Aiken V. Credit Freedom and Restoration Corporation, Case No. 2:26-cv-01782

Primary Source: View Original Complaint (PDF)

Facts as Alleged in the Complaint

The following is taken verbatim from the complaint filed in federal court. These are allegations; no finding of fact has been made.

The Parties

13. Plaintiff Michael Aiken is an adult, who at all relevant times, was a resident and citizen of the Commonwealth of Pennsylvania.
14. Plaintiff has suffered actual injury from having his Private Information exposed and/or stolen as a result of the Data Breach, including: (a) required mitigation efforts, including researching the Data Breach and needing to monitor his financial statements to ensure his information is not used for identity theft and fraud; (b) damages to and diminution of the value of his Private Information, a form of intangible property that loses value when it falls into the hands of criminals; (c) loss of privacy; and (d) continuous imminent and impending injury raising from increased risk of financial identity theft and fraud.
15. As a result of the Data Breach, and the sensitivity of the Private Information compromised, Plaintiff will continue to be at a substantial and certainly impending risk for fraud and identity theft, and their attendant damages, for years to come.
16. Defendant Credit Freedom and Restoration Corporation is a Pennsylvania corporation with its principal executive office located at 6000 Wismer Road, Pipersville, PA 18947.

Factual Allegations

21. Defendant provides professional credit repair services built on compliance, transparency, and education with the goal of providing long term financial improvement.
22. Plaintiff and Class Members are and/or were customers of Defendant.
23. As a condition of obtaining Defendant’s services, Plaintiff and Class Members directly or indirectly entrusted Credit Freedom with their sensitive Private Information.
24. Plaintiff and Class Members value the confidentiality of their Private Information and, accordingly, have taken reasonable steps to maintain the confidentiality of their Private Information.
25. In entrusting their Private Information to Defendant, Plaintiff and Class Members reasonably expected that Defendant would safeguard their highly sensitive information.
26. By obtaining, collecting, and storing Plaintiff’s and Class Members’ Private Information, Credit Freedom assumed equitable and legal duties to safeguard Plaintiff’s and Class Members’ highly sensitive information, to only use this information for business purposes, and to only make authorized disclosures.
27. Despite these duties, Credit Freedom failed to implement reasonable data security measures to protect Plaintiff’s and Class Members’ Private Information and ultimately allowed threat actors to breach its computer systems and exfiltrate Plaintiff’s and Class Members’ Private Information stored therein.
28. Credit Freedom understood that the Private Information it collects was highly sensitive and of significant value to those who would use it for wrongful purposes.
29. Credit Freedom also knew that a breach of its computer systems, and exposure of the Private Information stored therein, would result in the increased risk of identity theft and fraud against the individuals whose Private Information was compromised.
30. These risks are not theoretical; in recent years, numerous high-profile breaches have occurred at business such as Equifax, Facebook, Yahoo, Marriott, Anthem, Comcast, and many others.
31. Private Information has considerable value and constitutes an enticing and well-known target to hackers. Hackers can easily sell stolen data as there has been “proliferation of open and anonymous cybercrime forums on the Dark Web that serve as a bustling marketplace for such commerce.”
32. As the FTC recognizes, identity thieves can use this information to commit an array of crimes including identity theft, and medical and financial fraud. The prevalence of data breaches and identity theft has increased dramatically in recent years, accompanied by a parallel and growing economic drain on individual, businesses, and government entities in the U.S. In 2023 alone, there were 6,077 recorded breaches exposing more than 17 billion records – representing a 19.8% year-over-year increase in the United States compared to 2022. This trend is mirrored in identity theft complaints, which nearly doubled over a four-year span—from 2.9 million reports in 2017 to 5.7 million in 2021.
33. Indeed, a 2022 poll of security executives predicted an increase in attacks over the next two years from “social engineering and ransomware” as nation-states and cybercriminals grow more sophisticated. Unfortunately, these preventable causes will largely come from “misconfigurations, human error, poor maintenance, and unknown assets.”
34. In tandem with the increase in data breaches, the rate of identity theft complaints has also increased over the past few years. For instance, 2024 had the second-highest number of data compromises in the U.S. in a single year since such instances began being tracked in 2005.
35. The ramifications of Credit Freedom’s failure to keep Plaintiff’s and Class Members’ Private Information secure are long-lasting and severe. Once Private Information is stolen, fraudulent use of that information and damage to victims may continue for years. According to the U.S. Government Accountability Office, which conducted a study regarding data breaches: “[I]n some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the [Dark] Web, fraudulent use of that information may continue for years. As a result, studies that attempt to measure the harm resulting from data breaches cannot necessarily rule out all future harm.”
36. Even if stolen Private Information does not include financial or payment card account information, that does not mean there has been no harm, or that the breach does not cause a substantial risk of identity theft. Freshly stolen information can be used with success against victims in specifically targeted efforts to commit identity theft known as social engineering or spear phishing. In these forms of attack, the criminal uses the previously obtained PII about the individual, such as name, address, email address, and affiliations, to gain trust and increase the likelihood that a victim will be deceived into providing the criminal with additional information.
37. The specific types of personal data compromised in the Data Breach makes the information particularly valuable to thieves and leaves Plaintiff and other Class Members especially vulnerable to identity theft, tax fraud, medical fraud, credit and bank fraud, and more.
38. Social Security Numbers—Unlike credit or debit card numbers in a payment card data breach—which can quickly be frozen and reissued in the aftermath of a breach—unique Social Security Numbers cannot be easily replaced. Even when such numbers are replaced, the process of doing so results in a major inconvenience to the subject person, requiring a wholesale review of the person’s relationships with government agencies and any number of private companies in order to update the person’s accounts with those entities.
39. Indeed, the Social Security Administration warns that the process of replacing a Social Security Number is a difficult one that creates other types of problems, and that it will not be a complete remedy for the affected person: “You should know that other governmental agencies (such as the IRS and state motor vehicle agencies) and private businesses (such as banks and credit reporting companies) have records under your old number. Along with other personal information, credit reporting companies use the number to identify your credit record. So, using a new number won’t guarantee you a fresh start. This is especially true if your other personal information, such as your name and address, remains the same. If you receive a new SSN, you shouldn’t use the old number anymore. For some victims of identity theft, a new number actually creates new problems. If the old credit information isn’t associated with your new number, the absence of any credit history under your new number may make it more difficult for you to get credit.”
40. Social Security numbers allow individuals to apply for credit cards, student loans, mortgages, and other lines of credit – among other services. Often social security numbers can be used to obtain medical goods or services, including prescriptions. They are also used to apply for a host of government benefits. Access to such a wide range of assets makes Social Security numbers a prime target for cybercriminals and a particularly attractive form of PII to steal and then sell.
41. Based on the value of Plaintiff’s and Class Members’ PII to cybercriminals, Credit Freedom knew or should have known the importance of safeguarding the PII entrusted to it and of the foreseeable consequences if its data security systems were breached. Credit Freedom failed, however, to take adequate cyber security measures to prevent the Data Breach from occurring.
42. On or about March 12, 2026, an unauthorized third-party, Loki, gained access to Defendant’s CRM software and successfully exfiltrated Private Information stored therein. The Private Information exfiltrated in the Data Breach includes driver’s license numbers, Social Security numbers, plaintext credit card data and card images, utility bills, and credit reports.
43. Defendant has yet to provide notice of the Data Breach to its customers or formally announce that the Data Breach has occurred.
44. On information and belief, the cyberattack was expressly designed to gain access to private and confidential data of specific individuals, including (among other things) the PII of Plaintiff and the Class Members. The cybercriminals were successful in exfiltrating sensitive information from Defendant’s CRM software.
45. All in all, the Private Information of approximately 30,000 individuals was compromised in the Data Breach.
46. The Data Breach occurred as a direct result of Credit Freedom’s failure to implement and follow basic security procedures to protect its current and former customers’ Private Information that it had collected and stored.
47. Credit Freedom is prohibited by the Federal Trade Commission Act, 15 U.S.C. § 45 (“FTC Act”) from engaging in “unfair or deceptive acts or practices in or affecting commerce.” The Federal Trade Commission (“FTC”) has concluded that a company’s failure to maintain reasonable and appropriate data security for consumers’ sensitive personal information is an “unfair practice” in violation of the FTC Act.
48. The FTC has promulgated numerous guides for businesses that highlight the importance of implementing reasonable data security practices. According to the FTC, the need for data security should be factored into all business decision-making.
49. Among other guidance, the FTC recommends the following cybersecurity guidelines for businesses in order to protect sensitive information in their systems:
    1. Identify all connections to the computers where sensitive information is stored;
    2. Assess the vulnerability of each connection to commonly known or reasonably foreseeable attacks;
    3. Do not store sensitive consumer data on any computer with an internet connection unless it is essential for conducting their business;
    4. Scan computers on their network to identify and profile the operating system and open network services. If services are not needed, they should be disabled to prevent hacks or other potential security problems. For example, if email service or an internet connection is not necessary on a certain computer, a business should consider closing the ports to those services on that computer to prevent unauthorized access to that machine;
    5. Pay particular attention to the security of their web applications – the software used to give information to visitors to their websites and to retrieve information from them. Web applications may be particularly vulnerable to a variety of hack attacks;
    6. Use a firewall to protect their computers from hacker attacks while it is connected to a network, especially the internet;
    7. Determine whether a border firewall should be installed where the business’s network connects to the internet. A border firewall separates the network from the internet and may prevent an attacker from gaining access to a computer on the network where sensitive information is stored. Set access controls – settings that determine which devices and traffic get through the firewall – to allow only trusted devices with a legitimate business need to access the network. Since the protection a firewall provides is only as effective as its access controls, they should be reviewed periodically;
    8. Monitor incoming traffic for signs that someone is trying to hack in. Keep an eye out for activity from new users, multiple log-in attempts from unknown users or computers, and higher-than-average traffic at unusual times of the day; and
    9. Monitor outgoing traffic for signs of a data breach. Watch for unexpectedly large amounts of data being transmitted from their system to an unknown user. If large amounts of information are being transmitted from a business’s network, the transmission should be investigated to make sure it is authorized.
50. The FTC further recommends that companies not maintain PII longer than is needed for authorization of a transaction; limit access to private data; require complex passwords to be used on networks; use industry-tested methods for security; monitor for suspicious activity on the network; and verify that third-party service providers have implemented reasonable security measures.
51. The FTC has brought enforcement actions against businesses for failing to adequately and reasonably protect customer data, treating the failure to employ reasonable and appropriate measures to protect against unauthorized access to confidential consumer data as an unfair act or practice prohibited by Section 5 of the FTC Act. Orders resulting from these actions further clarify the measures businesses must take to meet their data security obligations.
52. Credit Freedom failed to properly implement basic data security practices. Credit Freedom’s failure to employ reasonable and appropriate measures to protect against unauthorized access to its customers’ PII constitutes an unfair act of practice prohibited by Section 5 of the FTC Act.
53. Credit Freedom was at all times fully aware of its obligations to protect the PII of its customers given the reams of PII that it had access to as a result of the nature of its business. Credit Freedom was also aware of the significant repercussions that would result from a failure to properly secure the Private Information it maintained.
54. An unauthorized third-party, Loki, accessed Defendant’s information technology system on or about March 12, 2026.
55. Credit Freedom failed to take necessary precautions and failed to employ adequate measures necessary to protect its computer systems against unauthorized access and keep Plaintiff’s and Class Members’ Private Information secure.
56. The Private Information that Credit Freedom allowed to be exposed in the Data Breach is the type of private information that Credit Freedom knew or should have known would be the target of cyberattacks.
57. Despite its own knowledge of the inherent risks of cyberattacks, and notwithstanding the FTC’s data security principles and practices, Credit Freedom failed to disclose that its systems and security practices were inadequate to reasonably safeguard individuals’ Private Information.
58. The FTC directs businesses to use an intrusion detection system to expose a breach as soon as it occurs, monitor activity for attempted hacks, and have an immediate response plan if a breach occurs. Immediate notification to individuals impacted by a data breach is critical so that those impacted can take measures to protect themselves.
59. Here, Credit Freedom has yet to notify impacted individuals about the Data Breach.
60. Plaintiff and Class Members remain in the dark about the identities of the perpetrators, the precise attack method of the breach, the full extent of the data stolen, and the steps are being taken to secure their PII in the future.
61. The ramifications of Credit Freedom’s failure to keep Private Information secure are long-lasting and severe. Once Private Information is stolen, fraudulent use of that information and damage to victims may continue for years.
62. Once Private Information is exposed, there is virtually no way to ensure that the exposed information has been fully recovered or obtained against future misuse. For this reason, Plaintiff and Class Members will need to maintain these heightened measures for years, and possibly their entire lives as a result of Defendant’s conduct. Further, the value of Plaintiff’s and Class Members’ Private Information has been diminished by its exposure in the Data Breach.
63. PII remains of high value to criminals, as evidenced by the prices they will pay through the dark web. Numerous sources cite dark web pricing for stolen identity credentials. For example, personal information can be sold at a price ranging from $40 to $200, and bank details have a price range of $50 to $200. “Fullz” packages, which includes “extra information about the legitimate credit card owner in case” the scammer’s “bona fides are challenged when they attempt to use the credit card” are also offered on the dark web.
64. Plaintiff and Class Members are at substantial increased risk of suffering identity theft and fraud or misuse of their Private Information as a result of the Data Breach. From a recent study, 28% of individuals affected by a data breach become victims of identity fraud – this is a significant increase from a 2012 study that found only 9.5% of those affected by a breach would be subject to identity fraud. Without a data breach, the likelihood of identify fraud is only about 3%.
65. Further, Plaintiff and Class Members have incurred and will incur out of pocket costs for protective measures, such as identity theft protection, credit monitoring, credit report fees, credit freeze fees, and similar costs related to the Data Breach.
66. Besides the monetary damage sustained in the event of identity theft, consumers may have to spend hours trying to resolve identity theft issues. For example, the FTC estimates that it takes consumers an average of 200 hours of work over approximately six months to recover from identity theft.
67. Plaintiff and Class Members are also at a continued risk because their information remains in Credit Freedom’s systems, which the Data Breach showed are susceptible to compromise and attack and are subject to further attack so long as Credit Freedom fails to take necessary and appropriate security and training measures to protect the Private Information in its possession.
68. Plaintiff and Class Members have suffered emotional distress as a result of the Data Breach, the increased risk of identity theft and financial fraud, and the unauthorized exposure of their Private Information to strangers.
69. As a result of Credit Freedom’s failure to prevent the Data Breach, Plaintiff and Class Members have suffered and will continue to suffer injuries, including out of pocket expenses; loss of time and productivity through efforts to ameliorate, mitigate, and deal with the future consequences of the Data Breach; theft of their valuable Private Information; the imminent and certainly impeding injury flowing from fraud and identity theft posed by their Private Information being disclosed to unauthorized recipients and cybercriminals; damages to and diminution in value of their Private Information; and continued risk to Plaintiff’s and the Class Members’ Private Information, which remains in the possession of Defendant and which is subject to further breaches so long as Credit Freedom fails to undertake appropriate and adequate measures to protect the Private Information entrusted to it.
70. The fact is that victims of data breaches and other unauthorized disclosures commonly face multiple years of ongoing identity theft and financial fraud, and Plaintiff and Class Members have not been provided any compensation for the unauthorized release and disclosure of their PII.

Class Allegations

71. Plaintiff brings this class action on behalf of himself and all other individuals who are similarly situated pursuant to Rule 23 of the Federal Rules of Civil Procedure.
72. Plaintiff seeks to represent a class of persons to be defined as follows: All individuals in the United States whose Private Information was compromised in the Data Breach (the “Class”).
73. Excluded from the Class are Credit Freedom, its subsidiaries and affiliates, officers and directors, any entity in which Defendant has a controlling interest, the legal representative, heirs, successors, or assigns of any such excluded party, the judicial officer(s) to whom this action is assigned, and the members of their immediate families.
74. This proposed class definition is based on the information available to Plaintiff at this time. Plaintiff may modify the class definition in an amended pleading or when he moves for class certification, as necessary to account for any newly learned or changed facts as the situation develops and discovery gets underway.
75. Numerosity: Plaintiff is informed and believes, and thereon alleges, that there are at minimum, tens of thousands of members of the Class described above. The exact size of the Class and the identities of the individual members are identifiable through Defendant’s records, including but not limited to the files implicated in the Data Breach.
76. Commonality: This action involved questions of law and fact common to the Class. Such common questions include but are not limited to:
    1. Whether Defendant had a duty to protect the Private Information of Plaintiff and Class Members;
    2. Whether Defendant was negligent in collecting and storing Plaintiff’s and Class Members’ Private Information, and breached its duties thereby;
    3. Whether Plaintiff and Class Members are entitled to damages as a result of Defendant’s wrongful conduct; and
    4. Whether Plaintiff and Class Members are entitled to restitution as a result of Defendant’s wrongful conduct.
77. Typicality: Plaintiff’s claims are typical of the claims of the members of the Class. The claims of the Plaintiff and members of the Class are based on the same legal theories and arise from the same unlawful and willful conduct. Plaintiff and members of the Class were all customers of Defendant, and each had their Private Information exposed and/or accessed by an unauthorized third-party.
78. Adequacy of Representation: Plaintiff is an adequate representative of the Class because his interests do not conflict with the interests of the members of the Class. Plaintiff will fairly, adequately, and vigorously represent and protect the interests of the members of the Class and has no interests antagonistic to the members of the Class. In addition, Plaintiff has retained counsel who are competent and experienced in the prosecution of class action litigation. The claims of Plaintiff and the Class Members are substantially identical as explained above.
79. Superiority: This class action is appropriate for certification because class proceedings are superior to other available methods for the fair and efficient adjudication of this controversy and joinder of all members of the Class is impracticable. This proposed class action presents fewer management difficulties than individual litigation, and provides the benefits of single adjudication, economies of scale, and comprehensive supervision by a single court. Class treatment will create economies of time, effort, and expense, and promote uniform decision-making.
80. Predominance: Common questions of law and fact predominate over any questions affecting only individual Class Members. Similar or identical violations, business practices, and injuries are involved. Individual questions, if any, pale by comparison, in both quality and quantity, to the numerous common questions that dominate this action. For example, Defendant’s liability and the fact of damages are common to Plaintiff and each member of the Class. If Defendant breached its duty to Plaintiff and Class Members, then Plaintiff and each Class member suffered damages by that conduct.
81. Injunctive Relief: Defendant has acted and/or refused to act on grounds that apply generally to the Class, making injunctive and/or declaratory relief appropriate with respect to the Class under Fed. R. Civ. P. 23(b)(2).
82. Ascertainability: Members of the Class are ascertainable. Class membership is defined using objective criteria, and Class Members may be readily identified through Defendant’s books and records.

Claims for Relief

COUNT I — NEGLIGENCE (On Behalf of Plaintiff and the Class)

83. Plaintiff re-alleges the above factual allegations as if fully set forth herein.
84. Plaintiff and Class Members provided their Private Information to Defendant as a condition of obtaining services from Defendant.
85. Defendant owed a duty to Plaintiff and Class Members to exercise reasonable care in securing, safeguarding, storing, and protecting the PII collected from them from being compromised, lost, stolen, accessed and misused by unauthorized parties. This duty includes, among other things, designing, maintaining, overseeing, and testing Defendant’s security systems to ensure that PII in Credit Freedom’s possession was adequately secured and protected.
86. Defendant had full knowledge of the sensitivity of the Private Information and the types of harm that Plaintiff and Class Members could and would suffer if their Private Information were wrongfully disclosed.
87. Defendant owed a duty of care to Plaintiff and Class Members to provide reasonable security, consistent with industry standards, to ensure that its systems and networks adequately protected their Private Information.
88. Defendant had a special relationship with Plaintiff and Class Members. Plaintiff’s and Class Members’ willingness to entrust Credit Freedom with their Private Information as a condition of receiving resources was predicated on the understanding that Credit Freedom would take adequate security precautions to protect their PII.
89. By assuming the responsibility to collect and store this data, Defendant had duties of care to use reasonable means to secure and to prevent disclosure of the information, and to safeguard the information from theft.
90. Plaintiff and members of the Class entrusted Defendant with their PII with the understanding that Credit Freedom would safeguard their information.
91. Defendant’s conduct also created a foreseeable risk of harm to Plaintiff and Class Members by failing to: (1) secure its systems and exercise adequate oversight of its data security protocols; (2) ensure compliance with industry standard data security practices, (3) implement adequate system and event monitoring, and (4) implement the systems, policies, and procedures necessary to prevent the Data Breach.
92. Defendant knew, or should have known of, the risks inherent in collecting and storing PII, the vulnerabilities of its systems, and the importance of adequate security. Defendant should have been aware of numerous, well-publicized data breaches in the months and years preceding the Data Breach.
93. Defendant breached its common law duty to act with reasonable care in collecting and storing the Private Information of its customers, which exists independently from any contractual obligations between the parties. Specifically, Defendant breached its common law, statutory, and other duties to Plaintiff and Class Members in numerous ways, including by:
    1. failing to adopt reasonable data security measures, practices, and protocols;
    2. failing to implement data security systems, practices, and protocols sufficient to protect Plaintiff’s and Class Members’ PII;
    3. storing former Plaintiff’s and Class Members’ PII longer than reasonably necessary;
    4. failing to comply with industry-standard data security measures; and
    5. failing to timely disclose critical information regarding the nature of the Data Breach.
94. Defendant’s failure to implement and maintain adequate data security measures to protect Plaintiff’s and Class Members’ Private Information created conditions conducive to a foreseeable, intentional criminal act in the form of the Data Breach. Plaintiff and Class Members did not contribute to the Data Breach or the subsequent misuse of their Private Information.
95. Defendant owed a duty of care to Plaintiff and Class Members to provide data security consistent with industry standards and other requirements discussed herein, and to ensure that its systems and networks, and the personnel responsible for them, adequately protected the Private Information.
96. Moreover, Defendant had a duty to promptly and adequately notify Plaintiff and Class Members of the Data Breach.
97. Defendant had and continues to have duties to adequately disclose that the Private Information of Plaintiff and Class Members within Defendant’s possession might have been compromised, how it was compromised, and precisely the types of data that were compromised and when. Such notice is necessary to allow Plaintiff and Class Members to take steps to prevent, mitigate, and repair any identity theft and the fraudulent use of their Private Information by third parties.
98. Defendant’s conduct was particularly unreasonable given the nature and amount of Private Information it obtained and stored and the foreseeable consequences of the immense damages that would result to Plaintiff and Class Members.
99. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class Members have and will suffer damages including, but not limited to: (i) the loss of value of their Private Information and loss of opportunity to determine for themselves how their PII is used; (ii) the publication and/or theft of their PII; (iii) out-of-pocket expenses associated with the prevention, detection, and recovery from identity theft, tax fraud, and/or unauthorized use of their PII; (iv) lost opportunity costs associated with addressing and attempting to mitigate the actual and future consequences of the Data Breach, including, but not limited to, efforts spent researching how to prevent, detect, contest and recover from tax fraud and identity theft; (v) time, effort, and expense associated with placing fraud alerts or freezes on credit reports; (vi) anxiety, emotional distress, loss of privacy, and other economic and non-economic losses; (vii) the continued risk to their PII, which remains in Defendant’s possession and is subject to further unauthorized disclosures so long as Credit Freedom fails to undertake appropriate and adequate measures to protect it; and (viii) future costs in terms of time, effort and money that will be expended to prevent, detect, contest, and repair the inevitable and continuing consequences of compromised for the rest of their lives.
100. But for Defendant’s wrongful and negligent breaches of duties owed to Plaintiff and Class Members, the Private Information of Plaintiff and Class Members would not have been compromised.
101. There is a close causal connection between Defendant’s failure to implement security measures to protect the Private Information of Plaintiff and Class Members and the harm, or risk of imminent harm, suffered by Plaintiff and Class Members. The Private Information of Plaintiff and Class Members was lost and accessed as the proximate result of Defendant’s failure to exercise reasonable care in safeguarding such Private Information by adopting, implementing, and maintaining appropriate security measures.
102. As a direct and proximate result of Defendant’s negligence, Plaintiff and Class Members have suffered and will suffer injury, including but not limited to: (i) invasion of privacy; (ii) lost or diminished value of Private Information; (iii) lost time and opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; (iv) loss of benefit of the bargain; (v) an increase in spam calls, texts, and/or emails; and (vi) the continued and certainly increased risk to their Private Information, which: (a) remains unencrypted and available for unauthorized third parties to access and abuse; and (b) remains backed up in Defendant’s possession and is subject to further unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate measures to protect the Private Information.
103. As a direct and proximate result of Defendant’s negligence, Plaintiff and the Class have suffered and will continue to suffer other forms of injury and/or harm, including, but not limited to, anxiety, emotional distress, loss of privacy, and other economic and non-economic losses.
104. In addition, Credit Freedom had a duty to employ reasonable security measures under Section 5 of the FTC Act, 15 U.S.C. § 45, which prohibits “unfair . . . practices in or affecting commerce,” including, as interpreted and enforced by the FTC, the unfair practice of failing to use reasonable measures to protect confidential data.
105. Defendant’s violation of federal statutes, including the FTC Act, constitutes negligence per se.
106. Additionally, as a direct and proximate result of Defendant’s negligence and negligence per se, Plaintiff and the Class have suffered and will suffer the continued risks of exposure of their Private Information, which remain in Defendant’s possession and is subject to further unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate measures to protect the Private Information in its continued possession.
107. Plaintiff and Class Members are therefore entitled to damages, including restitution and unjust enrichment, declaratory and injunctive relief, and attorneys’ fees, costs, and expenses.

COUNT II — BREACH OF IMPLIED CONTRACT (On Behalf of Plaintiff and the Class)

108. Plaintiff re-alleges the above factual allegations as if fully set forth herein.
109. In connection with obtaining services from Defendant, Plaintiff and Class Members entered into implied contracts with Credit Freedom.
110. Plaintiff and Class Members were required to deliver their Private Information to Defendant as part of the process of obtaining services from Defendant.
111. Defendant required Class Members to provide their Private Information in order to obtain services from Defendant. Plaintiff and Class Members accepted Defendant’s offers and provided their Private Information to Defendant.
112. Defendant accepted possession of Plaintiff’s and Class Members’ Private Information for the purpose of providing services to Plaintiff and Class Members.
113. When Plaintiff and Class Members provided their PII to Credit Freedom, either directly or indirectly, as a pre-condition for services, they entered into implied contracts with Credit Freedom.
114. Pursuant to these implied contracts, in exchange for the consideration and PII provided by Plaintiff and Class Members, Defendant agreed to, among other things, and Plaintiff and Class Members understood that Credit Freedom would: (1) provide services to Plaintiff and Class Members; (2) implement reasonable measures to protect the security and confidentiality of Plaintiff’s and Class Members’ PII; and (3) protect Plaintiff’s and Class Members’ PII in compliance with federal and state laws and regulations and industry standards.
115. In entering into such implied contracts, Plaintiff and Class Members reasonably believed and expected that Defendant’s data security practices complied with relevant laws and regulations and were consistent with industry standards.
116. Implicit in the agreement between Plaintiff and Class Members and Defendant to provide Private Information, was the latter’s obligation to:
     1. use such Private Information for business purposes only,
     2. take reasonable steps to safeguard that Private Information,
     3. prevent unauthorized disclosures of the Private Information,
     4. provide Plaintiff and Class Members with prompt and sufficient notice of any and all unauthorized access and/or theft of their Private Information,
     5. reasonably safeguard and protect the Private Information of Plaintiff and Class Members from unauthorized disclosure or uses, and
     6. retain the Private Information only under conditions that kept such information secure and confidential.
117. The protection of PII was a material term of the implied contracts between Plaintiff and Class Members, on the one hand, and Defendant, on the other hand. Indeed, as set forth herein, Defendant recognized its duty to provide adequate data security and ensure the privacy of its customers’ PII with its practice of providing a privacy policy on its website.
118. Plaintiff and Class Members performed their obligations under the implied contract when they provided Defendant with their PII.
119. Defendant breached its obligations under its implied contracts with Plaintiff and Class Members in failing to implement and maintain reasonable security measures to protect and secure their PII and in failing to implement and maintain security protocols and procedures to protect Plaintiff’s and Class Members’ PII in a manner that complies with applicable laws, regulations, and industry standards.
120. The mutual understanding and intent of Plaintiff and Class Members on the one hand, and Defendant, on the other, is demonstrated by their conduct and course of dealing.
121. On information and belief, at all relevant times, Defendant promulgated, adopted, and implemented written privacy policies whereby it expressly promised Plaintiff and Class Members that it would only disclose Private Information under certain circumstances, none of which relate to the Data Breach.
122. On information and belief, Defendant further promised to comply with industry standards and to make sure that Plaintiff’s and Class Members’ Private Information would remain protected.
123. Plaintiff and Class Members would not have entrusted their Private Information to Defendant in the absence of the implied contract between them and Defendant to keep their information reasonably secure.
124. Plaintiff and Class Members would not have entrusted their Private Information to Defendant in the absence of their implied promise to monitor its computer systems and networks to ensure that it adopted reasonable data security measures.
125. Plaintiff and Class Members fully and adequately performed their obligations under the implied contracts with Defendant.
126. Defendant breached the implied contracts it made with Plaintiff and the Class by failing to safeguard and protect their Private Information, by failing to delete the information of Plaintiff and the Class in a timely manner if it was no longer needed, and by failing to provide accurate notice to them that Private Information was compromised as a result of the Data Breach.
127. Defendant breached the implied contracts by failing to maintain adequate computer systems and data security practices to safeguard Private Information, failing to timely and accurately disclose the Data Breach to Plaintiff and Class Members, and continued acceptance of Private Information and storage of other personal information after Defendant knew, or should have known, of the security vulnerabilities of the systems that were exploited in the Data Breach.
128. Defendant’s breach of its obligations of its implied contracts with Plaintiff and Class Members directly resulted in the Data Breach and the injuries that Plaintiff and Class Members have suffered from the Data Breach.
129. Plaintiff and Class Members suffered by virtue of Defendant’s breach of their implied contracts because: (i) they paid for data security protection they did not receive; (ii) they face a substantially increased risk of identity theft – risks justifying expenditures for protective and remedial services for which they are entitled to compensation; (iii) their PII was improperly disclosed to unauthorized individuals; (iv) the confidentiality of their PII has been breached; (v) they were deprived of the value of their PII, for which there is a well-established national and international market; (vi) they have lost time and incurred expenses, and will incur future costs to mitigate and remediate the effects of the Data Breach, including the increased risks of identity theft they face and will continue to face; and (vii) they have overpaid for the services they received without adequate data security.
130. Plaintiff and Class Members are entitled to compensatory, consequential, and nominal damages suffered as a result of the Data Breach.
131. Plaintiff and Class Members are also entitled to injunctive relief requiring Defendant to, e.g., (i) strengthen its data security systems and monitoring procedures; (ii) submit to future annual audits of those systems and monitoring procedures; and (iii) immediately provide adequate credit monitoring to all Class Members.

COUNT III — BREACH OF THE IMPLIED COVENANT OF GOOD FAITH AND FAIR DEALING (On Behalf of Plaintiff and the Class)

132. Plaintiff re-alleges the above factual allegations as if fully set forth herein.
133. Every contract in the state of Pennsylvania has an implied covenant of good faith and fair dealing. This implied covenant is an independent duty and may be breached even when there is no breach of a contract’s actual and/or express terms.
134. Plaintiff and Class Members have complied with and performed all conditions of their contracts with Defendant.
135. Defendant breached the implied covenant of good faith and fair dealing by failing to maintain adequate computer systems and data security practices to safeguard PII, failing to timely and accurately disclose the Data Breach to Plaintiff and Class Members, and continued acceptance of PII and storage of other personal information after Defendant knew or should have known of the security vulnerabilities of the systems that were exploited in the Data Breach.
136. Defendant acted in bad faith and/or with malicious motive in denying Plaintiff and Class Members the full benefit of their bargains as originally intended by the parties, thereby causing them injury in an amount to be determined at trial.

COUNT IV — UNJUST ENRICHMENT (On Behalf of Plaintiff and the Class)

137. Plaintiff re-alleges the factual allegations in paragraphs 1–82 as if fully set forth herein.
138. This count is plead in the alternative to the breach of implied contract count above.
139. By its wrongful acts and omissions described herein, Defendant has obtained a benefit by unduly taking advantage of Plaintiff and Class Members.
140. Plaintiff and Class Members conferred a benefit on Defendant, whereby they provided their Private Information to Defendant in connection with receiving certain services.
141. Defendant prior to and at the time Plaintiff and Class Members entrusted it with their PII, caused Plaintiff and Class Members to reasonably believe that it would keep that Private Information secure.
142. The monies Defendant was paid in its ordinary course of business included a premium for Defendant’s cybersecurity obligations and were supposed to be used by Defendant, in part, to pay for the administrative and other costs of providing reasonable data security and protection for Plaintiff’s and Class Members’ Private Information.
143. Defendant knew that Plaintiff and Class Members conferred a benefit upon it and accepted and retained that benefit by accepting and retaining the Private Information entrusted to it. Defendant profited from Plaintiff’s retained data and used Plaintiff’s and Class Members’ Private Information for business purposes.
144. Defendant failed to disclose facts pertaining to its substandard information systems, or defects and vulnerabilities therein before Plaintiff and Class Members made their decisions to provide Defendant with their Private Information.
145. Defendant enriched itself by hoarding the costs it reasonably should have expended on data security measures to secure Plaintiff’s and Class Members’ Private Information. Instead of providing a reasonable level of security that would have prevented the Data Breach, Defendant calculated to increase its own profit at the expense of Plaintiff and Class Members by utilizing cheap, ineffective security measures and diverting those funds to its own personal use. Plaintiff and Class Members, on the other hand, suffered as a direct and proximate result of Defendant’s decision to prioritize its own profits over the requisite security and the safety of their Private Information.
146. Defendant failed to provide reasonable security, safeguards, and protections to the Private Information of Plaintiff and Class Members, and, as a result, Defendant was overpaid.
147. Under principles of equity and good conscience, Defendant should not be permitted to retain any of the benefits that Plaintiff and Class Members conferred upon it.
148. Plaintiff and Class Members have no adequate remedy at law.
149. As a direct and proximate result of Defendant’s conduct, Plaintiff and Class Members have suffered and will suffer injury, including but not limited to: (i) invasion of privacy; (ii) lost or diminished value of Private Information; (iii) lost time and opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; (iv) loss of benefit of the bargain; (v) an increase in spam calls, texts, and/or emails; and (vi) the continued and certainly increased risk to their Private Information, which: (a) remains unencrypted and available for unauthorized third parties to access and abuse; and (b) remains backed up in Defendant’s possession and is subject to further unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate measures to protect the Private Information.
150. Plaintiff and Class Members are entitled to full refunds, restitution, and/or damages from Defendant and/or an order proportionally disgorging all profits, benefits, and other compensation obtained by Defendant from its wrongful conduct. This can be accomplished by establishing a constructive trust from which Plaintiff and Class Members may seek restitution or compensation.

COUNT V — DECLARATORY JUDGMENT (On Behalf of Plaintiff and the Class)

151. Plaintiff re-alleges the above factual allegations as if fully set forth herein.
152. Under the Declaratory Judgment Act, 28 U.S.C. §§ 2201, et seq., this Court is authorized to enter a judgment declaring the rights and legal relations of the parties and grant further necessary relief. Furthermore, the Court has broad authority to restrain acts, such as here, that are tortious and violate the terms of the federal and state statutes described in this Complaint.
153. An actual controversy has arisen in the wake of the Data Breach regarding Plaintiff’s and Class Members’ Private Information and whether Credit Freedom is currently maintaining data security measures adequate to protect Plaintiff and Class Members from further data breaches that compromise their PII. Plaintiff alleges that Credit Freedom’s data security measures remain inadequate. Furthermore, Plaintiff continues to suffer injury as a result of the compromise of his PII and remains at imminent risk that further compromises of his PII will occur in the future.
154. Pursuant to its authority under the Declaratory Judgment Act, this Court should enter a judgment declaring, among other things, the following:
     1. Credit Freedom owes a legal duty to secure customers’ Private Information and to timely notify impacted individuals of a data breach under the common law, and various state statutes; and
     2. Credit Freedom continues to breach this legal duty by failing to employ reasonable measures to secure Private Information in its possession.
155. This Court also should issue corresponding prospective injunctive relief requiring Credit Freedom to employ adequate security protocols consistent with law and industry standards to protect Private Information in Credit Freedom’s data network.
156. If an injunction is not issued, Plaintiff will suffer irreparable injury, and lack an adequate legal remedy, in the event of another data breach at Credit Freedom. The risk of another such breach is real, immediate, and substantial. If another breach at Credit Freedom occurs, Plaintiff will not have an adequate remedy at law because many of the resulting injuries are not readily quantified and he will be forced to bring multiple lawsuits to rectify the same conduct.
157. The hardship to Plaintiff if an injunction is not issued exceeds the hardship to Credit Freedom if an injunction is issued. Plaintiff will likely be subjected to substantial identity theft and other damage. On the other hand, the cost to Credit Freedom of complying with an injunction by employing reasonable prospective data security measures is relatively minimal, and Credit Freedom has a pre-existing legal obligation to employ such measures.
158. Issuance of the requested injunction will not disserve the public interest. In contrast, such an injunction would benefit the public by preventing another data breach at Credit Freedom, thus eliminating the additional injuries that would result to Plaintiff and customers whose confidential information would be further compromised.

Remedies Sought

• For an Order certifying this action as a class action, appointing Plaintiff as class representative for the Class, and appointing his counsel to represent the Class;
• For equitable relief enjoining Credit Freedom from engaging in the wrongful conduct complained of herein pertaining to the misuse and/or disclosure of Plaintiff’s and Class Members’ PII, and from refusing to issue prompt, complete and accurate disclosures to Plaintiff and Class Members;
• For equitable relief compelling Credit Freedom to utilize appropriate methods and policies with respect to customer data collection, storage, and safety, and to disclose with specificity the types of PII compromised as a result of the Data Breach;
• For equitable relief requiring restitution and disgorgement of the revenues wrongfully retained as a result of Credit Freedom’s wrongful conduct;
• Ordering Credit Freedom to pay for not less than ten years of credit monitoring services for Plaintiff and Class Members;
• For an award of actual damages, compensatory damages, statutory damages, and statutory penalties, in an amount to be determined, as allowable by law;
• For an award of punitive damages, as allowable by law;
• For an award of attorneys’ fees and costs, and any other expense, including expert witness fees;
• Pre- and post-judgment interest on any amounts awarded; and
• Such other and further relief as this court may deem just and proper.

Frequently Asked Questions

Has Credit Freedom and Restoration Corporation been found liable in this case?

No. This is a complaint — a legal filing that contains allegations made by Michael Aiken. Credit Freedom and Restoration Corporation has not been found liable for any wrongdoing. A finding of liability requires a court proceeding where evidence is presented and evaluated by a judge or jury.

What data does the complaint allege was compromised?

The complaint alleges the following types of Private Information were exfiltrated: driver’s license numbers, Social Security numbers, plaintext credit card data and card images, utility bills, and credit reports. The complaint alleges approximately 30,000 individuals were affected.

What is the current status of this case?

This case was filed on March 19, 2026 in the United States District Court for the Eastern District of Pennsylvania. See the CourtListener docket linked at the bottom of this page for the complete filing record. This page is updated automatically when new documents are filed.

Who is included in the proposed class?

The complaint defines the proposed class as all individuals in the United States whose Private Information was compromised in the Data Breach. The complaint excludes Credit Freedom, its subsidiaries and affiliates, officers and directors, any entity in which Defendant has a controlling interest, and the judicial officer(s) to whom this action is assigned.

Where can I read the full complaint?

The full complaint is publicly available on CourtListener. The Facts as Alleged section above reproduces the complaint’s key factual allegations verbatim. The complete 34-page filing is available through the PDF link at the top of this page or through the docket link below.

Source: CourtListener — Aiken v. Credit Freedom and Restoration Corporation, Docket 72514092. Information on this page is taken from the court complaint. These are allegations; no finding of fact has been made.