ut
h oriza t
ion from t
h epa t
ient
.
7
8
112. I n t
h eusua lcourseof business, em ployers, including Sony, possess
a ndret
a in cert
a in m edia t
ion recordsa ndinform a t
ion belong ing t
o it
scurrenta nd
10
form erem ployees, including cert

a in of P la int
iffsm edica linform a t
ion. D uring
11
12
13
14
t
h eirem ploym entw it
h Sony, P la int
iffsliv edin C a lifornia .
113. A ta llrelev a ntt
im es, D efenda nth a da leg a ldut
yt
o prot
ectt
he
confident
ia lit
yof P la int
iffsa ndC la ssm em bersm edica linform a t
ion.
15
16
17
18
114. B yfa iling t

o ensurea dequa t
esecurit
ysyst
em sw erein pla cet
o
prev enta ccessa nddisclosureof P la int
iffsa ndC la ssm em berspriv a t
em edica l
inform a t
ion w it
h outw rit
t
en a ut
h oriza t
ion, D efenda ntv iola t
edt
h eM edica l
19
20
I nform a t
ion A cta ndt
h eirleg a ldut
yt
o prot
ectt
h econfident
ia lit
yof such
21
inform a t
ion.
22
115. P ursua ntt

o C a l. C iv . C ode 56 .36 , t
h oseP la int
iffsa nd m em bersof
23
24
t
h eC la ssw h osem edica linform a t
ion w a scom prom iseda reent
it
ledt
o nom ina l
25
st
at
ut
oryda m a g esof $1,000percla ssm em bera sw ella sa nya ct
ua lda m a g es
26
27
sust
a inedbyt
h oseP la int
h eC la ss.
28
C la ssA ct
1
2
3
4
C O UN T I I I :Viola t
ion of C a l. C iv . C ode 17 9 8 .8 0etseq.
(O n B eh a lf O f P la int
iff M a t
h isa ndt
h eC a lifornia Subcla ss)
116 . P la int
iffsa ndt
ebyreferencet
he
a lleg a t
ionscont
5
6
7
8
fullysetfort
h h erein.
117 . Sect
ion 17 9 8 .8 2of t
h eC a lifornia C iv ilC odeprov ides, in pert
inent
pa rt
, a sfollow s:
9
10
(b) A nyperson orbusinesst

h a tm a int
a inscom put
erizedda t
at
h at
11
includespersona linform a t
ion t
h a tt
h eperson orbusinessdoesnot
12
ow n sh a llnot
ifyt
h eow nerorlicenseeof t
h einform a t
ion of a ny
13
14
brea ch of t
h esecurit
yof t
h eda t
a im m edia t
elyfollow ing discov ery, if
15
t
h epersona linform a t
ion w a s, orisrea sona blybeliev edt
o h a v ebeen,
16
a cquiredbya n una ut
h orizedperson.
17
* * *
18
19
20
(d) A nyperson orbusinesst

h a tisrequired t
o issuea securit
ybrea ch
not
ifica t
ion pursua ntt
ot
h issect
ion sh a llm eeta llof t
h efollow ing
21
22
23
24
requirem ent
s:
(1) Th esecurit
ybrea ch not
ifica t
ion sh a llbew rit
t
en in pla in
la ng ua g e.
25
26
27
(2) Th esecurit
ybrea ch not
ifica t
ion sh a llinclude, a ta
m inim um , t
h efollow ing inform a t
ion:
28
C la ssA ct
1
2
(A ) Th ena m ea ndcont
a ctinform a t
ion of t
h ereport
ing
person orbusinesssubj
ectt
ot
h issect
ion.
3
4
5
6
(B ) A listof t
h et
ypesof persona linform a t
ion t
h a tw ere
ora rerea sona blybeliev edt
o h a v ebeen t
h esubj
ectof a
brea ch .
7
8
(C ) I f t
h einform a t
ion ispossiblet
o det
erm inea tt
h et
im e
t
h enot
iceisprov ided, t
h en a nyof t
h efollow ing :(i) t
he
10
da t
eof t
h ebrea ch , (ii) t
h eest
im a t
edda t
eof t
h ebrea ch , or
11
12
(iii) t
h eda t
era ng ew it
h in w h ich t
h ebrea ch occurred. Th e
13
not
ifica t
ion sh a lla lso includet
h eda t
eof t
h enot
ice.
14
(D ) W h et
h ernot
ifica t
ion w a sdela yeda sa resultof a la w
15
16
enforcem entinv est

ig a t
ion, if t
h a tinform a t
ion ispossible
17
t
o det
erm inea tt
h et
im et
h enot
iceisprov ided.
18
(E) A g enera ldescript

ion of t
h ebrea ch incident
, if t
h at
19
20
inform a t
ion ispossiblet
o det
erm inea tt
h et
im et
h enot
ice
21
isprov ided.
22
(F ) Th et
oll-freet
eleph onenum bersa nda ddressesof t
he
23
24
m aj
orcreditreport
ing a g enciesif t
h ebrea ch exposeda
25
socia lsecurit
ynum berora driv erslicenseorC a lifornia
26
27
28
ident
ifica t
ion ca rd num ber.
* * *
C la ssA ct
1
2
(f) A nyperson orbusinesst

h a tisrequiredt
o issuea securit
ybrea ch
not
ifica t
ion pursua ntt
ot
h issect
ion t
o m oret
h a n 500C a lifornia
3
4
5
6
resident
sa sa resultof a sing lebrea ch of t
h esecurit
ysyst
em sh a ll
elect
ronica llysubm ita sing lesa m plecopyof t
h a tsecurit
ybrea ch
not
ifica t
ion, excluding a nypersona llyident
ifia bleinform a t
ion, t
ot
he
7
8
At
t
orneyG enera l. A sing lesa m plecopyof a securit
ybrea ch
not
ifica t
ion sh a llnotbedeem edt
o bew it
h in subdiv ision (f) of
10
Sect
ion 6 254of t
h eG ov ernm entC ode.
11
12
(g ) F orpurposesof t
h issect
ion, brea ch of t
h esecurit
yof t
h esyst
em
13
m ea nsuna ut
h orizeda cquisit
ion of com put
erizedda t
at
h at
14
com prom isest

h esecurit
y, confident
ia lit
y, orint
eg rit
yof persona l
15
16
inform a t
ion m a int
a inedbyt
h eperson orbusiness. G oodfa it
h
17
a cquisit
ion of persona linform a t
ion bya n em ployeeora g entof t
he
18
person orbusinessfort
h epurposesof t
h eperson orbusinessisnota
19
20
brea ch of t
h esecurit
yof t
h esyst
em , prov idedt
h a tt
h epersona l
21
inform a t
ion isnotusedorsubj
ectt
o furt
h eruna ut
h orizeddisclosure.
22
118 . Th euna ut
h orizeda cquisit
ion of P la int
iffsa ndC la ssm em bersP I I
23
24
25
26
27
28
const
it
ut
eda brea ch of t
h esecurit
ysyst
em of Sony.
119 . Sonyunrea sona blydela yed inform ing a nyonea boutt
h ebrea ch of
securit
yof C a lifornia Subcla ssm em bersconfident
ia la nd non-public inform a t
ion
a ft
erSonyknew t
h eD a t
a B rea ch h a doccurred.
C la ssA ct
1
2
120. D efenda ntfa iledt

o discloset
o C a lifornia Subcla ssm em bers, w it
h out
unrea sona bledela y, a nd in t
h em ostexpedientt
im epossible, t
h ebrea ch of securit
y
3
4
5
6
of t
h eirunencrypt
ed, ornotproperlya ndsecurelyencrypt
ed, P I I w h en t
h eyknew
orrea sona blybeliev edsuch inform a t
ion h a dbeen com prom ised.
121. Upon inform a t
ion a ndbelief, no la w enforcem enta g encyinst
ruct
ed
7
8
9
10
Sonyt
h a tnot
ifica t
ion t
o C a lifornia Subcla ssm em bersw ould im pedeinv est
ig a t
ion.
122. P ursua ntt
o Sect
ion 17 9 8 .8 4of t
h eC a lifornia C iv ilC ode:
(a ) A nyw a iv erof a prov ision of t
h ist
it
leiscont
ra ryt
o public policy
11
12
a nd isv oida nd unenforcea ble.
13
14
* * *
(e) A nybusinesst
h a tv iola t
es, proposest
o v iola t
e, orh a sv iola t
edt
h is
15
16
t
it
lem a ybeenj
oined.
17
123. A sa resultof Sonysv iola t

ion of C a l. C iv . C ode 17 9 8 .8 2, C a lifornia
18
Subcla ssm em bersincurredeconom ic da m a g esrela t

ing t
o expensesforcredit
19
20
21
22
m onit
oring a ndot
h erident
ifyt
h eftprev ent
ion serv ices.
124. P la int
iff M a t
h is, indiv idua llya ndon beh a lf of t
h eot
h erC a lifornia
Subcla ssm em bers, seeka llrem ediesa v a ila bleunderC a l. C iv . C ode 17 9 8 .8 4,
23
24
including , butnotlim it
edt
o:(a ) da m a g essufferedbyC a lifornia Subcla ssm em bers
25
a sa lleg eda bov e;a nd(b) equit

a blerelief.
26
27
C O UN T I V:Viola t
ion of 18 .2-18 6 .6 ., etseq.
(O n B eh a lf O f P la int
iff C orona a ndt
h eVirg inia Subcla ss)
28
C la ssA ct
1
2
125. P la int
iffsa ndt
ebyreferencet
he
a lleg a t
ionscont
3
4
5
6
fullysetfort
h h erein.
126 . Sect
ion 18 .2-18 6 .6 of t
h eC odeof Virg inia prov ides, in pert
inentpa rt
,
a sfollow s:
7
8
(B ) I f unencrypt
edorunreda ct
edpersona linform a t
ion w a soris
rea sona blybeliev edt

o h a v ebeen a ccesseda nda cquiredbya n
10
una ut
h orizedperson a ndca uses, ort
h eindiv idua lorent
it
yrea sona bly
11
12
believ esh a sca usedorw illca use, ident

it
yt
h eftora not
h erfra udt
o a ny
13
residentof t
h eC om m onw ea lt
h , a n indiv idua lorent
it
yt
h a tow nsor
14
licensescom put
erizedda t
at
h a tincludespersona linform a t
ion sh a ll
15
16
disclosea nybrea ch of t
h esecurit
yof t
h esyst
em follow ing discov ery
17
ornot
ifica t
ion of t
h ebrea ch of t
h esecurit
yof t
h esyst
em t
ot
h eO ffice
18
of t
h eA t
t
orneyG enera la nda nya ffect
edresidentof t
he
19
20
C om m onw ea lt
h w it
h outunrea sona bledela y. N ot
icerequiredbyt
h is
21
sect
ion m a yberea sona blydela yedt
o a llow t
it
yt
o
22
det
erm inet
h escopeof t
h ebrea ch of t
h esecurit
yof t
h esyst
em a nd
23
24
rest
oret
h erea sona bleint
eg rit
yof t
h esyst
em . N ot
icerequiredbyt
h is
25
sect
ion m a ybedela yed if, a ft
ert
it
ynot
ifiesa la w -
26
27
28
enforcem enta g ency, t

h ela w -enforcem enta g encydet
erm inesa nd
a dv isest
it
yt
h a tt
h enot
icew illim pedea crim ina l
C la ssA ct
1
2
orciv ilinv est

ig a t
ion, orh om ela ndorna t
iona lsecurit
y. N ot
icesh a llbe
m a dew it
h outunrea sona bledela ya ft
ert
h ela w -enforcem enta g ency
3
4
5
6
det
erm inest
h a tt
h enot
ifica t
ion w illno long erim pedet
he
inv est
ig a t
ion orj
eopa rdizena t
iona lorh om ela ndsecurit
y.
(C ) A n indiv idua lorent
it
ysh a lldiscloset
h ebrea ch of t
h esecurit
yof
7
8
t
h esyst
em if encrypt
edinform a t
ion isa ccesseda nda cquiredin a n
unencrypt
ed form , orif t
h esecurit
ybrea ch inv olv esa person w it
h
10
a ccesst
ot
h eencrypt
ion keya ndt
it
yrea sona bly
11
12
believ est
h a tsuch a brea ch h a sca usedorw illca useident
it
yt
h eftor
13
ot
h erfra udt
o a nyresidentof t
h eC om m onw ea lt
h.
14
(D ) A n indiv idua lorent

it
yt
h a tm a int
a inscom put
erizedda t
at
h at
15
16
includespersona linform a t
ion t
h a tt
it
ydoesnot
17
ow n orlicensesh a llnot
ifyt
h eow nerorlicenseeof t
h einform a t
ion of
18
a nybrea ch of t
h esecurit
yof t
h esyst
em w it
h outunrea sona bledela y
19
20
follow ing discov eryof t

h ebrea ch of t
h esecurit
yof t
h esyst
em , if t
he
21
persona linform a t
ion w a sa ccesseda nda cquiredbya n una ut
h orized
22
person ort
it
yrea sona blybeliev est
h epersona l
23
24
inform a t
ion w a sa ccesseda nda cquiredbya n una ut
h orizedperson.
25
(E) I n t
h eev enta n indiv idua lorent
it
yprov idesnot
icet
o m oret
h an
26
27
28
1,000personsa tonet
im epursua ntt
ot
h issect
ion, t
h eindiv idua lor
ent
it
ysh a llnot
ify, w it
h outunrea sona bledela y, t
h eO fficeof t
he
C la ssA ct
1
2
At
t
orneyG enera la nda llconsum erreport
ing a g enciest
h a tcom pile
a nd m a int
a in fileson consum erson a na t
ionw ideba sis, a sdefined in
3
4
5
6
15U.S.C . 16 8 1a (p), of t
h et
im ing , dist
ribut
ion, a ndcont
entof t
he
not
ice.
127 . F orpurposesof t
h issect
ion, persona linform a t
ionm ea nst
h efirst
7
8
na m eorfirstinit
ia la nd la stna m ein com bina t
ion w it
h a nd linkedt
o a nyoneor
m oreof t
h efollow ing da t
a elem ent
st
h a trela t
et
o a residentof t
h eC om m onw ea lt
h,
10
w h en t
h eda t
a elem ent
sa reneit
h erencrypt
ednorreda ct
ed:
11
12
(a ) Socia lsecurit
ynum ber;
13
(b) D riv erslicensenum berorst

at
eident
ifica t
ion ca rd num berissued
14
in lieu of a driv erslicensenum ber;or
15
16
(c) F ina ncia la ccountnum ber, orcreditordebitca rd num ber, in
17
com bina t
ion w it
h a nyrequiredsecurit
ycode, a ccesscode, or
18
pa ssw ordt
h a tw ouldperm ita ccesst
o a resident
sfina ncia la ccount
.
19
20
128 . F orpurposesof t
h issect
ion, not
icem ea ns:
21
(1) W rit
t
en not
icet
ot
h ela stknow n post
a la ddressin t
h erecordsof t
he
22
indiv idua lorent

it
y;
23
24
(2) Teleph onenot

ice;
25
(3) Elect
ronic not
ice;or
26
27
28
(4) Subst
it
ut
enot
ice, if t
h eindiv idua lort
h eent
it
yrequiredt
o prov idenot
ice
dem onst
ra t
est
h a tt
h ecostof prov iding not
icew illexceed$50,000, t
he
C la ssA ct
1
2
a ffect
edcla ssof Virg inia resident
st
o benot
ifiedexceeds100,000resident
s,
ort
h eindiv idua lort
h eent
it
ydoesnoth a v esufficientcont
a ctinform a t
ion or
3
4
5
consentt
o prov idenot
icea sdescribed in subdiv isions1, 2, or3of t
h is
definit
ion. Subst
it
ut
enot
iceconsist
sof a llof t
h efollow ing :
(a )
E-m a ilnot
iceif t
h eindiv idua lort
h eent
it
yh a se-m a ila ddresses
7
8
fort
h em em bersof t
h ea ffect
edcla ssof resident
s;
9
10
(b)
C onspicuouspost
ing of t
h enot
iceon t
h ew ebsit
eof t
he
indiv idua lort

h eent
it
yif t
h eindiv idua lort
h eent
it
ym a int
a insa w ebsit
e;
11
12
13
14
a nd
(c)
N ot
icet
o m aj
orst
at
ew idem edia .
129 . F urt
h er, t
h enot
icerequiredbyt
h issect
ion sh a llincludea
15
16
17
18
descript
ion of t
h efollow ing :
(1) Th eincidentin g enera lt
erm s;
(2) Th et
ypeof persona linform a t
ion t
h a tw a ssubj
ectt
ot
h euna ut
h orized
19
20
a ccessa nda cquisit

ion;
21
(3) Th eg enera la ct
sof t
it
yt
o prot
ectt
h epersona l
22
inform a t
ion from furt
h eruna ut
h orizeda ccess;
23
24
(4) A t
eleph onenum bert
h a tt
h eperson m a yca llforfurt
h erinform a t
ion a nd
25
a ssist
a nce, if oneexist
s;a nd
26
27
28
(5) A dv icet
h a tdirect
st
h eperson t
o rem a in v ig ila ntbyrev iew ing a ccount
st
at
em ent
sa nd m onit
oring freecreditreport
s.
C la ssA ct
1
2
130. B rea ch of t
h esecurit
yof t
h esyst
em m ea nst
h euna ut
h orizeda ccess
a nda cquisit
ion of unencrypt
eda ndunreda ct
edcom put
erizedda t
at
h at
3
4
5
6
com prom isest

h esecurit
yorconfident
ia lit
yof persona linform a t
ion m a int
a inedby
a n indiv idua lorent
it
ya spa rtof a da t
a ba seof persona linform a t
ion reg a rding
m ult
ipleindiv idua lsa ndt
h a tca uses, ort
it
yrea sona blybeliev es
7
8
h a sca used, orw illca use, ident

it
yt
h eftorot
h erfra udt
o a nyresidentof t
he
C om m onw ea lt
h . G ood fa it
h a cquisit
ion of persona linform a t
ion bya n em ployeeor
10
a g entof a n indiv idua lorent

it
yfort
h epurposesof t
it
yisnota
11
12
brea ch of t
h esecurit
yof t
h esyst
em , prov idedt
h a tt
h epersona linform a t
ion isnot
13
used fora purposeot

h ert
h a n a la w fulpurposeof t
it
yorsubj
ect
14
t
o furt
h eruna ut
h orizeddisclosure.
15
16
17
18
131.
Th euna ut
h orizeda cquisit
ion of P la int
iffsa ndC la ssm em bersP I I
const
it
ut
eda brea ch of t
h esecurit
yof t
h esyst
em of SonyunderSect
ion 18 .218 6 .6 .A . of t
h eC odeof Virg inia .
19
20
21
22
132. Sonyunrea sona blydela yed inform ing a nyonea boutt

h ebrea ch of
securit
yof Virg inia Subcla ssm em bersconfident
ia la nd non-public inform a t
ion
a ft
erSonyknew t
h eD a t
a B rea ch h a doccurred.
23
24
25
26
27
28
133. D efenda ntfa iledt

o discloset
o Virg inia Subcla ssm em bers, w it
h out
unrea sona bledela y, a nd in t
h em ostexpedientt
im epossible, t
h ebrea ch of securit
y
of t
h eirunencrypt
ed, ornotproperlya ndsecurelyencrypt
ed, persona linform a t
ion
w h en t
h eyknew orrea sona blybeliev edsuch inform a t
ion h a dbeen com prom ised.
C la ssA ct
1
2
134. Upon inform a t

ion a ndbelief, no la w enforcem enta g encyinst
ruct
ed
Sonyt
h a tnot
ifica t
ion t
o Virg inia Subcla ssm em bersw ould im pedeinv est
ig a t
ion.
3
4
5
6
135. N ot
h ing in Sect
ion 18 .2-18 6 .6 .I . of t
h eC odeof Virg inia lim it
sa n
indiv idua lfrom recov ering directeconom ic da m a g esfrom a v iola t
ion of t
h is
sect
ion.
7
8
9
10
136 . A sa resultof Sonysv iola t

ion of Sect
ion 18 .2-18 6 .6 . of t
h eC odeof
Virg inia , Virg inia Subcla ssm em bersincurredeconom ic da m a g esrela t
ing t
o
expensesforcreditm onit
oring a nd ident
it
yt
h eftprot
ect
ion. I n a ddit
ion, t
h eyh a v e
11
12
expended m a nyh oursa t

t
em pt
ing t
o sa feg ua rdt
h em selv esfrom ident
it
yt
h eftor
13
ot
h erelea seof t
h eirP I I a sa resultof t
h eD a t
a B rea ch ,
14
including freezing t
h eircreditrecordsa ndot
h erident
ifyt
h eftprev ent
ion serv ices.
15
16
17
18
137 . P la int
iff C orona , indiv idua llya ndon beh a lf of t
h eot
h erVirg inia
Subcla ssm em bers, seeka llrem ediesa v a ila bleunderSect
ion 18 .2-18 6 .6 .I . of t
he
C odeof Virg inia , including , butnotlim it
ed t
o:(a ) da m a g essufferedbyVirg inia
19
20
Subcla ssm em bersa sa lleg eda bov e;a nd(b) equit

a blerelief.
21
22
P RA YE RF O RRE L I E F
W H EREF O RE, P la int
iffs, on beh a lf of t
h em selv esa ndt
h eC la sssetfort
h
23
24
25
26
h erein, respect
fullyrequest
st
h efollow ing relief:
A.
Th a tt
h eC ourtcert
ifyt
h isca sea sa cla ssa ct
ion pursua ntt
o F edera l
Ruleof C iv ilP rocedure23(a ), (b)(2) a nd(b)(3), a nd, pursua ntt

o F edera lRuleof
27
28
C la ssA ct
1
2
C iv ilP rocedure23(g ), a ppointP la int

iffsa ndP la int
iffscounselof recordt
o
representsa idC la ss;
3
4
5
6
B .
F inding t
h a tSonybrea ch ed it
sdut
yt
o sa feg ua rda ndprot
ect
P la int
iffsa ndt
h eC la ssP I I t
h a tw a scom prom ised in t
h esecurit
ybrea ch t
h at
beca m epublic know ledg est
a rt
ing in N ov em ber2014;
7
8
9
10
C.
Th a tt
h eC ourta w a rdP la int
iffsa ndt
h eC la ssa ppropria t
erelief,
including a nya ct
ua la ndst
at
ut
oryda m a g es, rest
it
ut
ion a nddisg org em ent
.
D.
Th a tt
h eC ourta w a rdequit
a ble, inj
unct
iv ea nddecla ra t
oryrelief a s
11
12
m a ybea ppropria t
eundera pplica blest
at
ela w s. P la int
iffs, on beh a lf of t
h eC la ss
13
seeksa ppropria t
einj
unct
iv erelief, including butnotlim it
edt
o:(i) t
h eprov ision of
14
creditm onit
oring a nd/orcreditca rd m onit
oring serv icesfort
h eC la ssfora tlea st
15
16
fiv eyea rs;(ii) t

h eprov ision of ba nkm onit
oring a nd/orba nkm onit
oring serv ices
17
fort
h eC la ssfora tlea stfiv eyea rs;(iii) t
h eprov ision of ident
it
yt
h eftinsura ncefor
18
t
h eC la ssfora tlea stfiv eyea rs;(iv ) t
h eprov ision of creditrest
ora t
ion serv icesfor
19
20
t
h eC la ssfora tlea stfiv eyea rs;(v ) a w a rding P la int
iffsa ndt
h eC la sst
he
21
rea sona blecost

sa ndexpensesof suit
, including a t
t
orneysfees, filing fees, a nd
22
insura ncefort
h eC la ss;a nd(v i) requiring t
h a tSonyreceiv eperiodic com plia nce
23
24
a udit
sbya t
h irdpa rt
yreg a rding t
h esecurit
yof it
scom put
ersyst
em sused for
25
st
oring currenta nd form erem ployeeda t
a, t
o ensurea g a instt
h erecurrenceof a
26
27
28
da t
a brea ch bya dopt
ing a ndim plem ent
ing bestsecurit
yda t
a pra ct
ices;
E.
A w a rding t
h eda m a g esrequest
ed h erein t
o P la int
iffsa ndt
h eC la ss;
C la ssA ct
1
2
F.
A w a rding a llcost
s, including expert
sfeesa nda t
t
orneysfees, a nd
t
h ecost
sof prosecut
ing t
h isa ct
ion;
3
4
5
6
G.
A w a rding pre-j
udg m enta ndpost
-j
udg m entint
eresta sprescribedby
la w ;a nd
H.
G ra nt
ing a ddit
iona lleg a lorequit
a blerelief a st
h isC ourtm a yfindj
ust
7
8
9
10
a ndproper.
JURYTRI A L D EM A N D E D
P la int
iffsh erebydem a nda t
ria lbyj
uryon a llissuesso t
ria ble.
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
C la ssA ct
1
2
D A TED t
h is15t
h da yof D ecem ber, 2014.
3
4
5
6
7
8
B y s/ K h esra w K a rm a nd
K h esra w K a rm a nd(SB N 28 027 2)
M at
t
h ew J. P reusch (SB N 29 8 144)
kka rm a nd@ kellerroh rba ck.com
m preusch @ kellerroh rba ck.com
1129 St
at
eSt
reet
, Suit
e8
Sa nt
a B a rba ra , C a lifornia 9 3101
Tel.:(8 05) 456 -149 6 , F a x(8 05) 456 -149 7
9
10
11
12
13
14
15
16
17
18
L ynn L incoln Sa rko, pro h a c v ice

fort
h com ing
lsa rko@ kellerroh rba ck.com
G ret
ch en F reem a n C a ppio, pro h a c v ice
fort
h com ing
g ca ppio@ kellerroh rba ck.com
C a riC a m pen La ufenberg , pro h a c v ice
fort
h com ing
cla ufenberg @ kellerroh rba ck.com
A m yN .L. H a nson, pro h a c v icefort
h com ing
a h a nson@ kellerroh rba k.com
1201Th ird A v e., Suit
e3200
Sea t
t
le, W a sh ing t
on 9 8 101
Tel:(206 ) 6 23-19 00/ F a x:(206 ) 6 23-338 4
19
20
Attorneys for Plaintiffs Michael Corona

and Christina Mathis
21
22
23
24
25
26
27
28
C la ssA ct

Sony Pictures Entertainment Suit

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sony Pictures Entertainment Suit

Uploaded by

Copyright:

Available Formats

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 1 of 45 Page ID #:1

K h esra w K a rm a nd(C a l. B a rN o. 28 027 2)

M ich a elC orona a ndC h rist

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 2 of 45 Page ID #:2

persona lknow ledg e, inform a t

rea llife, isunfolding in slow m ot

em ploym entfilesincluding sa la ries, m edica linform a t

h a ndsof crim ina ls.

inexcusa bleproblem s:(1) Sonyfa iledt

beca useSonym a dea businessdecision t

Sonyscurrenta nd form erem ployeesst

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 3 of 45 Page ID #:3

em ployeena m es, h om ea ddresses, t

num bers, em a ila ddresses, sa la riesa ndbonuspla ns, h ea lt

perform a nceev a lua t

Sonyow eda leg a ldut

firew a llsa ndcom put

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 4 of 45 Page ID #:4

of fra uda nd ident

sig nifica ntda t

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 5 of 45 Page ID #:5

Th isC ourth a sdiv ersit

D efenda nta recit

Th isC ourth a spersona lj

Virg inia . P la int

C orona sP I I w a scom prom isedw h en h a ckersa ccessedSonysN et

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 6 of 45 Page ID #:6

forw a rd, P la int

com prom isedw h en h a ckersa ccessedSonysN et

spending ov er$300fora yea rof ident

h erself. Sh eh a sa lrea dyexpended10h oursa t

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 7 of 45 Page ID #:7

D efenda ntSonyP ict

org a nized undert

Specifica lly, on D ecem ber2, 2014, da t

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 8 of 45 Page ID #:8

num bers, birt

sev era ncepa cka g es, w a spost

sourcesh a dconfirm edt

Th efilesincludea M icrosoftExceldocum entt

em ployees;a nda filet

sea rch on L inkedI n fordozensof na m esin t

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 9 of 45 Page ID #:9

M ich a elL ynt

em a ilon D ecem ber3, 2014t

O n D ecem ber5, 2014, sourcesreport

B rea ch h a d lea kedev en m oreP I I t

em a ila ddresses, sa la ryinform a t

sev era lW orddocum ent

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 10 of 45 Page ID #:10

A lso on D ecem ber5, 2014, h a ckersw erereport

A sof D ecem ber8 , 2014, h a ckersh a drelea seda round140g ig a byt

M oreov er, B usinessI nsiderreport

senta secondcom pa ny-w idem em o t

LosA ng elesTim esreport

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 11 of 45 Page ID #:11

m a na g em entprog ra m m a kerL ieberm a n Soft

sev era lsecurit

includea num berof Sonyspriv a t

presidenta tVena fi, expla inedt

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 12 of 45 Page ID #:12

m ea nsof bypa ssing w h it

Case 2:14-cv-09600-RGK-SH Document 1 Filed 12/15/14 Page 13 of 45 Page ID #:13

Sonyh a sbeen a long st