Ashley Madison Amended Lawsuit

8/20/2019 Ashley Madison Amended Lawsuit

1/21

1

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF MISSISSIPPI

JACKSON DIVISION

JOHN DOES 1-21, PSEUDONYMS PLAINTIFFS

vs. CIVIL ACTION NO. 3:15-cv-00658-HTW-LRA

AVID LIFE MEDIA, INC., an Ontario Corporation,

and AVID DATING LIFE, INC., an Ontario Corporation

d/b/a ASHLEY MADISON DEFENDANTS

AMENDED COMPLAINT

BENCH TRIAL REQUESTED

Plaintiffs, JOHN DOES 1-21 bring this action against Defendants AVID LIFE MEDIA, INC.

and AVID DATING LIFE, INC. d/b/a Ashley Madison on behalf of themselves. Except as to their

own actions, Plaintiffs aver the following allegations upon information and belief of the investigation

of counsel and facts that are a matter of public record:

INTRODUCTION

1. Defendants operate a dating site under the ASHLEY MADISON trademark as

AshleyMadison.com. The Ashley Madison website, in operation since 2002, is designed to facilitate

discreet intimate adult relationships for individuals who are either married or are in committed

relationships. The website’s motto, prominently displayed on its site, is, “Life is short. Have an

affair.” The promise of secrecy, anonymity and privacy encourage the curious to engage with the

web site.

2. AshleyMadison.com targets individuals who reside in the United States, particularly

Mississippi, as well as outside the United States, encouraging them to engage in adulterous behavior

while assuring its users of its discretion. The website boasts a current membership of approximately

thirty-seven million users and is rated the twentieth most popular adult website in the United States.

Case 3:15-cv-00658-HTW-LRA Document 2 Filed 11/16/15 Page 1 of 21


2/21

2

The website has proven extraordinarily lucrative, yielding Defendants $115.5 million in revenue in

2014 alone.

3. The website stores personal and financial information of its users--login details,

mailing addresses, email addresses, telephone numbers, payment transaction details, credit card data,

and passwords. Importantly, very highly sensitive user profile data, such as photographs and sexual

fantasies, is also stored in the website.

4. In what can only be described as a nightmare for the users of the website

AshleyMadison.com, on or about July 20, 2015, the hacking collection Impact Team accessed and

downloaded the personal and financial data of approximately all thirty-seven million

AshleyMadison.com customers. Following this theft of information, the hackers threatened that if

Defendants did not shut down the website, they would release all customer information on the

Internet in a data dump.

5. On or about August 18, 2015, Impact Team made good on its promise, dumping 9.7

gigabytes worth of stolen and highly-sensitive personal and financial data-including user identity

information, their sexual fantasies and preferences, and personal and financial data belonging to the

website’s some thirty-seven million users. Reportedly, among the dumped data was data of

individuals who paid an additional fee of $19.00 to have AshleyMadison.com scrub their profiles from

the site, but whose profiles had apparently not been scrubbed.

6. Needless to say, this dumping of sensitive personal and financial information is bound

to have catastrophic effects on the lives of the website’s users.

JURISDICTION & VENUE

7. This Court has jurisdiction over this action pursuant to 28 U.S.C. § 1332. The

amount in controversy as to the Plaintiffs exceeds $75,000.00, exclusive of interest and costs, and



3/21

3

Defendants are incorporated and have their principal places of business outside the state in which the

Plaintiffs reside.

8. Venue in this District is appropriate on the basis that Plaintiffs reside within the

geographical boundaries of the United States District Court for the Southern District of Mississippi.

9. This Court has personal jurisdiction over the Defendants because the Defendants have:

a) intentionally availed themselves to this jurisdiction by marketing its website to

millions of consumers nationwide, including residents throughout Mississippi and this specific

District; and

b) directed tortious acts towards individuals residing within this District, and have

committed tortious acts they knew or should have known would cause injury to the Plaintiff.

PARTIES

10. Plaintiff John Doe 1 is an adult male resident of Madison County, Mississippi. John

Doe 1 created an account on AshleyMadison.com in 2010.

11. Plaintiff John Doe 2 is an adult male resident of Rankin County, Mississippi. John Doe

2 created an account on AshleyMadison.com in 2015 prior to the August 18, 2015, data dump.





14. Plaintiff John Doe 5 is an adult male resident of Lincoln County, Mississippi. John

Doe 5 created an account on AshleyMadison.com on 2014.


Doe 6 created an account on AshleyMadison.com on 2013.



4/21

4

16. Plaintiff John Doe 7 is an adult male resident of Jones County, Mississippi. John Doe

7, upon information and belief, created the account on AshleyMadison.com between 2010-2012.

17. Plaintiff John Doe 8 is an adult male resident of Rankin County, Mississippi. John Doe

8 created an account on AshleyMadison.com in 2015 prior to the August 18, 2015, data dump. 18.

Plaintiff John Doe 9 is an adult male resident of Hinds County, Mississippi. John Doe 9

created an account on AshleyMadison.com in 2014.


Doe 10, upon information and belief, created the account on AshleyMadison.com in the later part of

2013 or the early part of 2014.



21. Plaintiff John Doe 12 is an adult male resident of Harrison County, Mississippi. John


22. Plaintiff John Doe 13 is an adult male resident of Hinds County, Mississippi. John Doe

13 created an account on AshleyMadison.com in 2013.

23. Plaintiff John Doe 14 is an adult male resident of Hinds County, Mississippi. John Doe



Doe 15 created an account on AshleyMadison.com in 2015 prior to the August 18, 2015, data dump.



26. Plaintiff John Doe 17 is an adult male resident of Pike County, Mississippi. John Doe




5/21

5

27. Plaintiff John Doe 18 is an adult male resident of Neshoba County, Mississippi. John

Doe 18, upon information and belief, created the account on AshleyMadison.com between 2012-

2013.

28. Plaintiff John Doe 19 is an adult male resident of Baker County, Florida, currently.

John Doe 19 created an account on AshleyMadison.com in 2013, while he was an adult male resident

of Rankin County, Mississippi.


Doe 20 created an account on AshleyMadison.com approximately in 2008.


Doe 21, upon information and belief, created the account on AshleyMadison.com between 2012-

2013.

31. Defendant Avid Life Media, Inc. is a corporation organized and existing under the

laws of Ontario, Canada, with its principal place of business and headquarters in Toronto, Canada.

The corporation owns various companies in the business of operating online dating websites.

32. Defendant Avid Dating Life, Inc. d/b/a Ashley Madison, is a corporation organized

and existing under the laws of Ontario, Canada, with its principal place of business in Toronto,

Canada, and is regularly engaged in the business of operating online dating websites, including

AshleyMadison.com.



6/21

6

FACTS

A. Defendants and their Business

33. AshleyMadison.com is a dating website marketed to people who are married or in

committed relationships seeking to engage in adulterous behavior. AshleyMadison.com is owned by

Avid Life Media, a privately-held Canadian corporation founded by its CEO Noel Biderman, which

owns various companies that are in the business of operating online dating websites, including

CougarLife.com and EstablishedMen.com.

34. Defendants market AshleyMadison.com to consumers both within and without the

United States. The website has more than thirty-seven million users in forty six countries. It is rated

the twentieth most popular adult website in the United States. Defendants market the website through

television, radio, billboard, and internet advertisements, many of which include its founder and CEO

Noel Biderman as the website’s spokesperson.

35. The website’s business model is based on credits, which users purchase, as opposed to

paid subscriptions. In order to initiate a conversation with another user, one must pay five credits.

Users buy credits from the website and enter their credit or debit card information in order to pay for

the credits.

36. The website also offers to “scrub” or delete user profiles along with all personal

information from the website for an additional $19.00 charge.

B. AshleyMadison.com Stores Personal Information of Its Users in a

Unencrypted Format at the Database Level

37. In order to create an account on AshleyMadison.com, users are required to select a

username and password, personalize a greeting, indicate their location (by country), zip code, date of

birth, type of affair sought, (the options provided are short term, long term, cyber affair/erotic chat, or



7/21

7

other) height, weight, body type, ethnicity and email.

38. Below the box where users are asked to enter their email, the website promises: “This

email will never be shown or shared.”

39. The website also asks each user to upload a discrete photograph and offers options of

either placing a mask over the user’s eyes on the photo or blurring the photo.

40. In the “Manage Profile” section, users may enter information relating to “My Intimate

Desires,” “My Perfect Match” and “My Personal Interests” among other information.

41. Upon information and belief, Defendants store the users’ personal information

collected in an unencrypted format at the database level. Despite these security threats that may have

even been internally discovered by Defendants’ officers or directors, Defendants published on the

internet a statement calling itself “the last secure space on the Internet.”

C. Plaintiffs’ Creation of AshleyMadison.com Account and Security Breach

42. In or about 2010, Plaintiff John Doe 1 created an account with AshleyMadison.com.

As part of the process of creating his account, Plaintiff John Doe 1 created a user name and password

and entered his personal information into the website’s system, including photographs. Plaintiff

subsequently purchased credits and communicated with other members on the website. At least three

years ago, Plaintiff John Doe 1 ceased use of AshleyMadison.com, confessed the same to his spouse

and engaged in rebuilding the marriage and re-earning the trust of his spouse.

43. In or about 2015 prior to the August 18, 2015, data dump, Plaintiff John Doe 2

created an account on AshleyMadison.com. As part of the process of creating his account, Plaintiff

John Doe 2 created a user name and password and entered his personal information into the website’s

system, including photographs.

44. In or about 2014, Plaintiff John Doe 3 created an account on AshleyMadison.com. As



8/21

8

part of the process of creating his account, Plaintiff John Doe 3 created a user name and password

and entered his personal information into the website’s system, including photographs.



and entered his personal information into the website’s system.







48. Sometime between 2010-2012, Plaintiff John Doe 7 created an account on

AshleyMadison.com. As part of the process of creating his account, Plaintiff John Doe 7 created a

user name and password and entered his personal information into the website’s system.



John Doe 8 created a user name and password and entered his personal information into the website’s

system.




51. In the later part of 2013 or early part of 2014, Plaintiff John Doe 10 created an

account on AshleyMadison.com. As part of the process of creating his account, Plaintiff John Doe 10



9/21

9

created a user name and password and entered his personal information into the website’s system.

52. In or about 2014, Plaintiff John Doe 11 created an account on AshleyMadison.com.

As part of the process of creating his account, Plaintiff John Doe 11 created a user name and

password and entered his personal information into the website’s system, including photographs.












John Doe 15 created a user name and password and entered his personal information into the

website’s system.









10/21

10



user name and password and entered his personal information into the website’s system.

60. In or about 2013, Plaintiff John Doe 19 created an account of AshleyMadison.com.



61. In or about 2008, Plaintiff John Doe 20 created an account of AshleyMadison.com.


password and entered his personal information into the website’s system.



user name and password and entered his personal information into the website’s system, including

photographs.

63. As a result of Defendants’ failure to maintain adequate and reasonable security

measures to secure the data of the website’s users from being compromised, on or about July 20,

2015, Impact Team, a group of hackers, downloaded highly-sensitive personal, financial, and

identifying information of the website’s some thirty-seven million users.

64. On information and belief, among the data compromised and downloaded were

profiles of individuals who executed the option to scrub their user profiles and all associated data and

paid $19.00 to Defendants to do so, yet Defendants failed to actually scrub the data.

65. Following the breach and downloading of users’ personal and financial information,

Impact Team threatened that if Avid Life Media did not shut down the website permanently, they

would leak the information on the Internet. Avid Life Media refused to shut down the website, and on



11/21

11

or about August 18, 2015, Impact Team, in keeping with its threat, published some 9.7 gigabytes of

stolen personal information of the website users on the Internet.

66. Each and every John Doe Plaintiff was among those whose personal data was

compromised and made public by Impact Team.

67. This massive data breach could have been prevented had Defendants taken the

necessary and reasonable precautions to protect its users’ information by, for example, encrypting the

data entrusted to it by its users on a database level so that any information hacked and downloaded

appeared in encrypted format. Defendants were aware, or should have been aware, of the need to

secure users’ information, especially in light of the recent rise of massive security breaches on the

Internet and the fact that information contained on its servers is particularly sensitive.

68. Defendant failed to notify Plaintiffs of the breach in a timely manner after learning of

the breach and failed to take reasonable steps to inform Plaintiffs of the extent of the breach.

D. The Data Breach Harmed Plaintiffs

69. As a result of Defendants’ unfair, unreasonable, and inadequate data security, its users’

extremely personal and embarrassing information regarding users’ sexual interests or the fact that

users were seeking or had affairs, users’ addresses, phone numbers, email addresses, credit card or

other payment information, and/or birth dates, and photos are also now available on the World Wide

Web. For many of the website’s users, the publicity of this information has created and will continue

to create irreparable harm.

70. As a direct and proximate result of Defendants’ failure to take reasonable care and to

use industry standard measures to protect the personal and financial information placed in its care,

John Doe 1's spouse has moved out of the family home. While knowing of John Doe 1's years old

account, the public humiliation was too much for Plaintiff’s spouse.



12/21

12


use industry standard measures to protect the personal and financial information placed in its care, the

publicity and salacious nature of the publicity has imperiled John Doe 1's employment.



John Doe 2's wife has left the marriage, the relationship with minor child(ren) has suffered, John Doe

2's wife’s own business has suffered from the publicity and John Doe 2 has been the victim of

attempted blackmail by persons unknown.



John Doe 3's wife has left the marriage, his relationship with his child(ren) has been irreparably

harmed as well as the relationship with his own parents.



John Doe 4's wife has left the marriage, a promotion at work has been imperiled due to the publicity

and salacious nature of the publicity, which has also strained relations with his regular community.

John Doe 4 has been subjected to blackmailing emails from persons unknown.


use industry-standard measures to protect the personal and financial information placed in its care,

John Doe 5's wife has left the marriage, he has suffered substantial public humiliation and loss of long-

time friends.





13/21

13

John Doe 6 has been terminated from two places of employment, all personal relations have been

damaged, including with his spouse.



John Doe 7's employment has been threatened, he has been harassed, his relationship with his

child(ren) has been significantly harmed. John Doe 7 has been subjected to blackmailing emails from

persons unknown.



John Doe 8's wife has left the marriage, he receives harassing text messages, his minor child(ren)

is/are bullied at school, he has lost business clients and his community relationships have been

significantly harmed.



John Doe 9's wife has left the marriage, he is unable to participate in the daily life of his minor

child(ren), his business reputation has publicly suffered and he is under substantial scrutiny from his

employers and co-workers



John Doe 10's marital relations are substantially strained, he has lost clients as a result of the data

breach and publicity, his position in community affairs has been threatened and he has endured

substantial public ridicule and shame.




14/21

14


John Doe 11's marriage has been substantially damaged, his business and business reputation has been

substantially damaged, he has been the subject of public shaming and bullying, he has been sent

obscene objects in the mail with taunting notes and he has endured substantial public ridicule and

shame. John Doe 11 has been subjected to blackmailing emails from persons unknown.



John Doe 12's relationship with his minor child(ren) has been substantially impaired, his immediate

and extended family have been harassed by members of the public, his personal relationships have

been substantially impaired, his business and business relationships have been substantially impaired

and he has endured substantial public ridicule and shame.



John Doe 13's marriage has been substantially damaged, his relationship with his minor child(ren) has

been substantially damaged, he has been isolated outside his immediate and extended family, he has

had to change his business practices as a result of damage to his professional reputation and John Doe

13 has been subjected to blackmailing emails from persons unknown.



John Doe 14's marriage has been substantially damaged, his visitation with his minor child(ren) from a

former relationship has been arbitrarily reduced by his former wife, his business and business

reputation has been substantially damaged, he has become isolated from former relationships and

community activities and has endured public ridicule and shame. John Doe 14 has been subjected to



15/21

15

blackmailing emails from persons unknown.



John Doe 15's wife has left the marriage, he was terminated from his employment, losing his source of

income and attendant benefits, his child(ren) refuse to see him, his professional reputation has been

damaged, he has become isolated from former relationships and community activities and has endured

public ridicule and shame.



John Doe 16's wife has left the marriage, he has become isolated from former relationships and

community activities, has been subjected to blackmailing emails from persons unknown and endured




John Doe 17's romantic relationship with his partner has been severely damaged, his professional

business and reputation has been significantly harmed, his relationship with immediate and extended

family has been substantially harmed, he has become isolated from former relationships and

community activities, has been subjected to blackmailing emails from persons unknown and endured




John Doe 18's business and business reputation has substantially suffered, he has been subjected to

harassment by members of the public, his relationships with immediate and extended family has been



16/21

16

substantially harmed, he has become isolated from former relationships and community activities and

endured public ridicule and shame.


use industry standard measures to protect the person and financial information placed in it care, John

Doe 19’s wife has left the marriage and his health has suffered.



Doe 20’s relationship with his minor child(ren) has been substantially impaired, his personal

relationships have been substantially impaired as his significant other left the relationship, his business

relationships have been substantially impaired and he has become isolated from the community and

endured public ridicule and shame.



Doe 21’s marital relations are substantially strained, a promotion at work has been imperiled due to

the publicity and salacious nature of the publicity, has not been able to perform work duties due to the

shame and ridicule, general relationships have suffered, his position in the community has been

threatened and he has endured substantial public ridicule and shame. John Doe 21 has been subjected

to blackmailing emails from persons unknown.

92. Each of the John Doe Plaintiffs have suffered extreme emotional distress.

93. Additionally, as a direct and proximate result of Defendants’ failure to take reasonable

care and use industry standard measures to protect personal and financial information placed in their

care, Plaintiffs have had their personal and financial information stolen and released to the public,

causing direct and measurable monetary loses in the form of, inter alia, costs associated with the



17/21

17

detection and prevention of unauthorized use of personal information and costs associated with loss

of productivity from time to ameliorate the actual and future consequences of the breach.

FIRST CAUSE OF ACTION

NEGLIGENCE

94. By accepting Plaintiffs’ personal and financial information, Defendants assumed a duty

requiring them to use reasonable and industry standard of care to secure such information against

theft and misuse. Further, Defendants acknowledged and publicly embraced this duty by touting itself

as "the last secure space on the Internet," and assuring users of its privacy and discretion.

95. Defendants breached their duty of care by failing to timely disclose to Plaintiffs a

breach of security had occurred and their personal and financial information had been compromised,

or was reasonably believed to have been compromised.

96. Plaintiffs suffered injury in fact, including having highly-sensitive personal, financial,

and embarrassing information leaked to the public, and will continue to be injured and incur damages

as a result of Defendants’ negligence and misconduct.

97. Plaintiffs seek compensatory and punitive damages with interest, attorneys’ fees and

costs, and any other and further relief as this Court deems just and proper.

SECOND CAUSE OF ACTION

NEGLIGENT INFLICATION OF EMOTIONAL DISTRESS

98. Defendants had a duty to Plaintiffs to take reasonable care to protect and safeguard

Plaintiffs’ personal and financial information.

99. Defendants breached their duty when they failed to take reasonable precautions to

safeguard and protect Plaintiffs’ personal and financial information from collection and misuse.

100. As a direct and proximate result of Defendants’ negligence, hackers accessed and

collected Plaintiffs’ personal and financial information.



18/21

18

101. As a direct and proximate result of Defendants’ negligence, Plaintiffs suffered mental

anguish, disability, loss of capacity for the enjoyment of life, and expense of medical care and

treatment.

102. Plaintiffs seek compensatory damages with interest, attorneys’ fees and costs, and any

other and further relief as this Court deems just and proper.

THIRD CAUSE OF ACTION

INVASION OF PRIVACY-PUBLIC DISCLOSURE OF PRIVATE FACTS,

AND CONSTITUTIONAL RIGHT TO PRIVACY

103. Plaintiffs had reasonable expectations of privacy in the private information Defendants

mishandled.

104. By failing to keep Plaintiffs’ private information safe, and by misusing and/or

disclosing said information to unauthorized parties for unauthorized use, Defendants invaded

Plaintiffs’ privacy by:

a) allowing intrusion into Plaintiffs’ private affairs in a manner that would be

highly offensive to a reasonable person;

b) allowing publication of private facts about Plaintiffs, which is highly offensive

to a reasonable person; and

c) violating Plaintiffs’ right to privacy under the United States Constitution

through the improper use of Plaintiffs’ private personal and financial information, obtained for

a specific purpose, for another purpose or the disclosure of it to some third party.

105. Defendants knew, or acted with reckless disregard of the fact that, a reasonable person

in Plaintiffs’ position would consider Defendants’ actions highly offensive.

106. Defendants permitted invasion into Plaintiffs’ right to privacy and intruded into

Plaintiffs’ private affairs by allowing misuse and/or disclosure of Plaintiffs’ private information



19/21

19

without their informed, voluntary, affirmative and clear consent.

107. As a proximate result of such misuse and disclosures, Plaintiffs’ reasonable expectation

of privacy of their private information were unduly frustrated and thwarted, and they suffered a

serious invasion of protected private interests.

108. In failing to protect Plaintiffs’ private information, and in allowing misuse and/or

disclosure of that information, Defendants have acted in conscious disregard of Plaintiffs’ rights to

have such information kept confidential and private.

109. Plaintiffs therefore seek an award of damages and any such other and further relief as

this Court may deem just and appropriate.

FOURTH CAUSE OF ACTION

BREACH OF IMPLIED CONTRACT

110. When Plaintiffs provided their personal and financial information to

AshleyMadison.com in order to receive the website’s services, they entered into implied contracts

with Defendants pursuant to which Defendants agreement to safeguard and protect such information

from being compromised.

111. Defendants solicited and invited Plaintiffs to sign up with AshleyMadison.com and to

provide their personal and financial information. Plaintiffs accepted the website’s offer and provided

their personal information in order to sign up and, later, their financial information in order to

purchase credits.

112. Plaintiffs would not have provided and entrusted this financial and personal

information to Defendants in the absence of the implied contract between them.

113. Plaintiffs fully performed their obligations under the implied contracts with

Defendants.



20/21

20

114. Defendants breached the implied contracts it made with Plaintiffs by failing to

safeguard and protect their personal and financial information.

115. The losses and damages sustained by Plaintiffs as described herein were the direct and

proximate result of Defendants’ breaches of the implied contract between them and Plaintiffs.

116. Plaintiffs seek actual and compensatory damages, punitive damages, declaratory and

injunctive relief, and attorneys’ fees and costs, and any such other further relief as this Court may

deem just and appropriate.

FIFTH CAUSE OF ACTION

BAILMENT

117. Plaintiffs delivered and entrusted their private information to Defendants for the sole

purpose of receiving services from Defendants.

118. During the time of bailment, Defendants owed Plaintiffs a duty to safeguard this

information properly and maintain reasonable security procedures and practices to protect such

information. Defendants breached this duty.

119. As a result of this breach of duty, Plaintiffs have suffered harm.

120. Plaintiffs seek actual damages.

PRAYER FOR RELIEF

WHEREFORE, Plaintiffs request the following relief:

A. That the Court award Plaintiffs appropriate relief, to include actual, statutory and

punitive damages, disgorgement, restitution;

B. That the Court award Plaintiffs preliminary or other equitable or declaratory relief as

may be appropriate by way of applicable law;

C. Such additional orders or judgments as may be necessary to prevent these practices



21/21

21

and to restore to Plaintiffs any money or property which may have been acquired by means of

violations;

D. That the Court award Plaintiffs favorable relief as may be available and appropriate

under the law or at equity;

E. Pre- and Post-Judgment Interest;

F. Reasonable attorneys’ fees and costs; and

G. And such other, further and different relief as the Court may deem just and proper.

Respectfully submitted, this the 16th day of November, 2015

JOHN DOES 1-21, PSEUDONYMS

By: /s/ Allison P. Fry

Allison P. Fry (MS Bar No. 100725)

John Arthur Eaves Law Offices

101 North State Street

Jackson, MS 39201

(601) 355-7961

(601) 355-0530 – facsimile

[email protected]


Ashley Madison Amended Lawsuit

Documents

Transcript of Ashley Madison Amended Lawsuit