Ledger Shopify Complaint

Case 3:21-cv-02470-JSC Document 1 Filed 04/06/21 Page 1 of 43
1 Todd M. Schneider (SBN 158253) Kyle W. Roche (pro hac vice application
Jason H. Kim (SBN 220279) forthcoming)
2 Matthew S. Weiler (SBN 236052) Richard Cipolla (pro hac vice application
Kyle G. Bates (SBN 299114) forthcoming)
3 SCHNEIDER WALLACE Jolie Huang (pro hac vice application
4 COTTRELL KONECKY LLP forthcoming)
2000 Powell Street, Suite 1400 ROCHE FREEDMAN LLP
5 Emeryville, California 94608 99 Park Avenue, 19th Floor
Telephone: (415) 421-7100 New York, NY 10016
6 Email: tschneider@schneiderwallace.com Telephone: (646) 970-7509
Email: jkim@schneiderwallace.com Email: kyle@rcfllp.com
7
Email: mweiler@schneiderwallace.com Email: rcipolla@rcfllp.com
8 Email: kbates@schneiderwallace.com Email: jhuang@rcfllp.com
9 Velvel Freedman (pro hac vice

application forthcoming)
10 Constantine P. Economides (pro hac vice
application forthcoming)
11
ROCHE FREEDMAN LLP
12 200 South Biscayne Boulevard
Miami, FL 33131
13 Telephone: (305) 971-5943
Email: vel@rcfllp.com
14 Email: ceconomides@rcfllp.com
15
Counsel for Plaintiffs
16
17
UNITED STATES DISTRICT COURT
18 NORTHERN DISTRICT OF CALIFORNIA
19
20
JOHN CHU and EDWARD BATON, Individually
21 and on Behalf of All Others Similarly Situated,
No. ______________
22 Plaintiffs,
COMPLAINT
23 v.
CLASS ACTION
24 LEDGER SAS, LEDGER TECHNOLOGIES INC.,
SHOPIFY (USA) INC., and SHOPIFY INC., DEMAND FOR JURY TRIAL
25
Defendants.
26
27
28
CLASS ACTION COMPLAINT

1 Individually and on behalf of all others similarly situated, Plaintiffs John Chu (“Chu”) and
2 Edward Baton (“Baton”), (collectively, “Plaintiffs”), bring this Action against Defendants Ledger
3 SAS and Ledger Technologies Inc. (“Ledger Technologies”), (collectively, “Ledger”) and
4 Defendants Shopify Inc., and Shopify (USA) Inc. (“collectively, “Shopify”). Plaintiffs’ allegations
5 are based upon personal knowledge as to themselves and their own acts, and upon information and
6 belief as to all other matters based on the investigation conducted by and through Plaintiffs’
7 attorneys. Plaintiffs believe that substantial additional evidentiary support will exist for the
8 allegations set forth herein, after a reasonable opportunity for discovery.
9 I. INTRODUCTION
10 “We know security means never standing still.”

-Ledger.
11
12 1. Plaintiffs seek redress for the substantial, Class-wide damages that Ledger’s and
13 Shopify’s misconduct caused in connection with a massive 2020 data breach that those companies
14 negligently allowed, recklessly ignored, and then intentionally sought to cover up.
15 2. With Shopify assisting as its e-commerce vendor, Ledger purports to provide “the
16 highest level of security for crypto assets.” Its primary products are hardware wallets (“Ledger
17 wallets”) that store the “private keys” of an individual’s crypto-assets. These private keys are akin
18 to a bank-account password in that access to the private keys allows an individual to transfer one’s
19 crypto-assets. But unlike a bank-account transaction, crypto-asset transactions are non-reversible:
20 whoever gains access to the private keys associated with a crypto-asset can then transfer or spend
21 that asset with impunity. Ledger purports to provide owners of crypto-assets with the best security
22 to protect private keys from hackers and other bad actors.
23 3. Ledger thus knows that anonymity is necessary to protect against hacking attempts.
24 Crypto-asset transactions are publicly visible on the underlying blockchain, but nefarious actors
25 cannot identify the owner of particular crypto-assets based solely on public information. Without
26 personally identifying information, hackers face an immense obstacle to targeting an individual’s
27 crypto-assets. Conversely, when a hacker knows the identity of a crypto-asset owner, the hacker can
28 construct a workable attack catered to a target.

2
1 4. Consequently, to the world of hackers, Ledger’s customer list is gold. It is a list of
2 people who have converted substantial wealth into anonymized crypto-assets that are transferrable
3 without a trace. Using that list, hackers can manipulate or compel those owners to make untraceable
4 and irreversible transfers of the crypto-assets into the hackers’ accounts. The stakes of security for
5 crypto-assets are thus enormous. With anonymity, owning a Ledger wallet is a cutting-edge method
6 of securing crypto-assets. But without anonymity, owning a Ledger device simply creates a target
7 for attackers.
8 5. Ledger understands these realities and purports to account for them. As Ledger
9 claims in its advertising: “If you don’t want to get hacked, get a Ledger wallet.” Over the past year,
10 however, Ledger repeatedly and profoundly failed to protect its customers’ identities, causing
11 targeted attacks on thousands of its customers’ crypto-assets and causing Class members to receive
12 far less security than they thought they purchased when they purchased a Ledger wallet.
13 6. In mid-2020, between April and June, hackers found and exploited a database
14 vulnerability at Ledger and its e-commerce vendor, Shopify, to obtain a list of Ledger’s customers,
15 as well as email addresses and other contact information. By June 2020, Ledger’s customer list had
16 made its way onto the internet’s black market, making Ledger wallet owners vulnerable.
17 7. The circumstances grew much worse over the next six months. From June 2020
18 through December 2020, at least one of the hackers who had acquired the data published it online,
19 providing over 270,000 names, physical addresses, phone numbers, and order information to every
20 hacker in the world. As a direct result, the attacks on Ledger’s customers grew exponentially, with
21 customers losing money, facing threats of physical violence, and even feeling vulnerable in their
22 own homes. Indeed, using the customer shipping addresses that Ledger and Shopify had failed to
23 protect, hackers threatened to enter the homes of and attack Ledger customers unless those
24 customers made untraceable ransom payments.
25 8. In the face of these obviously emergent circumstances, rather than acting to protect
26 its customers, Ledger stood still. It did not even inform its customers of the breach. Instead, it
27 initially denied that any breach had occurred and continued to claim its products provided the best
28

3
1 possible protection for crypto-assets. As the customer list began to spread on the dark web, Ledger
2 admitted the existence of the breach but nevertheless disputed its publicly-reported scope.
3 9. By December 21, 2020, however, Ledger could no longer cover up the data breach.
4 On that day, the hacked customer list was posted publicly and became widely available. In a message
5 posted on its website from its CEO, Ledger admitted to the scope of the attack, stating that the
6 company “very deeply regret[s] this situation.” Ledger’s CEO further acknowledged that, as a result
7 of the hack, “many [Ledger customers] have been targeted by e-mail and SMS phishing campaigns
8 and that it’s clearly a nuisance.”
9 10. Ledger’s and Shopify’s misconduct has made targets of Ledger customers, with their
10 identities known or available to every hacker in the world. Ledger’s persistently deficient response
11 compounded the harm. In failing to individually notify every affected customer or admit to the full
12 scope of the breach, Ledger left customers unaware of the data breaches and concomitant hacking
13 risks. The natural and foreseeable result was that many customers fell victim to hackers’ phishing
14 emails disguised as emails from Ledger.
15 11. Ledger customers would not have purchased Ledger wallets at all, or would not have
16 paid as much as they did for Ledger wallets, had they known of Ledger’s lax security practices and
17 unwillingness to promptly and completely disclose data breaches.
18 12. Plaintiffs seek to redress Defendants’ misconduct, occurring from April 1, 2020, to
19 the present (the “Class Period”), under state common law and consumer-protection statutes on
20 behalf of the Class and several Subclasses of Ledger customers affected by the data breach described
21 herein.
22 II. PARTIES
23 Plaintiffs
24 13. Plaintiff John Chu is a resident of Georgia. He purchased and/or utilized devices
25 and/or services from Ledger.

26 14. Plaintiff Edward Baton is a resident of Georgia. He purchased and/or utilized devices
27 and/or services from Ledger.

28

4
1 Defendants
2 15. Defendant Ledger SAS is a French simplified joint-stock company headquartered in
3 Paris, France.
4 16. Defendant Ledger Technologies Inc. is a wholly-owned subsidiary of Ledger SAS.
5 It is incorporated in Delaware, registered to do business in California, and, at the time of the breach,
6 was headquartered in San Francisco, California and has a substantial office at 121 2nd St #4, San
7 Francisco, California 94105.
8 17. Defendant Shopify Inc. is a Canadian Corporation with offices at 151 O’Connor
9 Street, Ground floor, Ottawa, Ontario, K2P 2L8.

10 18. Defendant Shopify (USA) Inc. is a Delaware corporation and registered to do
11 business in California. Up until a week before it announced the data breach, its principal place of
12 business was in San Francisco, California. It now lists Ottawa, Canada as its principal place of
13 business. It is a wholly-owned subsidiary of Shopify Inc.
14 III. JURISDICTION AND VENUE
15 19. Jurisdiction of this Court is founded upon 28 U.S.C. § 1332(d) because the matter in
16 controversy exceeds the value of $5,000,000, exclusive of interests and costs, there are more than
17 100 class members, and the matter is a class action in which any member of a class of plaintiffs is a
18 citizen of a state different from any defendant.
19 20. This Court has personal jurisdiction over all parties.
20 21. Shopify (USA) Inc. is registered to do business in California, and for the vast-
21 majority of the relevant time period, listed a California address as its principal place of business.
22 22. Similarly, Ledger Technologies is registered to do business in California has a
23 substantial office at 121 2nd St #4, San Francisco, California 94105.

24 23. Ledger SAS dominates and controls Ledger Technologies’ internal affairs and daily
25 operations. Not only is Ledger Technologies a wholly-owned subsidiary of Ledger SAS, but there
26 is substantial overlap among their executives. For example, the Chief Executive Officer (“CEO”) of
27 Ledger Technologies is Pascal Gauthier, who is also the Chairman and CEO of Ledger SAS. Ledger
28 Technologies’ secretary is listed as Antione Thibault, who is the general counsel of Ledger SAS.

5
1 Ledger Technologies’ Chief Financial Officer (“CFO”) is the CFO of Ledger SAS. Though Ledger
2 SAS is not registered to do business in California, it boasts that it has employees in “Paris, Vierzon,
3 and San Francisco” without differentiating between the two entities.
4 24. Shopify Inc. dominates and controls Shopify (USA) Inc.’s internal affairs and daily
5 operations. Not only is Shopify (USA) a wholly-owned subsidiary of Shopify, but as in Ledger’s
6 case, there is a substantial overlap among its executives. Shopify (USA)’s CEO and CFO is Amy
7 Shapero—the CFO of Shopify. The Secretary of Shopify (USA) is Shopify’s Chief Legal Officer.
8 In addition, Shopify’s job listings notes that it will “hire you [ ] anywhere” as long as it has “an
9 entity where you are.” That is, Shopify does not differentiate between its entities for any job
10 responsibilities and thus does substantial business through the American employees it hires through
11 its subsidiary formerly located in California.
12 25. This Court also has personal jurisdiction over Shopify and Shopify (USA) because
13 they solicit customers and transact business in California, including with Ledger and those who
14 purchased products or services from Ledger.
15 26. This Court also has personal jurisdiction over Ledger and Ledger Technologies
16 because they solicit customers, including Plaintiffs and Class members, in the United States and
17 California. In fact, 33% of the compromised two hundred and seventy-three thousand accounts with
18 address information belonged to Class members with U.S. addresses. This Court also has personal
19 jurisdiction over Ledger and Ledger Technologies because Shopify (USA) acted as those entities’
20 agent for the conduct giving rise to Plaintiffs’ claims. With respect to the breached data of Ledger’s
21 customers, the responses to the breaches, and the conduct giving rise to Plaintiffs’ causes of action,
22 Ledger had the right to control the conduct of Shopify, which acted as Ledger’s agent and was
23 authorized to act on Ledger’s behalf with respect to Ledger’s customers.
24 IV. FACTUAL ALLEGATIONS
25 A. Bitcoin and Crypto-Assets
26 27. A crypto-asset is a digital asset designed to work as a medium of exchange or a store
27 of value or both. Crypto-assets leverage a variety of cryptographic principles to secure transactions,

28 control the creation of additional units, and verify the transfer of the underlying digital assets.

6
1 28. Bitcoin was the world’s first decentralized crypto-asset. It is also the largest and most
2 popular crypto-asset, with a market capitalization of approximately $1.08 billion. Bitcoin spawned
3 a market of other crypto-assets that, together with Bitcoin, have a current market capitalization of
4 approximately $1.94 trillion. (The term “bitcoin” can refer to both a computer protocol and a unit
5 of exchange. Accepted practice is to use the term “Bitcoin” to label the protocol and software, and
6 the term “bitcoin” to label the units of exchange.)
7 29. At its core, Bitcoin is a ledger of addresses and transfer amounts that tracks the
8 ownership and transfer of every bitcoin in existence. This ledger is called the blockchain. The
9 blockchain is completely public.
10 30. Blockchains act as the central technical commonality across most crypto-assets.
11 While each blockchain may be subject to different technical rules and permissions based on the
12 preferences of its creators, they are typically designed to achieve the similar goal of decentralization.
13 31. In April 2013, there were only seven crypto-assets listed on coinmarketcap.com, a
14 popular website that tracks the crypto-asset markets. As of this filing, the site monitors more than
15 9,112 crypto-assets.
16 1. Transacting with Bitcoin and Blockchain Addresses
17 32. Because all blockchain addresses and transfers are public, the way to verify
18 ownership of an address is through the use of public and private keys.
19 33. Each address has one public key and one private key associated with it. With the
20 private key, one can control the address and can move bitcoin in or out of the account. The public
21 key is more like a digital signature that is used to verify ownership and transfers of funds. The
22 blockchain address, public key, and private key are often mathematically related to one another.
23 34. The private key is, however, the only mechanism that allows for the transfer of
24 crypto-asset. With the private key—and nothing more—a person can implement an untraceable
25 transfer of the crypto-asset from one digital address to another. Without the private key, the crypto-
26 asset can never be transferred. In other words, anyone with the private key has total control over
27 the funds. Thus, to safeguard crypto-assets, one must keep the private key private.
28

7
1 2. Security and Crypto-Assets
2 35. It is the cryptographic principals behind the use of public and private keys that give
3 crypto-assets their name. Cryptography is at the heart of blockchain transactions, and security is
4 one of the chief advantages and selling points of the technology.
5 36. Nonetheless, since the inception of crypto-assets, there have been high-profile hacks
6 to steal them. One of the first large Bitcoin exchanges (handling over 70% of all Bitcoin transactions
7 at the time) lost a staggering 850,000 bitcoins to theft, with a value exceeding $49 billion USD
8 today.
9 37. It has been estimated that over $4 billion crypto-assets were lost to theft and related
10 crimes in 2019.1 That risk of theft continues today.

11 38. Because it is nearly impossible to guess a user’s private key, hackers employ various
12 methods to gain access to private keys. Once a hacker obtains the private key for an address, the
13 hacker controls its funds. Unlike traditional accounts housed at banks, there are no approvals or
14 fraud monitoring warnings for moving crypto-assets out of an account. Moreover, any transfer is
15 effectively untraceable and irreversible, leaving the recipient immune from identification or claw-
16 back.
17 39. Given this constant threat of theft, security over an individual’s private keys is
18 paramount.
19 B. Ledger and Hardware Wallets
20 40. Ledger offers solutions to consumers to keep their crypto-assets safe. Ledger’s main
21 product offerings are “hardware wallets.” These are physical consumer items that appear similar to
22 a USB storage device. This is an example of a Ledger hardware wallet:
23
24
25
26 1
Jeb Su, Hackers Stole Over $4 Billion From Crypto Crimes In 2019 So Far, Up From $1.7 Billion
27 In All Of 2018, FORBES (Aug. 15, 2019, 01:49 PM EDT),
https://www.forbes.com/sites/jeanbaptiste/2019/08/15/hackers-stole-over-4-billion-from-crypto-
28 crimes-in-2019-so-far-up-from-1-7-billion-in-all-of-2018/?sh=42ef46855f58.

8
1
2
3
4
5
6
7
8
9
10 41. Despite being named a “wallet,” such wallets do not “hold” cryptocurrency in the
11 way a traditional wallet stores cash. Rather, consumers store their private keys on these physical
12 devices, which are never connected to the internet (at least in the case of Ledger’s products).
13 42. The wallet itself can be accessed only by entering a PIN. Simply misplacing the
14 wallet thus poses no risk of theft. Ledger offers for sale two types of hardware wallets: the Ledger
15 Nano S and the Ledger Nano X.
16 43. Ledger also produces “Ledger Live,” a software product designed to interact with
17 devices. This screenshot shows its core functionality, in that a user can use the software to buy, sell,
18 send, and receive various crypto-assets:
19
20
21
22
23
24
25
26
27
28

9
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15 44. Ledger has been highly successful selling these devices and services. Having raised
16 $88 million in funding, it is one of the market leaders for crypto-asset security.
17 1. Hacking Hardware Wallets
18 45. Users of hardware wallets generally face discrete risks of theft by hacking because
19 private keys exist only where the owners store them. If an owner stores the private keys only on a
20 hardware wallet with no internet connectivity—and not on a personal computer—then traditional
21 hacking cannot reveal those private keys. Instead, the main sources of risk are: (1) “phishing” attacks
22 to trick a user into revealing the private PIN to their hardware wallet; or (2) physical intimidation
23 that forces users into paying money or revealing that information to a hacker.
24 46. Phishing is the practice of purporting to be a legitimate institution and contacting
25 targets with the goal of soliciting passwords, banking information, or other sensitive information.
26 Common examples of this practice include mass spam emails sent to mimic the look and feel of a
27 banking website. The email recipient receives the email, believes she needs to link to the account to
28 update information, clicks a link in the email that goes to a sham website made to look like the real

10
1 bank website, and enters real login information into the sham website. The owners of the sham
2 website then possess that victim’s real banking login and password.
3 47. Internet users are becoming more and more savvy to phishing, however, requiring
4 hackers to craft attacks that are increasingly realistic and personalized and less reliant on large-scale
5 mass efforts.
6 48. Phishing attacks are also generally harder to accomplish against Ledger users, who
7 are typically more skeptical and security conscious and, in turn, savvier to phishing practices. For
8 example, Ledger users will commonly create special email addresses used just for interacting with
9 accounts that manage their crypto assets. And Ledger users will often have a separate dedicated
10 phone number to use for dual-factor authentication when interacting with their crypto assets.2 These
11 dedicated email addresses and phone numbers add another layer of protection to avoid phishing
12 attacks. Users know that crypto-asset-related emails, texts, or calls to any “main” email address or
13 phone number are illegitimate.
14 49. Similarly, using a separate phone number can protect users from other attacks, such
15 as SIM swap attacks.3 A SIM swap attack occurs when an attacker gains control of an individual’s
16 phone number by convincing the individual’s mobile carrier to switch it to a new SIM card—one
17 that the attacker possesses. Once attackers gain control of that phone number, they can then bypass
18 dual-factor authentication requirements.
19 50. Plaintiffs—who have professional backgrounds, including in technology—were as
20 savvy as anyone buying crypto assets and hardware wallets as far back as 2017. Accordingly, in
21 addition to buying multiple Ledger products for storing their crypto assets, Plaintiffs took other
22 precautions. Plaintiff Baton, for example, acquired a separate mobile phone and always interacted
23
24
25
2
Dual authentication is a method in which a user is granted access to some system or device only
26 after successfully presenting two or more pieces of evidence of rightful access, such as unique
knowledge (e.g., a password) or unique possession (e.g., a key).
27
3
SIM stands for “subscriber identification module,” and a SIM card is a physical circuit that is used
28 to securely store the unique identifier of any user on a cellular network.

11
1 with crypto assets using a virtual private network to encrypt communications and shield his IP
2 address.
3 51. As to physical intimidation, even the savviest internet user cannot insulate himself
4 from such threats. A hacker can contact an owner of crypto-assets and threaten the owner with
5 physical violence unless an effective ransom is paid (usually in the form of an untraceable transfer
6 of crypto-assets transfer to the hacker). These threats are rare. Without knowing an owner’s home
7 address, physical location, or even phone number, a hacker would have difficulty making a credible
8 threat prompting payment from the victim. And hackers cannot identify viable targets by simply
9 looking up publicly listed names, phone numbers, and addresses. Crypto-assets have not yet been
10 widely adopted; therefore, attackers have no way of knowing whether would-be targets own crypto-
11 assets or hardware wallets. In addition, for owners of crypto-assets, there is no analog for the
12 physical bank ATM—where would-be attackers could potentially wait, identify victims with funds,
13 and intimidate those victims.
14 52. For these reasons, the single greatest point of vulnerability for owners of Ledger
15 wallets is public disclosure of the information that a particular person owns the wallet. If hackers
16 know the names and/or email addresses of people who own Ledger wallets, then hackers can target
17 those people with sophisticated phishing schemes and tailored threats.
18 53. Accordingly, by operating in the crypto-asset security space, Ledger places itself
19 between user’s funds and would-be hackers. The anonymity of its customer list is a key and obvious
20 element of the security that Ledger offers. By analogy, a manufacturer of state-of-the-art lock safes
21 would not publish its customer list, which is valuable to would-be thieves seeking to identify targets
22 possessing high-value items. Similarly, public disclosure of Ledger’s customers puts those
23 individuals in the crosshairs of the very hackers the company seeks to impede.
24 2. Ledger Advertises State-of-the-Art Security for Crypto-Assets
25 54. Ledger’s consistent message to consumers is that Ledger wallets offer the best
26 possible protection for crypto-assets. Their tagline embodies this value proposition: “If you don’t
27 want to get hacked, get a Ledger wallet.” Ledger represented to consumers, prior to the data breach
28 at issue, the following:

12
1 Critical digital assets are the new oil and securing them is the most
important challenge for the coming years.
2
That’s where we come in. We are Ledger.
3
We are a unique digital security ecosystem that provides protection
4 and is built on verifiable trust across our people, hardware and
software. And in today’s world, we know that trust deserves proof.
5 This is why we provide transparency into how our technology works.
6 We relentlessly stress-test our own technology solutions. Our Ledger

Donjon team is made up of world-class experts with extensive
7 backgrounds in the security and smartcard industries. They
continuously look for vulnerabilities on Ledger products as well as
8 our providers’ products in an effort to analyze and improve the
security. We know security means never standing still.
9
(emphasis added).
10
55. Ledger further and publicly asserted, prior to the data breach at issue:
11
 “At Ledger we are developing hardware wallet technology that
12 provides the highest level of security for crypto assets;”
13
 “Ledger hardware wallet, combined with the Ledger Live application,
14 is the best solution to secure and control your crypto assets;”
15  “Ledger hardware wallets are designed with the highest security

standard to keep your crypto secure at all time;”
16
 “Ledger enables resilience through verifiable trust. Knowing trust is
17
the greatest way to make our world truly move forward and progress.”
18
56. Ledger also republished, prior to the data breach at issue, acknowledgments from
19
reputable third-party commentators:
20
 “French Crypto Wallet Ledger Is Solving Bitcoin’s Biggest Flaw” (as
21 featured in Forbes);
22
 “Ledger makes sure private keys never become accessible to thieves,
23 online or anywhere else” (as featured in Bloomberg);
24  “Ledger removes the risk of being hacked” (as featured on CNBC).

25
57. Through those statements, Ledger conveyed to consumers that Ledger wallets,
26
coupled with Ledger’s services, provide the highest standard of security for owners of crypto-assets.
27
Ledger further conveyed that it was tirelessly assessing its wallets and supporting services for
28

13
1 vulnerabilities, while adapting to protect against those threats. By buying a Ledger wallet,
2 consumers purportedly were buying into a comprehensive security support system that maximized
3 protections against threats to crypto-assets.
4 58. Making the forgoing, unequivocal representations, Ledger sold Class members the
5 Ledger Nano X wallet for $119 and the Ledger Nano S wallet for $59. Class members would not
6 have purchased these products at all, or would have paid significantly less for them, had they known
7 of Ledger’s lax security practices and unwillingness to promptly and completely disclose data
8 breaches.
9 3. Ledger Uses Shopify as an E-commerce Vendor
10 59. Ledger sells its Nano products through a number of distributors, including retailers
11 like Amazon and Walmart. It also sells directly to consumers through https://shop.ledger.com/ (the
12 “Shopping Website”).
13 60. Shopify powers Ledger’s Shopping Website. Shopify is an e-commerce giant. Over
14 one million businesses use its platform, and over $61 billion of sales occurred on its platform
15 through these businesses in 2019. It is the largest publicly-traded company in Canada.
16 61. Shopify’s success is based on providing services to allow companies to easily
17 operate online stores. Shopify provides e-commerce solutions for businesses to allow them to easily
18 create digital storefronts. For example, Shopify allows you to create a well-designed web layout,
19 provides a payment provider to accept credit card payments, and makes various profit and inventory
20 applications available. These solutions are essentially a software product that companies subscribe
21 to in order to host digital stores.
22 62. When users purchase directly from Ledger on its Shopping Website, they must
23 provide certain personal information before placing an order, such as their physical address, phone
24 number, and email address. Because Ledger uses Shopify’s services, Shopify acts as an intermediary
25 between Ledger and purchasers of Ledger’s products. Therefore, Shopify also has access to the
26 personal information that purchasers provide.
27
28

14
1 63. Shopify’s terms of service obligate it to “take all reasonable steps” to protect the
2 disclosure of confidential information, including “names, addresses and other information regarding
3 customers and prospective customers.”
4 C. The Ledger Data Breach
5 64. In mid-2020, between April and June, certain Shopify employees took advantage of
6 Shopify’s access to the personal information of Ledger’s customers and acquired and exported
7 Ledger’s customer transactional records (the “Data Breach”). The Shopify employees also obtained
8 data relating to other merchants.
9 65. On September 22, 2020, Shopify announced that: (1) “two rogue members of our
10 support team were engaged in a scheme to obtain customer transactional records of certain
11 merchants;” (2) the “incident involv[ed] the data of less than 200 merchants;” and (3) “Our teams
12 have been in close communication with affected merchants to help them navigate this issue and
13 address any of their concerns.” This announcement made it clear that Shopify was aware of the data
14 breach before the day of the announcement and even had time to “conduct an investigation” and
15 notify affected merchants. On information and belief, Shopify knew of the data breach more than
16 one week before.
17 66. On information and belief, those rogue employees were located in America, as
18 immediately after noting that the employees’ access was terminated, Shopify’s statement
19 highlighted its compliance with American (rather than Canadian) legal authorities in stating that it
20 was “currently working with the FBI and other international agencies.” To the extent these
21 employees were American, they were most probably employed by its California office.
22 67. The Data Breach in fact involved the data of approximately 272,000 people,4
23 approximately a third of whom live in the United States.5 Hackers copied information such as names,
24
4
25 E-commerce and Marketing data breach – FAQ, LEDGER, https://support.ledger.com/hc/en-
us/articles/360015559320-E-commerce-and-Marketing-data-breach-FAQ (last visited Apr. 5,
26 2021).
5
27 Larry Cermak, A detailed look at the Ledger data leak and other recent incidents, THE BLOCK
(Dec. 21, 2020, 9:49 AM EST), https://www.theblockcrypto.com/genesis/88706/a-detailed-look-
28 at-the-ledger-data-leak-and-other-recent-incidents.

15
1 order details, email addresses, physical addresses, and phone numbers.6 And for many more users,
2 hackers obtained the email address users used when buying their Ledger.7
3 68. By the time it publicly announced the breach, Shopify notified every affected
4 merchant that rogue employees had stolen their data, but neither Shopify nor Ledger warned the
5 hundreds of thousands of vulnerable Ledger customers harmed by the Data Breach. Instead, as the
6 timeline below explains, Ledger attempted to cover up and downplay the scale of the Data Breach.
7 1. April – June 2020: Ledger Initially Denies the Data Breach
8 69. In May 2020, public rumors arose concerning the Data Breach. The rumors were that
9 Ledger’s consumer information from Shopify had been hacked.8

10 70. This publicly-stated concern was an opportunity for Ledger to get ahead of the
11 problem. Ledger should have, at a minimum: (1) disclosed the breach; (2) notified all impacted and
12 potentially impacted users; (3) offered services to help impacted users transition to new accounts;
13 (4) monitored for suspicious transactions; (5) hired third-party auditors to conduct security testing;
14 (6) trained employees to identify and contain similar breaches; and (7) trained and educated their
15 users about the threats they faced.
16 71. Instead, Ledger’s immediate reaction was to deny that there was a breach impacting
17 Ledger’s customers. Ledger stated that “Rumors pretend our Shopify database has been hacked
18 through a Shopify exploit. Our e-commerce team is currently checking these allegations by
19 analyzing the so-called hacked [database], and so far it doesn’t match our real [database]. We
20
21
22 6
Id.
7
23 Id.
8
24 Jamie Redman, Hacker Attempts to Sell Data Allegedly Tied to Ledger, Trezor, Bnktothefuture
Customers, BITCOIN (May 24, 2020), https://news.bitcoin.com/hacker-attempts-to-sell-data-
25 allegedly-tied-to-ledger-trezor-bnktothefuture-customers/.
26 @UnderTheBreach, TWITTER (May 24, 2020, 03:39 AM)
https://twitter.com/underthebreach/status/1264460979322138628?ref_src=twsrc%5Etfw%7Ctwca
27 mp%5Etweetembed%7Ctwterm%5E1264460979322138628%7Ctwgr%5E%7Ctwcon%5Es1_&re
f_url=https%3A%2F%2Fnews.bitcoin.com%2Fhacker-attempts-to-sell-data-allegedly-tied-to-
28 ledger-trezor-bnktothefuture-customers%2F.

16
1 continue investigations and are taking the matter seriously.”9 During this time, the risks and damages
2 to Ledger’s customers were only increasing; a prompt and proper response from Ledger, including
3 full disclosure to all customers, would have mitigated those risks and damages.
4 2. July 2020: Ledger Admits the Data Breach Occurred, but Downplays Its Scale
5 72. On July 29, 2020, Ledger made partial admissions that exacerbated, rather than
6 mitigated, the harm caused by the Data Breach.

7 73. After researchers informed Ledger of a potential data breach on its website, Ledger
8 announced that its marketing and e-commerce database had been exposed in June 2020:
9
What happened
10 On the 14th of July 2020, a researcher participating in our bounty
program made us aware of a potential data breach on the Ledger
11 website. We immediately fixed this breach after receiving the
researcher’s report and underwent an internal investigation. A week
12 after patching the breach, we discovered it had been further exploited
on the 25th of June 2020, by an unauthorized third party who accessed
13 our e-commerce and marketing database – used to send order
confirmations and promotional emails – consisting mostly of email
14 addresses, but with a subset including also contact and order details
such as first and last name, postal address, email address and phone
15 number. Your payment information and crypto funds are safe.
16 To be as transparent as possible, we want to explain what happened.

An unauthorized third party had access to a portion of our e-
17 commerce and marketing database through an API Key. The API key
has been deactivated and is no longer accessible.
18
What personal information was involved?
19 Contact and order details were involved. This is mostly the email
address of our customers, approximately 1M addresses. Further to
20 investigating the situation we have also been able to establish that, for
a subset of 9500 customers were also exposed, such as first and last
21 name, postal address, phone number or ordered products. Due to the
scope of this breach and our commitment to our customers, we have
22 decided to inform all of our customers about this situation.
23 Those 9500 customers whose detailed personal information are

exposed will receive a dedicated email today to share more details.
24
Regarding your ecommerce data, no payment information, no
25 credentials (passwords), were concerned by this data breach. It
solely affected our customers’ contact details.
26
27
9
@Ledger, TWITTER (May 24, 2020 06:39 AM),
28 https://twitter.com/Ledger/status/1264506360735174657.

17
1 This data breach has no link and no impact whatsoever with our
hardware wallets nor Ledger Live security and your crypto
2 assets, which are safe and have never been in peril. You are the
only one in control and able to access this information.
3
(emphasis in original).
4
5 74. Ledger’s disclosure and responsive measures were flawed and misleading.
6 75. First, as Ledger admitted, it failed to immediately warn its customers and instead
7 waited on the results of its “internal investigation with third party experts before warning [its]
8 community.”10 This delay in issuing even a warning was reckless, or at least negligent.
9 76. Second, Ledger did not disclose that this breach had anything to do with the Shopify
10 breaches, which involved insiders stealing information for personal profit. Ledger never even
11 mentioned Shopify. This incomplete disclosure was reckless, or at least negligent.
12 77. Third, Ledger was not clear as to the status and dissemination of the stolen data.
13 Ledger explained that “[w]e are actively monitoring for evidence of the database being sold on the
14 internet, and have found none thus far.” Ledger also explained that they “immediately fixed this
15 breach” and were undertaking an “internal investigation,” choosing to eschew third party auditors.
16 Ledger also took pains to repeatedly reiterate to consumers that the breach had “no impact
17 whatsoever with our hardware wallets nor Ledger Live security and your crypto assets.” In other
18 words, Ledger’s message was that, after an exhaustive internal investigation, they had identified a
19 limited hack and had rectified the situation. This patently inaccurate disclosure was reckless, or at
20 least negligent.
21 78. Fourth, Ledger sent follow-up notifications only to the 9,500 customers whom they
22 determined had additional personal information exposed. In doing so, Ledger failed to notify its one
23 million other customers whose email information had been exposed. This patently incomplete
24 follow-up was reckless, or at least negligent.
25
26
10
27 Addressing the July 2020 e-commerce and marketing data breach — A Message From Ledger’s
Leadership, LEDGER (July 29, 2020), https://www.ledger.com/addressing-the-july-2020-e-
28 commerce-and-marketing-data-breach.

18
1 3. August – December 2020: Hacking Attacks Increase on Ledger Users
2 79. By the fall of 2020, Ledger and Shopify were still failing to respond appropriately to
3 the severe threats that customers faced or to the damages they had incurred. Ledger still had not
4 disclosed that its customers had any connection to the Shopify breaches. It had not contacted every
5 customer whose email address had been exposed to hackers. It had not provided sufficient
6 disclosures or resources to assist customers in protecting against rising phishing schemes.
7 Meanwhile, several media reports signaled that Ledger’s customers were under attack as a result of
8 the Data Breach.
9 80. In October 2020, for example, a Ledger user reported a phishing attempt by hackers
10 posing as Ledger Support team members and asking Ledger customers to download fake versions
11 of the Ledger Live software. The fake email looked very convincing:
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

19
1 81. Other Ledger users responded to the report by confirming that they had received and
2 been tricked by the fake email. One user reported: “Wow this looked really legit, so much so I used
3 Contact Us form to ask Ledger if it was real. I am normally pretty good at sniffing things like this
4 out – this was by far the most convincing attempt I have ever seen.”11
5 82. The hackers behind this fake email were of course armed with Ledger’s customer
6 lists and email addresses and, therefore, knew they were targeting Ledger owners. Accordingly, the
7 hackers invested the time and resources to create such a convincing—and, unfortunately,
8 successful—fake. Worse yet, because of Ledger’s false and misleading statements and omissions
9 regarding the Data Breach, Ledger’s customers did not know that their email had been
10 compromised. Ledger thus deprived them of the opportunity to increase their wariness and/or take
11 other precautions to avoid such hacking.
12 83. The phishing attempts were not limited to emails. Ledger users began to report the
13 receipt of SMS/text phishing messages, again claiming to be from Ledger, such as the below:
14
15
16
17
18
19
20
21
22
23
24
25
26
11
27 Benjamin Powers, ‘Convincing’ Phishing Attack Targets Ledger Hardware Wallet Users,
COINDESK (Oct. 27, 2020, 04:13 PM EDT, updated Nov. 2, 2020, 02:56 PM EST),
28 https://www.coindesk.com/phishing-attack-ledger-cryptocurrency-wallet.

20
1
2
3
4
5
6
7
8
9
10
11
12
13
14 84. Other hackers used a different phishing attempt, attempting to pose not as Ledger,
15 but as other entities such as the Stellar Development Foundation (“Stellar”), an entity affiliated with
16 the creator of the Stellar Lumen token purchased by Plaintiff Baton. Under this scheme, hackers
17 sent an extremely sophisticated email posing as Stellar and soliciting users such as Baton to “stake”
18 Stellar Lumen tokens—a well-known form of deposit that pays interest.
19 85. These emails and websites were effective in part because they looked like Stellar’s
20 actual website, using real assets, articles, features, and other content from Stellar’s email and
21 website. In order to stake Lumens, a user would have to transfer the Lumens to a staking address.
22 But the staking “address” provided to deposit the funds was not actually associated with Stellar, and
23 once the funds were transferred, the hackers absconded with it. Critically, this phishing strategy did
24 not require the disclosure of any private keys and increased a victim’s trust in the malicious site.
25 86. Creating such convincing versions of Stellar’s website and emails required a
26 significant amount of effort, which paid off because the hackers knew they could target the emails
27 of likely cryptocurrency holders such as Plaintiff Baton.
28

21
1 87. In response to these reports, Ledger should have devoted substantial resources and
2 taken responsibility for being the source of the leak that allowed this precision targeting from
3 hackers. Instead, Ledger continued to tout its security credentials and prevaricated about whether
4 the increased phishing and hacking attempts arose from a data breach.
5 88. On November 2, 2020, Ledger refused to acknowledge the Data Breach was the
6 source of the rising attacks on its customers:

7 As soon as we discovered the data breach on Ledger’s website in July
2020, we immediately patched it. Since then, we led two penetration
8 tests with a third-party consultancy to verify and improve the security
of our clients’ data. For two weeks, some of Ledger’s customers have
9 been experiencing continuous phishing scams through various
channels, including email and SMS. We’ve issued several scam alerts
10 through our Twitter, email, and other channels to notify our users
during the past two weeks.
11
The internal task force is investigating these attacks, and as of now,
12 we can’t state that scammers are using Ledger’s marketing
database, and therefore, these attacks resulted from July’s data
13 breach.12
14 89. Ledger’s efforts to cover up and downplay the actual and potential scale of the Data
15 Breach in the months leading up to its widespread public disclosure caused disastrous harm to its
16 customers. During that time, many crypto-asset investors lost massive sums of money. Had Ledger
17
acted responsibly during this period, much of that loss could have been avoided.
18
4. December 2020: In the Face of Widespread Public Disclosure, Ledger Admits
19 to the Scale of the Data Breach
20 90. By early December 2020, reports continued to escalate about phishing attempts on
21 Ledger’s users. By that time, Ledger’s inaction had provided an opportunity for the hackers to
22 increase the sophistication and effectiveness of phishing attempts. For example, some of the
23 phishing attempts referenced breaches and then instructed users, as a security measure, to install
24 fake versions of Ledger Live that asked for their private key information:
25
26
12
27 Benjamin Powers, ‘Convincing’ Phishing Attack Targets Ledger Hardware Wallet Users,
COINDESK (Oct. 27, 2020, 04:13 PM EDT, updated Nov. 2, 2020, 02:56 PM EST),
28 https://www.coindesk.com/phishing-attack-ledger-cryptocurrency-wallet.

22
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 91. Users reported losing significant sums of crypto-assets as a result of such phishing.
21 Plaintiff Chu lost about 4.2 bitcoin and 11 ether, collectively worth approximately $267,000 at
22 today’s market prices. Plaintiff Baton lost about 150,000 Stellar Lumens, worth approximately
23 $72,000 at today’s market prices.
24 92. The phishing attempts were sufficiently successful—and notorious—so that, through
25 December 20, 2020, the going rate among hackers for the compromised list of Ledger customer data
26 was approximately $100,000.13
27
28 13
@UnderTheBreach, TWITTER (Dec. 20, 2020, 01:38 PM),
23
1 93. On December 20, 2020, a hacker published the Ledger customer data online. This
2 publication included the personal information of more than 270,000 Ledger customers.
3 94. Consumers and reporters were quick to criticize Ledger, stating that the company
4 had “vastly underestimated” the Data Breach in its prior statements.14

5 95. With the data made publicly available for free, many Ledger customers started
6 receiving frightening threats. Ledger customers immediately started receiving spam phone calls,
7 emails, and even death threats. Many of these customers shared their experiences online:
8
9
10
11
12
13
14
15
16
17
18
19
20 96. Plaintiffs Chu, Baton, and Shillito, like many members of the Class, also received
21 spam emails, phone calls, and texts which, inter alia, attempted to phish for additional personal
22 information and sell prurient content.
23 97. Ledger knew of and advertised the importance of protecting its customers’ personal
24 information, but before and after the Data Breach, it failed to take reasonable steps to protect its
25
26 https://twitter.com/UnderTheBreach/status/1340735356375851009.
14
27 Vishal Chawla, Liam Kelly, Ledger Breach Vastly Underestimated, 270,000 Clients Data
Leaked, CRYPTO BRIEFING (Dec. 21, 2020), https://cryptobriefing.com/ledger-breach-clients-data-
28 leaked/.

24
1 customers. Before the breach, Ledger should have regularly deleted or archived customer data or
2 should have otherwise protected that information from online accessibility. After the breach, Ledger
3 repeatedly failed to provide critical information to its customers, compounding the harm to Plaintiffs
4 and the Class.
5 98. Shopify similarly failed to protect Ledger’s customer data. Shopify employees, rogue
6 or not, had no need for direct access to Ledger customer data. Shopify should have: (1) limited
7 employee access to customers’ data in a way that prevented the rogue employees’ access; (2)
8 monitored employees’ suspicious copying of customer data; (3) assisted Ledger with its
9 investigation to determine the scope of the Data Breach; and (4) notified Ledgers’ users of the Data
10 Breach.
11 D. Plaintiffs Suffered Damages
12 99. Plaintiffs Chu and Baton have suffered damages from the Data Breach.
13 100. As to direct monetary losses, Plaintiff Chu lost about 4.2 bitcoin and 11 ether,
14 collectively worth approximately $267,000 at today’s market prices. Plaintiff Baton lost about
15 150,000 Stellar Lumens, worth approximately $72,000 at today’s market prices.
16 101. If Ledger had timely disclosed the extent of the Data Breach, Plaintiffs—
17 sophisticated users with technology backgrounds and wary of scams—would have been on
18 heightened alert and not fallen prey to these scams.
19 102. As to other forms of damages, Plaintiff Chu had his email compromised and has
20 received several spam messages since his email was leaked. Plaintiff Baton had his email, physical
21 address, and phone number compromised. He received regular spam calls, still receives spam emails
22 and had to change his phone number and where he receives packages as a result of this breach. He
23 also remains fearful of intruders due to his physical address being publicly leaked.
24 103. These leaks of personal information, in conjunction with the information that they
25 were Ledger customers, have exposed Plaintiffs to additional risks of theft and threat.
26 104. In addition, Plaintiffs would not have purchased Ledger’s products at all, or would
27 have paid significantly less for them, had they known of Ledger’s lax security practices and
28 unwillingness to promptly and completely disclose data breaches.

25
1 V. CLASS ALLEGATIONS
2 105. Plaintiffs bring this Action as a class action pursuant to Fed. R. Civ. P. 23 and seek
3 certification of the following Class and Subclasses:

4 Nationwide Class: All persons residing in the United States who provided
5 Ledger or Shopify with personal information that was accessed,
compromised, stolen, or exposed in a data breach between April 1, 2020, and
6 the present.
7 Nationwide Phishing Subclass: All persons in the Class who suffered

monetary damages in connection with a phishing or threatening
8 communication by a third-party possessing those persons’ personal
information disclosed as a result of a data breach between April 1, 2020, and
9 the present.
10 Nationwide Consumer Class: All persons residing in the United States who
purchased a Ledger Nano X wallet or a Ledger Nano S wallet from Ledger
11 or an authorized reseller within the limitations period, as may be extended or
tolled by any applicable rule of law or equitable doctrine.
12 California Subclass: All persons residing in California who provided Ledger
13 or Shopify with personal information that was accessed, compromised,
stolen, or exposed in a data breach between April 1, 2020, and the present.
14 California Phishing Subclass: All persons in the California Subclass who
15 suffered monetary damages in connection with a phishing or threatening
communication by a third-party possessing those persons’ personal
16 information disclosed as a result of a data breach between April 1, 2020, and
the present.
17 California Consumer Subclass: All persons residing in California who
18 purchased a Ledger Nano X wallet or a Ledger Nano S wallet from Ledger
or an authorized reseller within the limitations period, as may be extended or
19 tolled by any applicable rule of law or equitable doctrine.
20 Georgia Subclass: All persons residing in Georgia who provided Ledger or

Shopify with personal information that was accessed, compromised, stolen,
21 or exposed in a data breach between April 1, 2020, and the present.
22 Georgia Phishing Subclass: All persons in the Georgia Subclass who suffered
monetary damages in connection with a phishing or threatening
23 communication by a third-party possessing those persons’ personal
information disclosed as a result of a data breach between April 1, 2020, and
24 the present.
25 Georgia Consumer Subclass: All persons residing in Georgia who purchased

a Ledger Nano X wallet or a Ledger Nano S wallet from Ledger or an
26 authorized reseller within the limitations period, as may be extended or tolled
by any applicable rule of law or equitable doctrine.
27
28 Accordingly, the Class Period is April 1, 2020, through the present except as to the Consumer

26
1 Subclasses.
2 106. Excluded from the Class and Subclasses are Defendants, their officers and directors,
3 and members of their immediate families or their legal representatives, heirs, successors or assigns
4 and any entity in which Defendants have or had a controlling interest.
5 107. Plaintiffs reserve the right to amend the Class definition if investigation or discovery
6 indicate that the definition should be narrowed, expanded, or otherwise modified.

7 108. The Class members are so numerous that joinder of all members is impracticable.
8 The precise number of Class members is unknown to Plaintiffs at this time, but it is believed to be
9 in the tens of thousands.
10 109. The Class members are readily ascertainable and identifiable. They may be identified
11 through contact information that was breached. They may be notified of the pendency of this Action
12 by electronic mail using a form of notice customarily used in class actions.
13 110. Plaintiffs’ claims are typical of the claims of the Class members, who are similarly
14 affected by Defendants’ respective wrongful conduct in violation of the laws complained of herein.
15 Plaintiffs do not have any interest that is in conflict with the interests of the Class members.
16 111. Plaintiffs and the Class members sustained damages and/or are entitled to restitution
17 from data exposure caused by Defendants’ unlawful conduct and/or for the diminution in value of
18 the products they purchased revealed by Defendants’ unlawful conduct.
19 112. Plaintiffs have fairly and adequately protected, and will continue to fairly and
20 adequately protect, the interests of the Class members and have retained counsel competent and
21 experienced in class actions and data privacy litigation. Plaintiffs have no interests antagonistic to
22 or in conflict with those of the Class.
23 113. Common questions and answers of law and fact exist as to all Class members and
24 predominate over any questions solely affecting individual Class members, including but not limited
25 to the following:
26  The precautions that Defendants took and failed to take with respect to the protection
of the Class members’ data;
27
 The steps Defendants took and failed to take after learning of the Data Breach and
28 the reasonableness of those steps;

27
1  The duties Defendants owed to the Class members, and the manner in which they
breached those duties;
2
 The economic value of Ledger’s wallets and services as advertised;
3
4  The actual economic value of Ledger’s wallets and services where, contrary to its
advertising, Ledger failed to protect customers’ personal information from nefarious
5 actors;
6  The quantification of the harm to Class members resulting from the exposure of their
data to prospective hacking; and
7
 The restitution and/or damages to which Class members are entitled as result of the
8
fact that the actual value of the Ledger wallets was far less than the value of the
9 wallets as advertised.
10 114. A class action is superior to all other available methods for the fair and efficient
11 adjudication of this controversy since joinder of all members is impracticable. Furthermore, as the
12 damages suffered by some of the individual Class members may be relatively small, the expense
13
and burden of individual litigation makes it impossible for Class members to individually redress
14
the wrongs done to them.
15
115. There will be no difficulty in the management of this Action as a class action.
16
17
VI. CLAIMS FOR RELIEF
18
FIRST CAUSE OF ACTION
19
NEGLIGENCE
20 (On Behalf of Plaintiffs, the Nationwide Class, and the Nationwide Phishing Subclass
and, Alternatively, on Behalf of the Remaining Non-Consumer Subclasses)
21
116. Plaintiffs incorporate the preceding paragraphs.
22
117. Ledger and Shopify owed a duty to the Class members, including Plaintiffs, to
23
exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting
24
their personal information in their possession from being compromised, lost, or stolen, and from
25
being accessed, and misused by unauthorized persons.
26
118. This duty included: (a) designing, maintaining, and testing Ledger’s and Shopify’s
27
security systems to ensure that the Class members’ personal information was adequately secured
28

28
1 and protected; (b) implementing processes that would timely detect a breach of their security
2 systems; (c) timely acting upon warnings and alerts, including those generated by their own security
3 systems, regarding intrusions to their networks; (d) maintaining data-security measures consistent
4 with industry standards; and (e) timely and comprehensively notifying Class members of any
5 potential or actual unauthorized access of their personal information.
6 119. Ledger’s and Shopify’s duties to use reasonable care arose from several sources,
7 including those described below. Ledger and Shopify had a common law duty to prevent foreseeable
8 harm to others, including Class members, who were the foreseeable and probable victims of any
9 inadequate security practices. Ledger and Shopify in fact knew that their failure to protect Class
10 members’ personal information would likely harm Class members, because they knew that hackers
11 routinely attempt to steal such information and use it for nefarious purposes.
12 120. Ledger’s and Shopify’s duties also arose under Section 5 of the Federal Trade
13 Commission (“FTC”) Act, 15 U.S.C. § 45, which prohibits “unfair . . . practices in or affecting
14 commerce,” including, as interpreted and enforced by the FTC, failing to use reasonable measures
15 to protect personal information by companies such as Ledger. Various FTC publications and data
16 security breach orders further form the basis of Ledger’s and Shopify’s duties. In addition,
17 individual states have enacted statutes based upon the FTC Act that also created a duty.
18 121. Ledger’s and Shopify’s duties also arose from Ledger’s unique position in the
19 burgeoning crypto-asset market. Ledger strove to create “the highest level of security for crypto
20 assets,” and Ledger was in a unique and superior position to protect against the harm to the Class
21 members as a result of data breaches. As Ledger’s e-commerce vendor entrusted with Ledger’s data,
22 Shopify was in the same unique and superior position to protect against this harm.
23 122. Ledger and Shopify also had duties to safeguard the personal information of the Class
24 members and to promptly notify them of a breach because of state laws and statutes that require
25 Ledger to reasonably safeguard sensitive personal information. Timely notification was necessary
26 to permit Class members to take appropriate measures to protect their identities as owners of crypto-
27 assets, safeguard against threats to those crypto-assets, safeguard against personal threats, and take
28 other steps to mitigate or ameliorate the damages caused by Ledger’s and Shopify’s misconduct.

29
1 123. Ledger and Shopify breached their duties to the Class members and thus were
2 negligent. Ledger and Shopify breached these duties by, among other things, failing to: (a) exercise
3 reasonable care and implement adequate security systems, protocols, and practices sufficient to
4 protect the personal information of the Class members; (b) detect the breaches while they were
5 ongoing; (c) maintain security systems consistent with industry standards; and (d) disclose that the
6 Class members’ personal information in Ledger’s and/or Shopify’s possession had been or was
7 reasonably believed to have been stolen or compromised.
8 124. Ledger’s and Shopify’s negligence was, at least, a substantial factor in causing the
9 Class members’ personal information to be improperly accessed, disclosed, and otherwise

10 compromised, and in causing the Class members’ other injuries as a result of the data breaches.
11 125. As a direct and proximate result of Ledger’s and Shopify’s negligence, the Class
12 members are entitled to damages, including compensatory, punitive, and nominal damages, in an
13 amount to be proven at trial, for injuries that include at least the following:
14 a. the theft of their personal information;
15 b. the diminished value and loss of the benefits of purchased Ledger devices, which
16 now pose a security risk to the Class members;
17 c. the costs associated with the detection and prevention of phishing scams aimed at
18 depriving the Class members of assets and funds;
19 d. the costs associated with purchasing new hardware and software to protect crypto
20 assets and/or other assets and/or funds;
21 e. the costs associated with time spent and the loss of productivity from taking time to
22 address and attempt to ameliorate, mitigate, and deal with the actual and future
23 consequences of the data breaches;
24 f. the imminent and impending injury flowing from potential fraud and theft posed by
25 their personal information being placed in the hands of criminals;
26 g. the mental anguish from the stress and fear of receiving threats and other messages
27 from internet users who have physical address information;
28 h. the damages to and diminution in value of their personal information entrusted,

30
1 directly or indirectly, to Ledger with the mutual understanding that Ledger would
2 safeguard the Class members’ data against theft and not allow access and misuse of
3 their data by others; and
4 i. the continued risk of exposure to hackers and thieves of their personal information,
5 which remains in Ledger’s possession and is subject to further breaches so long as
6 Ledger fails to undertake appropriate and adequate measures to protect the Class
7 members.
8 SECOND CAUSE OF ACTION
9 NEGLIGENCE PER SE
(On Behalf of Plaintiffs, the Nationwide Class, and the Nationwide Phishing Subclass
10 and, Alternatively, on Behalf of the Remaining Non-Consumer Subclasses)
11 126. Plaintiffs incorporate the preceding paragraphs.
12 127. Section 5 of the FTC Act, 15 U.S.C. § 45, prohibits “unfair . . . practices in or
13 affecting commerce” including, as interpreted and enforced by the FTC, the unfair act or practice
14 by companies such as Ledger of failing to use reasonable measures to protect personal information.
15 Various FTC publications and orders also form the basis of Ledger’s and Shopify’s duties.
16 128. Ledger and Shopify violated Section 5 of the FTC Act (and similar state statutes) by
17 failing to use reasonable measures to protect personal information and not complying with industry
18 standards. Ledger’s and Shopify’s conduct was particularly unreasonable given the nature and
19 amount of personal information they obtained and stored and the foreseeable consequences of a data
20 breach that disclosed customers’ personal information, including the fact that those customers
21 owned crypto-assets, to hackers and other third parties.
22 129. Ledger’s and Shopify’s violations of Section 5 of the FTC Act (and similar state
23 statutes) constitute negligence per se. This negligence was, at least, a substantial factor in causing
24 the Class members’ personal information to be improperly accessed, disclosed, and otherwise
25 compromised, and in causing the Class members’ other injuries as a result of the data breaches.
26 130. The Class members, including Plaintiffs, are within the class of persons that Section
27 5 of the FTC Act (and similar state statutes) was intended to protect. In addition, the harm that the
28 Class members have suffered is the type of harm that the FTC Act (and similar state statutes) were

31
1 intended to prevent. Indeed, the FTC has pursued over fifty enforcement actions against businesses
2 that, as a result of their failure to employ reasonable data security measures and avoid unfair and
3 deceptive practices, caused the same or similar harm suffered by the Class members.
4 131. As a direct and proximate result of Ledger’s and Shopify’s negligence, the Class
5 members have been injured as described herein and are entitled to damages, including
6 compensatory, punitive, and nominal damages, in an amount to be proven at trial.
7 THIRD CAUSE OF ACTION
8 DECLARATORY JUDGMENT AND INJUNCTIVE RELIEF

(On Behalf of Plaintiffs, the Nationwide Class, and the Nationwide Phishing Subclass
9 and, Alternatively, on Behalf of the Remaining Non-Consumer Subclasses)
11 133. Under the Declaratory Judgment Act, 28 U.S.C. § 2201, et seq., this Court is
12 authorized to enter a judgment declaring the rights and legal relations of the parties and grant further
13 necessary relief. The Court also has broad authority to restrain acts, such as here, that are tortious
14 and violate the terms of the federal and state statutes described in this Complaint.
15 134. An actual controversy has arisen in the wake of the Data Breach regarding Ledger’s
16 and Shopify’s present and prospective duties to reasonably safeguard customers’ and consumers’
17 personal information and whether Ledger and Shopify are maintaining data-security measures
18 adequate to protect the Class members, including Plaintiffs, from further data breaches that
19 compromise their personal information.
20 135. Plaintiffs allege that Ledger’s and Shopify’s data-security measures remain
21 inadequate. Ledger and Shopify deny these allegations. In addition, Plaintiffs continue to suffer
22 injury as a result of the compromise of their personal information and remain at imminent risk that
23 further compromises of their personal information will occur in the future.
24 136. Pursuant to its authority under the Declaratory Judgment Act, Plaintiffs ask the Court
25 to enter a judgment declaring, among other things, the following:

26 (a) Ledger and Shopify owe a duty to secure consumers’ personal information and
27 to timely notify consumers of a data breach under the common law, Section 5 of
28 the FTC Act, and various state statutes; and

32
1 (b) Ledger and Shopify are in breach of these legal duties by failing to employ
2 reasonable measures to secure consumers’ personal information.
3 137. Plaintiffs further ask the Court to issue corresponding prospective injunctive relief
4 requiring Ledger and Shopify to employ adequate security protocols consistent with law and
5 industry standards to protect consumers’ personal information.
6 138. If an injunction is not issued, the Class members will suffer irreparable injury, and
7 lack an adequate legal remedy, in the event of another data breach at Ledger and/or Shopify. The
8 risk of another such breach is real, immediate, and substantial. If another breach at Ledger and/or
9 Shopify occurs, the Class members will not have an adequate remedy at law because many of the
10 resulting injuries are not readily quantified and they will be forced to bring multiple lawsuits to
11 rectify the same conduct.
12 139. The hardship to the Class members if an injunction does not issue exceeds the
13 hardship to Ledger and Shopify if an injunction is issued. Among other things, if another massive
14 data breach occurs at Ledger and/or Shopify, the Class members will likely be subjected to
15 substantial hacking attempts, physical threats, and other damage. On the other hand, the cost to
16 Ledger and Shopify of complying with an injunction by employing reasonable prospective data
17 security measures is relatively minimal, and Ledger and Shopify have pre-existing legal obligations
18 to employ such measures.
19 140. Issuance of the requested injunction will not disserve the public interest. To the
20 contrary, such an injunction would benefit the public by preventing additional data breaches at
21 Ledger and/or Shopify, thus eliminating the additional injuries that would result to the Class
22 members and the millions of consumers whose personal and confidential information would be
23 further compromised.
24 FOURTH CAUSE OF ACTION
25 CALIFORNIA UNFAIR COMPETITION LAW

Cal. Bus. & Prof. Code § 17200, et seq.
26 (On Behalf of Plaintiffs, the Nationwide Class, the Nationwide Phishing Subclass, and
the Nationwide Consumer Class, and Alternatively, on Behalf of the California
27 Subclass, California Phishing Subclass and California Consumer Class)

33
1 142. Ledger and Shopify are “persons” as defined by Cal. Bus. & Prof. Code § 17201.
2 143. California’s Unfair Competition Law (the “UCL”) prohibits “unfair competition,”
3 which Ledger and Shopify violated by engaging in unlawful, unfair, and deceptive business acts and
4 practices, including the following:
5 a. Failing to implement and maintain reasonable security measures to protect the
6 California Subclass members’ personal information from unauthorized
7 disclosure, release, data breaches, and theft, which was a direct and proximate
8 cause of the Data Breach. Ledger and Shopify failed to identify foreseeable
9 security risks, remediate identified security risks, and adequately improve security
10 following previous cybersecurity incidents. This conduct, with little if any utility,
11 is unfair when weighed against the harm to the California Subclass members
12 whose personal information has been compromised.
13 b. Ledger’s and Shopify’s failures to implement and maintain reasonable security
14 measures also were contrary to legislatively declared public policy that seeks to
15 protect consumers’ data and ensure that entities that are trusted with it use
16 appropriate security measures. These policies are reflected in laws, including the
17 FTC Act, 15 U.S.C. § 45, and California’s Consumer Records Act, Cal. Civ. Code
18 § 1798.81.5.
19 c. Ledger’s and Shopify’s failures to implement and maintain reasonable security
20 measures also led to substantial consumer injuries, as described above, that are
21 not outweighed by any countervailing benefits to consumers or competition.
22 Moreover, because consumers could not know of Ledger’s and Shopify’s
23 inadequate security, consumers could not have reasonably avoided the harms that
24 Ledger and Shopify caused.
25 d. Engaging in unlawful business practices by violating Cal. Civ. Code § 1798.82.
26 144. Ledger and Shopify have engaged in “unlawful” business practices by violating
27 multiple laws, including California’s Consumer Records Act, Cal. Civ. Code §§ 1798.81.5
28 (requiring reasonable data security measures) and 1798.82 (requiring timely breach notification);

34
1 California’s Consumers Legal Remedies Act, Cal. Civ. Code § 1780, et seq.; the FTC Act, 15 U.S.C.
2 § 45; and California common law. Ledger’s and Shopify’s unlawful, unfair, and deceptive acts and
3 practices include the following:
4 a. Failing to implement and maintain reasonable security and privacy measures to
5 protect the Class members’ personal information, including the confidential
6 fact that those individuals had purchased a Ledger and owned crypto-assets,
7 which was a direct and proximate cause of the Data Breach and the Class
8 members’ damages;
9 b. Failing to identify foreseeable security and privacy risks, remediate identified
10 security and privacy risks, and adequately improve security and privacy
11 measures following cybersecurity incidents, which was a direct and proximate
12 cause of the Data Breach;
13 c. Failing to comply with common law and statutory duties pertaining to the
14 security and privacy of the Class members’ personal information, including the
15 confidential fact that those individuals had purchased a Ledger and owned
16 crypto-assets, including duties imposed by the FTC Act, 15 U.S.C. § 45, which
17 was a direct and proximate cause of the Data Breach;
18 d. Misrepresenting that they would protect the privacy and confidentiality of the
19 Class members’ personal information, including by implementing and
20 maintaining reasonable security measures;
21 e. Misrepresenting that they would comply with common law and statutory duties
22 pertaining to the security and privacy of the Class members’ personal
23 information, including duties imposed by the FTC Act, 15 U.S.C. § 45;
24 f. Omitting, suppressing, and concealing the material fact that they did not
25 reasonably or adequately secure the Class members’ personal information;
26 g. Omitting, suppressing, and concealing the material fact that they did not
27 comply with common law and statutory duties pertaining to the security and
28 privacy of the Class members’ personal information, including duties imposed

35
1 by the FTC Act, 15 U.S.C. § 45; and
2 h. Misrepresenting that Ledger provided the highest level of security for crypto-
3 assets and that Ledger devices and services were worth the amounts paid by the
4 customers, when in reality, Ledger and Shopify permitted the dissemination of
5 personal information to hackers and bad actors, causing Ledger’s devices and
6 services to have less actual value or to be worthless.
7 145. Ledger’s and Shopify’s representations and omissions were material because they
8 were likely to deceive reasonable consumers about the value of Ledger’s and Shopify’s services and
9 the adequacy of Ledger’s and Shopify’s data security, ability to protect the confidentiality of
10 consumers’ personal information, and ability to protect the confidentiality of the fact that consumers
11 had purchased a Ledger and/or owned crypto-assets.
12 146. As a direct and proximate result of Ledger’s and Shopify’s deceptive and unlawful
13 acts and practices, the Class members are entitled to restitution in an amount to be proven at trial,
14 for, among other things, the loss of the benefit of their bargain with Ledger, as they would not have
15 paid Ledger for goods and services or would have paid less for such goods and services but for
16 Ledger’s and Shopify’s misconduct.
17 147. The Class members seek all monetary and non-monetary relief allowed by law,
18 including restitution of all revenues stemming from Ledger’s and Shopify’s unfair, unlawful, and
19 fraudulent business practices or use of their Personal Information; declaratory relief; reasonable
20 attorneys’ fees and costs under California Code of Civil Procedure § 1021.5; injunctive relief; and
21 other appropriate equitable relief.
22
23
24
25
26
27
28

36
1 FIFTH CAUSE OF ACTION
2 CALIFORNIA CONSUMER LEGAL REMEDIES ACT

Cal. Civ. Code § 1750, et seq.
3 (On Behalf of Plaintiffs, the Nationwide Class, the Nationwide Phishing Subclass, and
the Nationwide Consumer Class and, Alternatively on Behalf of the California
4 Subclass, California Phishing Subclass and California Consumer Class)
6 149. The Consumers Legal Remedies Act, Cal. Civ. Code § 1750, et seq. (“CLRA”), is a
7 comprehensive statutory scheme that is to be liberally construed to protect consumers against unfair
8 and deceptive business practices in connection with the conduct of businesses providing goods,
9 property or services to consumers primarily for personal, family, or household use.
10 150. Ledger and Shopify are “persons” as defined by California Civil Code §§ 1761(c)
11 and 1770, and have provided “services” as defined by California Civil Code §§ 1761(b) and 1770.
12 151. California Civil Code § 1770(a)(5) prohibits one who is involved in a transaction
13 from “[r]epresenting that goods or services have sponsorship, approval, characteristics, ingredients,
14 uses, benefits, or quantities [which] they do not have[.]”
15 152. California Civil Code § 1770(a)(7) prohibits one who is involved in a transaction
16 from “[r]epresenting that goods or services are of a particular standard, quality, or grade . . . if they
17 are of another.”
18 153. Class members are “consumers” as defined by California Civil Code §§ 1761(d) and
19 1770, and have engaged in a “transaction” as defined by California Civil Code §§ 1761(e) and 1770.
20 154. Ledger’s and Shopify’s acts and practices were intended to and did result in the sales
21 of products and services to the Class members in violation of California Civil Code § 1770.
22 155. Ledger’s and Shopify’s acts and practices were intended to and did result in the sales
23 of products and services to the Class members in violation of California Civil Code § 1770,
24 including, but not limited to, the following:
25 a. Representing that goods or services have characteristics that they do not have;
26 b. Representing that goods or services are of a particular standard, quality, or grade
27 when they were not;
28 c. Advertising goods or services with intent not to sell them as advertised; and

37
1 d. Representing that the subject of a transaction has been supplied in accordance
2 with a previous representation when it has not.
4 were likely to and did deceive reasonable consumers about the adequacy of Ledger’s and Shopify’s
5 data security and ability to protect the confidentiality of consumers’ personal information, including
6 the confidentiality of the fact that consumers purchased a Ledger devices or service and, therefore,
7 owned crypto-assets.
8 157. If Ledger and/or Shopify disclosed to the Class members that their data systems were
9 not secure and, thus, vulnerable to attack, Ledger and Shopify would have been unable to continue
10 in business and would have been forced to adopt reasonable data security measures and comply with
11 the law.
12 158. Instead, Ledger and Shopify received, maintained, and compiled the Class members’
13 personal information as part of the services Ledger and Shopify provided without advising the Class
14 members that Ledger’s and Shopify’s data-security practices were insufficient to maintain the safety
15 and confidentiality of the Class members’ personal information. Accordingly, the Class members
16 acted reasonably in relying on Ledger’s and Shopify’s misrepresentations and omissions, the truth
17 of which they could not have discovered.
18 159. As a direct and proximate result of Ledger’s and Shopify’s violations of California
19 Civil Code § 1770, the Class members are entitled to injunctive relief. Plaintiffs shall provide the
20 notice required by California Civil Code § 1782(a) and, upon the expiration of the statutory notice
21 and cure period, amend this claim to seek damages, including punitive damages.
22 160. As set forth above, the Class members will upon amendment seek all monetary and
23 non-monetary relief allowed by law, including damages, an order enjoining the acts and practices
24 described above, attorneys’ fees, and costs under the CLRA.
25 SIXTH CAUSE OF ACTION
26 GEORGIA UNIFORM DECEPTIVE TRADE PRACTICES ACT

O.C.G.A § 10-1-370, et seq.
27 (On Behalf of the Georgia Subclass, Georgia Phishing Subclass, and Georgia
Consumer Subclass)
28

38
2 162. Ledger, Shopify, and the Georgia Subclass members are “persons” within the
3 meaning of § 10-1-371(5) of the Georgia Uniform Deceptive Trade Practices Act (“Georgia
4 UDTPA”).
5 163. Ledger and Shopify engaged in deceptive trade practices in the conduct of its
6 business, in violation of Georgia Code (“O.C.G.A.”) § 10-1-372(a), including, but not limited to:
7 a. Representing that goods or services have characteristics that they do not have;
8 b. Representing that goods or services are of a particular standard, quality, or grade
9 when they were not;
10 c. Advertising goods or services with intent not to sell them as advertised; and
11 d. Representing that the subject of a transaction has been supplied in accordance with
12 a previous representation when it has not.
13 164. Ledger’s and Shopify’s deceptive trade practices include, but are not limited to:
14 a. Failing to implement and maintain reasonable security and privacy measures to
15 protect the Georgia Subclass members’ Personal Information, which was a direct and
16 proximate cause of the Data Breach;
17 b. Failing to identify foreseeable security and privacy risks, remediate identified
18 security and privacy risks, and adequately improve security and privacy measures
19 following previous cybersecurity incidents, which was a direct and proximate cause
20 of the Data Breach;
21 c. Failing to comply with common law and statutory duties pertaining to the security
22 and privacy of Plaintiff and Georgia Subclass members’ Personal Information,
23 including duties imposed by the FTC Act, 15 U.S.C. § 45, the Fair Credit Reporting
24 Act (“FCRA”), 15 U.S.C. § 1681e, and the Gramm-Leach-Bliley Act (“GLBA”), 15
25 U.S.C. § 6801, et seq., which was a direct and proximate cause of the Data Breach;
26 d. Misrepresenting that they would protect the privacy and confidentiality of the
27 Georgia Subclass members’ Personal Information, including by implementing and
28 maintaining reasonable security measures;

39
1 e. Misrepresenting that they would comply with common law and statutory duties
2 pertaining to the security and privacy of the Georgia Subclass members’ Personal
3 Information, including duties imposed by the FTC Act, 15 U.S.C. § 45, the FCRA,
4 15 U.S.C. § 1681e, and the GLBA, 15 U.S.C. § 6801, et seq.;
5 f. Omitting, suppressing, and concealing the material fact that they did not reasonably
6 or adequately secure the Georgia Subclass members’ Personal Information; and
7 g. Omitting, suppressing, and concealing the material fact that they did not comply with
8 common law and statutory duties pertaining to the security and privacy of the
9 Georgia Subclass members’ Personal Information, including duties imposed by the
10 FTC Act, 15 U.S.C. § 45, the FCRA, 15 U.S.C. § 1681e, and the GLBA, 15 U.S.C.
11 § 6801, et seq.
13 were likely to and did deceive reasonable consumers about the adequacy of Ledger’s and Shopify’s
14 data security and ability to protect the confidentiality of consumers’ personal information, including
15 the confidentiality of the fact that consumers purchased a Ledger devices or service and, therefore,
16 owned crypto-assets.
17 166. Ledger and Shopify intended to mislead the Georgia Subclass members and induce
18 them to rely on its misrepresentations and omissions.

19 167. In the course of their businesses, Ledger and Shopify engaged in activities with a
20 tendency or capacity to deceive.

21 168. Ledger and Shopify acted intentionally, knowingly, and maliciously to violate
22 Georgia’s UDTPA, and recklessly disregarded the Georgia Subclass members’ rights.
23 169. If Ledger and/or Shopify disclosed to the Georgia Subclass members that their data
24 systems were not secure and, thus, vulnerable to attack, Ledger and Shopify would have been unable
25 to continue in business and would have been forced to adopt reasonable data security measures and
26 comply with the law.
27 170. Instead, Ledger and Shopify received, maintained, and compiled the Georgia
28 Subclass members’ personal information as part of the services Ledger and Shopify provided

40
1 without advising the Georgia Subclass members that Ledger’s and Shopify’s data-security practices
2 were insufficient to maintain the safety and confidentiality of the Georgia Subclass members’
3 personal information. Accordingly, the Georgia Subclass members acted reasonably in relying on
4 Ledger’s and Shopify’s misrepresentations and omissions, the truth of which they could not have
5 discovered.
6 171. As a direct and proximate result of Ledger’s and Shopify’s deceptive trade practices,
7 the Georgia Subclass members have suffered and will continue to suffer monetary and non-monetary
8 damages, in an amount to be proven at trial, for injuries that include at least the following
9 ascertainable losses of money or property:
10 a. the loss of the benefit of their bargain with Ledger, as they would not have paid
11 Ledger for goods and services or would have paid less for such goods and services
12 but for Ledger’s and Shopify’s misconduct;
13 b. losses from fraud and theft;
14 c. costs for credit monitoring, identity protection services, or other services or products
15 to attempt to recover stolen crypto-assets, protect crypto-assets, or protect personal
16 information;
17 d. time and expenses incurred and to be incurred in monitoring their financial accounts
18 for fraudulent activity;
19 e. time and money spent attempting to recover stolen crypto-assets, protect crypto-
20 assets, or protect personal information;
21 f. loss of value of their personal information;
22 g. time and money spent attempting to replace or replacing the hardware and services
23 that Ledger was supposed to provide but failed to provide; and
24 h. an increased, imminent risk of fraud and identity theft.
25 172. The Georgia Subclass members seek all relief allowed by law, including injunctive
26 relief, and reasonable attorneys’ fees and costs, under O.C.G.A. § 10-1-373.
27
28

41
1 PRAYER FOR RELIEF
2 On behalf of themselves, the Class, and the Subclasses, Plaintiffs request as follows:
3 (a) That the Court determines that this Action may be maintained as a Class Action, that
4 Plaintiffs be named as Class Representatives of the Class, that the undersigned be
5
named as Lead Class Counsel of the Class, and directs that notice of this Action be
6
given to Class members;
7
(b) That the Court enter an order declaring that Defendants’ actions, as set forth in this
8
9 Complaint, violate the laws set forth above;
10 (c) That the Court award Plaintiffs and the Class damages in an amount to be determined
11 at trial;
12
(d) That the Court issue appropriate equitable and any other relief against Defendants to
13
which Plaintiffs and the Class are entitled, including but not limited to an Order
14
requiring Defendants to cooperate and financially support civil and/or criminal asset
15
16 recovery efforts;
17 (e) That the Court award Plaintiffs and the Class pre- and post-judgment interest
18 (including pursuant to statutory rates of interest set under State law);

19 (f) That the Court award Plaintiffs and the Class their reasonable attorneys’ fees and
20
costs of suit; and
21
(g) That the Court award any and all other such relief as the Court may deem just and
22
proper under the circumstances.
23
24 JURY TRIAL
25 Pursuant to Federal Rule of Civil Procedure 38(b), Plaintiffs respectfully demand a trial by
26 jury for all claims.

27
28

42
1 Dated: April 6, 2021 Respectfully submitted,
2 /s/ Todd M. Scheider /s/ Kyle W. Roche

Todd M. Schneider (SBN 158253) Kyle W. Roche (pro hac vice application
3
Jason H. Kim (SBN 220279) forthcoming)
4 Matthew S. Weiler (SBN 236052) Richard Cipolla (pro hac vice application
Kyle G. Bates (SBN 299114) forthcoming)
5 SCHNEIDER WALLACE Jolie Huang (pro hac vice application
COTTRELL KONECKY LLP forthcoming)
6 2000 Powell Street, Suite 1400 ROCHE FREEDMAN LLP
Emeryville, California 94608 99 Park Avenue, 19th Floor
7
Telephone: (415) 421-7100 New York, NY 10016
8 Email: Telephone: (646) 970-7509
tschneider@schneiderwallace.com Email: kyle@rcfllp.com
9 Email: jkim@schneiderwallace.com Email: rcipolla@rcfllp.com
Email: mweiler@schneiderwallace.com Email: jhuang@rcfllp.com
10 Email: kbates@schneiderwallace.com
11
Velvel Freedman (pro hac vice application
12 forthcoming)
Constantine P. Economides (pro hac vice
13 application forthcoming)
ROCHE FREEDMAN LLP
14 200 South Biscayne Boulevard
15 Miami, FL 33131
Telephone: (305) 971-5943
16 Email: vel@rcfllp.com
Email: ceconomides@rcfllp.com
17
18 Counsel for Plaintiffs
19
20
21
22
23
24
25
26
27
28

43

Ledger Shopify Complaint

Uploaded by

Copyright:

Available Formats

Ledger Shopify Complaint

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ledger Shopify Complaint

Uploaded by

Copyright:

Available Formats

What is Ledger's primary product?

What is Ledger's primary product?

What do Ledger wallets store that allows control over crypto-assets?

What do Ledger wallets store that allows control over crypto-assets?

Case 3:21-cv-02470-JSC Document 1 Filed 04/06/21 Page 1 of 43

9 Velvel Freedman (pro hac vice

CLASS ACTION COMPLAINT

10 “We know security means never standing still.”

CLASS ACTION COMPLAINT

1 4. Consequently, to the world of hackers, Ledger’s customer list is gold. It is a list of

CLASS ACTION COMPLAINT

25 and/or services from Ledger.

27 and/or services from Ledger.

CLASS ACTION COMPLAINT

2 15. Defendant Ledger SAS is a French simplified joint-stock company headquartered in

9 Street, Ground floor, Ottawa, Ontario, K2P 2L8.

23 substantial office at 121 2nd St #4, San Francisco, California 94105.

CLASS ACTION COMPLAINT

25 A. Bitcoin and Crypto-Assets

26 27. A crypto-asset is a digital asset designed to work as a medium of exchange or a store

27 of value or both. Crypto-assets leverage a variety of cryptographic principles to secure transactions,

CLASS ACTION COMPLAINT

18 ownership of an address is through the use of public and private keys.

CLASS ACTION COMPLAINT

1 2. Security and Crypto-Assets

4 one of the chief advantages and selling points of the technology.

10 crimes in 2019.1 That risk of theft continues today.

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

6 We relentlessly stress-test our own technology solutions. Our Ledger

15  “Ledger hardware wallets are designed with the highest security

24  “Ledger removes the risk of being hacked” (as featured on CNBC).

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

9 Ledger’s consumer information from Shopify had been hacked.8

CLASS ACTION COMPLAINT

6 mitigated, the harm caused by the Data Breach.

16 To be as transparent as possible, we want to explain what happened.

23 Those 9500 customers whose detailed personal information are

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

1 3. August – December 2020: Hacking Attacks Increase on Ledger Users

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

6 source of the rising attacks on its customers:

CLASS ACTION COMPLAINT

4 had “vastly underestimated” the Data Breach in its prior statements.14

CLASS ACTION COMPLAINT

CLASS ACTION COMPLAINT

3 certification of the following Class and Subclasses:

7 Nationwide Phishing Subclass: All persons in the Class who suffered

20 Georgia Subclass: All persons residing in Georgia who provided Ledger or

25 Georgia Consumer Subclass: All persons residing in Georgia who purchased

CLASS ACTION COMPLAINT