# Paidwork Data Breach Class Action - Full Complaint (llms-full) > Full text of the class action complaint filed July 24, 2026 in the United States District Court for the Eastern District of California, Sacramento Division: Magen Melissa Vennor v. Paidwork LLC, Case No. 2:26-at-01250. This file is intended for AI / LLM ingestion and reproduces the text extracted from the filed PDF. The authoritative source is the PDF available at https://hallattorneys.com/dockets/paidwork/01-complaint.pdf. ## Case metadata - Case name: Magen Melissa Vennor, individually and on behalf of all others similarly situated, v. Paidwork LLC. - Case number: 2:26-at-01250. - Docket entry: ECF No. 1. - Court: United States District Court, Eastern District of California, Sacramento Division. - Filed: July 24, 2026. - Jury trial demanded: Yes. - Proposed classes: North American Data Breach Class; Actual Misuse Subclass. - Claims: negligence; breach of implied contract; breach of confidence; restitution and unjust enrichment; declaratory and injunctive relief. - Plaintiff's counsel: Cutter Law, P.C.; Hall Attorneys, P.C.; Ahdoot & Wolfson, P.C. - Complaint PDF: https://hallattorneys.com/dockets/paidwork/01-complaint.pdf. - Docket: https://hallattorneys.com/dockets/paidwork. - Case overview: https://hallattorneys.com/paidwork-data-breach. - Filing announcement: https://hallattorneys.com/news/paidwork-class-action. - Contact: Nicholas Hall, Hall Attorneys, P.C., nhall@hallattorneys.com, +1 713 428 8967. ## Notice Attorney advertising. The complaint contains allegations only; no findings have been made. The authoritative court filing is the PDF; extraction can alter spacing, pagination, and symbols. ## Full text of the complaint Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 1 of 25 1 Margot Cutter (SBN 306789) Tina Wolfson (SBN 174806) mcutter@cutterlaw.com twolfson@ahdootwolfson.com 2 CUTTER LAW, PC Jeff S. Westerman (SBN 94559) 401 Watt Ave. jwesterman@ahdootwolfson.com 3 Sacramento, CA 95864 Lisa Cintron (SBN 356009) 4 Telephone: 916.290.9400 lcintron@ahdootwolfson.com Facsimile: 916.588.9314 AHDOOT & WOLFSON, PC 5 2600 W. Olive Ave., Suite 500 Nicholas Andrew Hall (Texas Bar No. Burbank, California 91505 6 24069863)* (310) 474-9111 (telephone) HALL ATTORNEYS, PC (310) 474-8585 (facsimile) 7 P.O. Box 1370 8 Edna, Texas 77957 Telephone: (713) 428-8967 9 Email: nhall@hallattorneys.com *pro hac vice forthcoming 10 11 Attorneys for Plaintiff and the Proposed Classes 12 UNITED STATES DISTRICT COURT 13 EASTERN DISTRICT OF CALIFORNIA 14 SACRAMENTO DIVISION 15 16 MAGEN MELISSA VENNOR, individually and on Case No. ____________________ behalf of all others similarly situated, 17 CLASS ACTION COMPLAINT Plaintiff, 1. Negligence 18 v. 2. Breach of Implied Contract 19 3. Breach of Confidence PAIDWORK LLC, 4. Restitution / Unjust Enrichment 20 5. Declaratory and Injunctive Relief Defendant. 21 DEMAND FOR JURY TRIAL 22 23 24 25 26 27 28 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 2 of 25 1 Plaintiff Magen Melissa Vennor ("Plaintiff"), individually and on behalf of all others similarly 2 situated, alleges the following against Defendant Paidwork LLC ("Paidwork" or "Defendant") upon 3 personal knowledge as to herself and her own acts, and upon information and belief as to all other 4 matters, after an investigation by counsel that is continuing: 5 NATURE OF THE ACTION 6 1. This putative class action arises from Paidwork's failure to use reasonable safeguards 7 to protect the highly sensitive identity, credential, payment, and financial information that it collected 8 and retained from millions of users, and from its failure to provide prompt and adequate notice after 9 that information was accessed, acquired, exfiltrated, offered for sale, and ultimately disclosed publicly 10 in a massive 2026 data breach (the "Data Breach"). 11 2. Paidwork operates a global gig-economy and microtask platform through which users 12 create accounts, perform online tasks, track earnings, and designate PayPal or bank-transfer 13 information for withdrawals. To provide those services, Paidwork required or induced users to entrust 14 it with personal and financial information, including names, email addresses, passwords, physical 15 addresses, telephone numbers, dates of birth, device and IP information, payment information, and 16 payout histories (collectively, "Private Information"). 17 3. In or about March 2026, a threat actor claimed to have penetrated Paidwork's 18 production environment and obtained approximately 11 gigabytes of data associated with tens of 19 millions of users. The data was reportedly offered for sale by early April 2026 and was later posted 20 publicly in July 2026. 21 4. Have I Been Pwned ("HIBP") reports that the compromised dataset contains 22 approximately 23.3 million unique accounts and includes bank account numbers, dates of birth, 23 device information, education levels, email addresses, financial transactions, genders, IP addresses, 24 names, passwords stored as bcrypt hashes, personal interests, phone numbers, physical addresses, 25 profile photographs, banking information, and worker payout histories. 26 5. HIBP notified Plaintiff on July 19, 2026 that her email address appeared in the 27 Paidwork breach dataset. Plaintiff received that notice months after the March 2026 intrusion and 28 after she had already suffered actual account takeover and financial misuse. 1 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 3 of 25 1 6. Beginning in the same month as the reported breach, Plaintiff experienced a cascade 2 of identity- and account-takeover events. On March 31, 2026, PayPal notified her that a new PayPal 3 account had been created using her name and restricted core features of her existing account. On May 4 27 and June 12, KOHO detected logins from an unrecognized device; the intruder changed the 5 account email and caused unauthorized transfers and charges. Plaintiff currently has documentation 6 of at least CAD $1,166.66 in unauthorized KOHO transactions, and the complete loss remains under 7 investigation. On July 20, 2026, she reported the identity theft and account takeovers to the Federal 8 Bureau of Investigation's Internet Crime Complaint Center ("IC3"). 9 7. On information and belief, the chronology and attack pattern are consistent with 10 misuse of data exposed in the Paidwork Data Breach. Plaintiff used the same password for Paidwork 11 and other online accounts; HIBP later confirmed her Paidwork email address in the corpus; and the 12 corpus reportedly contained password hashes, bank-account numbers, financial-transaction histories, 13 email addresses, device information, phone numbers, physical addresses, and other identity data that 14 can be combined to conduct credential-stuffing, account-recovery, and social-engineering attacks. 15 8. Paidwork's failure to provide prompt notice independently magnified the harm. Had 16 Paidwork disclosed the Data Breach at or near the time it occurred or was offered for sale, Plaintiff 17 could have—and, consistent with her documented history of vigilant self-protection, would have— 18 immediately hardened or replaced the banking, payment, email, and telecommunications credentials 19 associated with the exposed data before they were exploited. 20 9. Plaintiff brings this action to recover compensatory, restitutionary, nominal, and other 21 available relief; to obtain appropriate declaratory and injunctive relief; to require Paidwork to 22 remediate the security and notification failures that caused the Data Breach; and to protect the Class 23 from continuing misuse of data that cannot simply be recalled or made private again. 24 PARTIES 25 10. Plaintiff Magen Melissa Vennor is a citizen of Canada and is domiciled in and resides 26 in Edmonton, Alberta, Canada. 27 28 2 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 4 of 25 1 11. Defendant Paidwork LLC is a limited liability company that owns, operates, controls, 2 and/or is responsible for the Paidwork website, mobile applications, user-account systems, payout 3 functions, databases, and privacy and cybersecurity practices at issue. 4 12. Paidwork LLC is organized under the laws of California with its principal place of 5 business located at 3400 Cottage Way, Suite G2 #27204, Sacramento, California 95825. Paidwork 6 LLC identifies Sacramento as the place for dispute resolution under its currently posted terms. 7 13. Paidwork's exact corporate structure, members, managers, affiliates, database owners, 8 responsible operating entities, and CAFA citizenship facts are peculiarly within Defendant's 9 knowledge. Plaintiff reserves the right to amend this Complaint to conform the jurisdictional 10 allegations and to add or substitute related entities and responsible parties as discovery warrants. 11 JURISDICTION AND VENUE 12 14. This Court has original subject-matter jurisdiction under the Class Action Fairness Act 13 of 2005 ("CAFA"), 28 U.S.C. section 1332(d). 14 15. On information and belief, the proposed Classes contain far more than 100 members, 15 satisfying 28 U.S.C. § 1332(d)(5)(B). HIBP reports approximately 23.3 million compromised 16 accounts worldwide, and Paidwork offered its services throughout the United States and Canada. 17 Paidwork's own records will establish the precise number and citizenship of North American Class 18 members. 19 16. The aggregate amount in controversy exceeds $5,000,000, exclusive of interest and 20 costs. Among other relief, Class members seek actual damages for financial misuse, loss of funds, 21 mitigation expenses and time, loss of data value and privacy, restitution, nominal damages where 22 available, and the value of classwide injunctive relief. The claims of individual Class members are 23 aggregated under 28 U.S.C. § 1332(d)(6). 24 17. Minimal diversity exists under 28 U.S.C. § 1332(d)(2)(B). Plaintiff is a citizen of 25 Canada and a member of both proposed Classes, and Paidwork is, on information and belief, a citizen 26 of one or more States within the United States. CAFA expressly defines "class members" to include 27 named and unnamed persons who fall within the proposed class definition. 28 U.S.C. 28 § 1332(d)(1)(D). 3 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 5 of 25 1 18. For CAFA purposes, an unincorporated association such as Paidwork LLC is deemed 2 a citizen of the State in which it has its principal place of business and the State under whose laws it 3 is organized. 28 U.S.C. § 1332(d)(10). Neither Federal Rule of Civil Procedure 23 nor CAFA requires 4 a named class representative to be a United States citizen or resident. 5 19. On information and belief, no mandatory CAFA exception applies. The proposed 6 Classes are geographically dispersed, the claims arise from a breach affecting users across the United 7 States and Canada, and the principal injuries were not confined to California. 8 20. Plaintiff has Article III standing. She alleges completed and concrete injuries, 9 including unauthorized creation or attempted use of a PayPal account in her name; restriction and loss 10 of functionality of her existing PayPal account; repeated email-account recovery attacks; 11 unauthorized access to and takeover of her KOHO account; at least CAD $1,166.66 in documented 12 unauthorized transfers and charges; an unresolved negative balance and resulting collection and credit 13 risk; replacement of her telephone number and device; credit-monitoring, identity-protection, and 14 fraud-alert expenses and burdens; extensive mitigation time; and continuing exposure to misuse of 15 data that Paidwork allegedly continues to retain. Those injuries are traceable to the alleged security 16 and notification failures and are redressable through damages and appropriate equitable relief. 17 21. This Court may grant declaratory and further relief under 28 U.S.C. sections 2201 and 18 2202 and has authority to award the legal and equitable remedies requested below. 19 22. This Court has personal jurisdiction over Paidwork because Paidwork publicly holds 20 itself out as located in Sacramento, purposefully directs its services to residents of this District and 21 users worldwide from U.S.-based operations, states that data of non-U.S. users may be transferred to, 22 stored in, or processed in the United States, and, on information and belief, made or directed the 23 challenged cybersecurity, data-retention, incident-response, and notification decisions in this District 24 or elsewhere in the United States. 25 23. Paidwork has also deliberately invoked California law and selected Sacramento, 26 California as the location for dispute resolution in its currently posted Terms of Service. Plaintiff does 27 not concede that she assented to those post-breach terms or their arbitration provision, but Paidwork's 28 own forum selection confirms substantial, purposeful contacts with Sacramento and California. 4 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 6 of 25 1 24. Venue is proper in this District under 28 U.S.C. § 1391(b)(1) and (2) because Paidwork 2 identifies a registered address in Sacramento and, on information and belief, resides in this District 3 for venue purposes, and because a substantial part of the acts and omissions giving rise to the claims 4 - including data governance, security, retention, incident response, and notification decisions - 5 occurred in or were directed from this District. 6 25. Intradistrict assignment to the Sacramento Division is proper under Eastern District of 7 California Local Rule 120(d) because Defendant identifies a Sacramento County address and the 8 claims arise, in substantial part, from conduct occurring in or directed from Sacramento County. 9 FACTUAL ALLEGATIONS 10 A. Paidwork collected high-risk credential, identity, and financial information 11 26. Paidwork markets itself as an online earning platform available to users around the 12 world. Users can play games, complete surveys, watch videos, perform tasks, and engage with offers 13 in exchange for purported earnings. 14 27. To use Paidwork, users create an account and provide an email address and password. 15 Paidwork's current Privacy Policy states that Paidwork collects names, email addresses, passwords, 16 payment information used to facilitate PayPal or bank-transfer withdrawals, device and usage 17 information, IP addresses, and information obtained from payment providers and banks. 18 28. Paidwork's current Terms likewise state that withdrawals are made through bank 19 transfer and PayPal and that its account systems track users, tasks, earnings, and payout information. 20 29. Paidwork knew that the Private Information it collected was highly sensitive. 21 Payment-account identifiers, bank information, email addresses, dates of birth, physical addresses, 22 phone numbers, IP and device data, payout histories, and password hashes can be combined to commit 23 account takeover, credential stuffing, targeted phishing, identity fraud, financial fraud, and social- 24 engineering attacks. 25 30. Paidwork also knew or should have known that many ordinary consumers reuse 26 passwords across multiple services and that exfiltration of even hashed passwords creates a 27 foreseeable risk when passwords are weak, reused, or susceptible to offline cracking. Credential reuse 28 5 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 7 of 25 1 is a known reason why a breach of one service can lead to compromise of email, payment, and banking 2 accounts elsewhere. 3 31. Users did not provide their Private Information for sale, criminal use, or public 4 distribution. They entrusted it to Paidwork for the limited purposes of creating and authenticating 5 accounts, tracking tasks and purported earnings, processing withdrawals, preventing fraud, and 6 administering the platform. 7 32. Paidwork benefited commercially from collecting and retaining this information. The 8 information enabled Paidwork to operate its platform, authenticate and profile users, track 9 engagement, process or market payout functions, attract business partners and advertisers, and avoid 10 the costs of repeatedly recollecting user data. 11 33. Because Paidwork chose to collect and retain credential and financial information at 12 enormous scale, it had a corresponding duty to use security measures commensurate with the 13 sensitivity, volume, and foreseeable criminal value of that information. 14 B. Paidwork represented that it would secure and responsibly use user information 15 34. Paidwork's current Privacy Policy, effective March 29, 2026, states that Paidwork uses 16 information to authenticate identity, process withdrawals, secure the platform, detect and prevent 17 unauthorized access and fraudulent transactions, and comply with legal obligations. 18 35. That policy further states that Paidwork implements "robust security measures," 19 including encryption, firewalls, and secure data storage, to protect user information. It also states that 20 Paidwork will provide notice of material policy changes as required by law. 21 36. Plaintiff does not presently rely on the March 29, 2026 policy as the sole source of her 22 contractual rights because her account was created earlier. Paidwork's historical policies and signup 23 representations are within Defendant's possession and must be preserved and produced. The current 24 policy nevertheless reflects Paidwork's own acknowledgment that the information required robust 25 security and fraud-prevention controls during the relevant period. 26 37. Reasonable security for a platform retaining credential and financial data at Paidwork's 27 scale required, at minimum, appropriate data minimization and retention; strong access controls and 28 multifactor authentication for privileged systems; least-privilege permissions; network and database 6 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 8 of 25 1 segmentation; encryption and key management; secure password hashing parameters; vulnerability 2 management and patching; logging, monitoring, and anomaly detection; intrusion detection and 3 prevention; secure backup and exfiltration controls; employee and vendor security; incident-response 4 testing; and prompt notice sufficient to permit users to protect themselves. 5 38. On information and belief, Paidwork failed to implement one or more of these controls 6 adequately. The precise intrusion vector, dwell time, systems accessed, data tables exfiltrated, and 7 security-control failures are exclusively or predominantly within Paidwork's possession and will be 8 established through discovery and expert analysis. 9 39. Paidwork's deficient security and incident response were not excused by the criminal 10 conduct of third parties. Cyber intrusion, credential theft, database exfiltration, sale of user records, 11 credential cracking, and account takeover are foreseeable consequences of maintaining a large 12 repository of payment, identity, and credential information without reasonable safeguards. 13 C. Threat actors obtained and disseminated Paidwork user data 14 40. In March 2026, a threat actor claimed to have obtained data from Paidwork's 15 production systems. Public reporting in early April described an auction involving approximately 22 16 million user records and a sample containing emails, password hashes, names, addresses, device and 17 location information, partial banking details, and payment-platform information. 18 41. By no later than April 2, 2026, Paidwork had been contacted by a news organization 19 concerning the asserted breach and sale. 20 42. In July 2026, approximately 11 gigabytes of data attributed to Paidwork was 21 reportedly posted publicly rather than remaining available only to a private seller or buyer. Public 22 release materially increased the duration and breadth of the risk because any person with access to 23 the dataset could copy, analyze, redistribute, and weaponize it. 24 43. HIBP added the Paidwork incident to its breach database and reported approximately 25 23.3 million affected accounts. HIBP identified the compromised data categories as bank account 26 numbers, dates of birth, device information, education levels, email addresses, financial transactions, 27 genders, IP addresses, names, passwords, personal interests, phone numbers, physical addresses, and 28 profile photographs. 7 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 9 of 25 1 44. HIBP further described the dataset as including user-profile data, banking information, 2 worker payout history, and passwords stored as bcrypt hashes. Although bcrypt is designed to impede 3 rapid guessing, a stolen hash can still be attacked offline, particularly where the underlying password 4 is weak or reused. 5 45. The exposed fields are especially dangerous in combination. Email, password, device, 6 address, telephone, birth-date, payment, and transaction information can be correlated to defeat 7 account-recovery controls, answer identity-verification questions, impersonate users, target phishing, 8 open or access payment accounts, and launder or redirect funds. 9 46. Paidwork has not provided Plaintiff with a complete explanation of the incident, 10 including when the intrusion began, when it ended, when Paidwork discovered it, which systems were 11 accessed, what safeguards failed, which specific fields from Plaintiff's record were taken, who 12 received the information before public release, or what steps Paidwork took to prevent misuse. 13 D. Plaintiff entrusted Paidwork with information of the kind later exploited 14 47. Plaintiff registered her Paidwork account in approximately 2024 under her email 15 address and, in connection with the account and its payout functionality, supplied Paidwork with 16 personal information of the kinds compromised in the Data Breach, including at least an email 17 address, password, and PayPal account for payments. 18 48. Plaintiff used the same password for Paidwork and other online accounts. Like many 19 consumers, she did so for memorability and convenience. Plaintiff does not disclose the password or 20 its composition in this public pleading. After the takeover, she changed her credential practices and 21 began using a password manager. 22 49. HIBP notified Plaintiff on July 19, 2026 that her Paidwork email address was present 23 in the breach dataset. HIBP reported that the corpus included bank-account numbers, financial 24 transactions and payout histories, email addresses, passwords stored as bcrypt hashes, device 25 information, IP addresses, names, dates of birth, phone numbers, physical addresses, and other profile 26 information. 27 50. On information and belief, the exfiltrated Paidwork records associated users' account 28 identities with credential, banking, transaction, and payout information. Paidwork therefore placed 8 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 10 of 25 1 Plaintiff at foreseeable risk that an attacker could correlate her Paidwork email and reused password 2 with her financial, payment, email, and telecommunications accounts. 3 51. Before the account activity described below, Plaintiff had not received a warning from 4 Paidwork that its user database, password hashes, bank-account information, financial-transaction 5 histories, or payment-related records had been accessed, offered for sale, or publicly disseminated. 6 52. Timely notice mattered. Had Paidwork promptly disclosed the Data Breach at or near 7 the time it occurred or was offered for sale, Plaintiff could have—and, consistent with her documented 8 history of vigilant self-protection, would have—immediately hardened or replaced the banking, 9 payment, email, and telecommunications credentials associated with the exposed data before they 10 were exploited. 11 53. Plaintiff had no practical means to discover Paidwork's internal compromise herself. 12 Paidwork controlled the relevant systems, logs, and incident information and was the only party 13 positioned to warn her that the credential, identity, banking, and transaction data she had entrusted to 14 the platform was at risk. 15 E. Unauthorized account activity began in March 2026 16 54. On March 31, 2026, during the same month as the reported Data Breach, PayPal 17 notified Plaintiff that "there's a new PayPal account that's been created using your name." Plaintiff 18 did not create the duplicate account. PayPal restricted core features of Plaintiff's existing account 19 pending re-verification of her identity, address, card, and banking details. 20 55. The restrictions persisted for weeks. On April 28, 2026, PayPal sent Plaintiff, at the 21 same Outlook address later identified in the Paidwork dataset, a reminder stating, "It looks like 22 someone was trying to use your PayPal account without your permission," and advised that her ability 23 to send, receive, withdraw, and pay was paused until she uploaded photo identification and changed 24 her password. PayPal sent a further reminder on May 15, 2026. 25 56. Between late March and mid-April 2026, Plaintiff's Microsoft accounts were also 26 subjected to repeated account-recovery attempts, password-reset events, and security alerts. The 27 activity required Plaintiff to repeatedly re-secure those accounts, including changing a recovery email 28 and removing a passkey on April 13, 2026. Paidwork had not notified her of the Data Breach, so she 9 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 11 of 25 1 did not know that her Paidwork credentials and other exposed information could be part of the attack 2 pattern. 3 F. Plaintiff suffered a coordinated KOHO account takeover and financial misuse 4 57. On May 27, 2026, KOHO—the Canadian financial-services platform at which 5 Plaintiff held a deposit account—alerted Plaintiff to a login from a new device: an Android 14 device 6 identified as model SM-A042F. Plaintiff has never owned or used that device. Her devices at the 7 relevant times were an Apple iPhone and, beginning in mid-June 2026, a Samsung Galaxy S26+, 8 which is a different model. 9 58. On May 28, 2026, at approximately 6:26 a.m. local time, an international transfer of 10 CAD $977.17 was initiated from Plaintiff's KOHO account to a recipient identified as "Guillermo 11 Fernandez Martinez." Plaintiff did not initiate or authorize the transfer and does not know that 12 individual. 13 59. On June 12, 2026, the takeover escalated in a coordinated sequence. At approximately 14 5:07 a.m. local time, KOHO alerted Plaintiff to another login from the same unverified Android 15 device. At approximately 5:18 a.m., the email address on the account was changed away from 16 Plaintiff's control. At approximately 5:42 a.m., a CAD $35.00 Interac e-Transfer was sent to "Panda 17 Digital Media Limited." At approximately 6:09 a.m. and 6:12 a.m., charges of CAD $3.81 and CAD 18 $150.68 were made to the Skrill money-transfer service. Plaintiff authorized none of these 19 transactions or account changes. 20 60. Plaintiff detected the June 12 activity in real time, demanded an emergency lock on 21 her account within minutes, and reported the fraudulent Interac transfer to Interac's anti-phishing 22 address within approximately five minutes of its occurrence. Because the intruder had changed the 23 email address on the account, KOHO's support personnel initially could not locate Plaintiff's account 24 using her identifying information, causing a delay directly attributable to the takeover. 25 61. KOHO locked the account on June 14, 2026, stating that it did so "to prevent any 26 further unauthorized access." Plaintiff formally disputed the unauthorized transactions, opened in-app 27 disputes that remain under review, and, on June 16, 2026, escalated the matter in writing to 28 compliance personnel at Peoples Group, KOHO's issuing institution. She requested a regulator- 10 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 12 of 25 1 compliant final position letter and the session, IP-address, and device records associated with the 2 intrusion. Plaintiff also escalated the matter to the Ombudsman for Banking Services and Investments 3 and reported it to the Canadian Anti-Fraud Centre and law enforcement. 4 62. The itemized unauthorized transactions documented to date total CAD $1,166.66. On 5 information and belief, Plaintiff's total loss and exposure are higher: KOHO's fraud personnel 6 acknowledged Plaintiff's report that all funds in the account had been transferred out, and complete 7 itemization awaits KOHO's production of account records. 8 63. As of July 12, 2026, KOHO was demanding that Plaintiff pay a balance created by the 9 intrusion. Plaintiff disputes that balance. The demand exposes her to collection activity and credit 10 harm for sums she did not spend or authorize. 11 64. On July 20, 2026, Plaintiff filed an IC3 complaint regarding the identity theft and 12 account takeovers. Based on the information then available, she estimated her total loss at 13 approximately $4,000. Her current records document at least CAD $1,166.66 in itemized 14 unauthorized KOHO transactions, while the complete amount of loss, loss of use, fees, and disputed 15 balance remains subject to KOHO's records and the pending disputes. 16 65. In response, Plaintiff has undertaken extensive, documented mitigation. Among other 17 things, she replaced her mobile telephone number; replaced her mobile device and migrated device 18 platforms; repeatedly rotated passwords, passkeys, and recovery credentials across financial, email, 19 and platform accounts; maintained credit-monitoring and identity-protection services; maintained a 20 fraud alert with a national credit bureau; filed and prosecuted disputes and complaints with financial 21 institutions, a payment network, a federal complaints body, an ombudsman, law-enforcement 22 agencies, and anti-fraud agencies in two countries; and devoted dozens of hours—and, on some days, 23 dozens of communications—to securing her accounts and documenting the intrusions. 24 66. Plaintiff has not been made whole. She continues to face unresolved financial disputes, 25 a negative or impaired account balance, potential collection and credit consequences, loss of use of 26 funds and account functionality, out-of-pocket mitigation costs, loss of privacy and control over her 27 Private Information, and continuing risk of further fraud, identity theft, phishing, credential attacks, 28 and financial misuse. 11 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 13 of 25 1 G. Paidwork's delayed notice magnified the harm 2 67. On information and belief, the criminals who took over Plaintiff's KOHO account 3 knew to target it—and possessed identity, contact, credential, banking, and transaction information 4 useful to do so—because that information was contained in or derived from the Paidwork database 5 stolen in the Data Breach. At present, among the breaches reflected in Plaintiff's HIBP history, the 6 Paidwork corpus is the only one Plaintiff has identified as confirmed to contain both bank-account 7 numbers and financial-transaction histories. 8 68. The timing and sequence reinforce that inference. The attempted new-account and 9 account-recovery activity began in the same month as the reported Data Breach, continued after the 10 dataset was offered for sale, and escalated into the KOHO takeover while Paidwork's stolen data 11 remained available to criminals. The overlap between the compromised fields and the information 12 used in the attacks further supports traceability at the pleading stage. 13 69. A threat actor who recovered or matched Plaintiff's reused credential, or combined the 14 credential hash with the exposed identity, device, address, telephone, banking, payout, and transaction 15 information, could use credential-stuffing, account-recovery, or social-engineering techniques to 16 access related email, payment, and financial accounts. The intervening criminal acts were the very 17 risks that reasonable data security and prompt breach notice were intended to prevent. 18 70. Plaintiff learned that her Paidwork account was included in the breach only through 19 HIBP on July 19, 2026. By then, the PayPal restrictions, email-account attacks, KOHO takeover, 20 unauthorized transactions, and substantial mitigation burden had already occurred. Paidwork's 21 discovery date, investigation timeline, communications with the threat actor, insurers, vendors, law 22 enforcement, regulators, HIBP, and affected users, and any asserted reasons for delay remain within 23 Paidwork's exclusive possession. 24 H. The risk and need for remediation remain ongoing 25 71. Private Information such as names, birth dates, addresses, telephone numbers, 26 transaction histories, bank-account information, profile photographs, and credential data cannot be 27 reissued in the same way as a payment card. Once disclosed publicly, it can be copied indefinitely 28 and used in future attacks. 12 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 14 of 25 1 72. Plaintiff and Class members remain at heightened risk of credential stuffing, phishing, 2 account recovery abuse, new-account fraud, payment diversion, bank and PayPal fraud, identity theft, 3 doxing, and targeted scams. Actual misuse suffered by Plaintiff confirms that the risk is not 4 hypothetical. 5 73. Paidwork continues to possess Private Information belonging to Plaintiff and Class 6 members. Without court-ordered transparency and remediation, Class members cannot determine 7 whether Paidwork has corrected the vulnerabilities, minimized unnecessary retention, reset or 8 invalidated exposed credentials, restricted compromised payout identifiers, or implemented 9 monitoring adequate to prevent recurrence. 10 I. Plaintiff did not agree to Paidwork's arbitration and class-waiver terms 11 74. Paidwork's currently posted Terms of Service state that they were last updated April 12 16, 2026—after Plaintiff joined Paidwork in approximately 2024 and after the alleged March 2026 13 Data Breach. 14 75. Those current terms contain a California choice-of-law clause, a provision requiring 15 AAA arbitration in Sacramento, and a purported class-action and class-arbitration waiver. They also 16 state that significant changes will be communicated by email or website notice and that continued use 17 constitutes acceptance. 18 76. Plaintiff did not knowingly or affirmatively agree to the April 16, 2026 arbitration 19 provision or class waiver. She did not receive conspicuous notice identifying the new arbitration and 20 class-waiver terms and did not unambiguously manifest assent to them. 21 77. Plaintiff's claims arise from Paidwork's independent duties to protect Private 22 Information and provide reasonable incident response and from a breach that occurred before the 23 April 16 terms. Paidwork cannot manufacture retroactive assent to arbitration or a class waiver 24 through an undisclosed, post-breach website revision. 25 78. Plaintiff anticipates that Paidwork may invoke the current terms but denies that any 26 enforceable agreement to arbitrate this dispute exists. The formation, version, notice, and assent issues 27 must be decided by the Court before any purported arbitration rules or delegation provision can apply. 28 13 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 15 of 25 1 CLASS ACTION ALLEGATIONS 2 79. Plaintiff brings this action under Federal Rules of Civil Procedure 23(a), 23(b)(2), and 3 23(b)(3), individually and on behalf of the following proposed class and subclass, subject to 4 amendment after discovery: 5 North American Data Breach Class: All persons residing in the United States or Canada 6 whose Private Information was accessed, acquired, exfiltrated, stolen, compromised, or publicly disclosed as a result of the Paidwork Data Breach. 7 Actual Misuse Subclass: All members of the North American Data Breach Class who 8 experienced actual or attempted unauthorized access to, opening of, or transactions through 9 a financial, payment, email, or other online account that was caused by or reasonably traceable to the Paidwork Data Breach. 10 80. Plaintiff is a member of both proposed Classes. She resides in Canada, her Private 11 12 Information was included in the Paidwork breach dataset, and she experienced actual and attempted 13 unauthorized opening of and actual unauthorized access to payment, email, and financial accounts— 14 including a duplicate PayPal account created in her name and the takeover of her KOHO account— 15 which she alleges were caused by or reasonably traceable to the Data Breach. 16 81. Excluded from the Classes are Paidwork and its parents, subsidiaries, affiliates, 17 officers, directors, members, managers, and employees; any entity in which Paidwork has a 18 controlling interest; the judges and court personnel assigned to this case and their immediate family 19 20 members; and any person who validly requests exclusion from a Rule 23(b)(3) class. 21 82. Plaintiff reserves the right to amend, narrow, or create additional U.S., state, 22 provincial, consumer, financial-information, credential-exposure, and actual-misuse subclasses after 23 discovery and to add additional qualified representatives as appropriate. Additional U.S. or state- 24 specific representatives may strengthen particular statutory or choice-of-law subclasses, but they are 25 not a prerequisite to Plaintiff's commencement of this action on behalf of the Classes defined above. 26 83. Numerosity. The Classes are so numerous that joinder is impracticable. The breach 27 28 reportedly involved approximately 23.3 million unique accounts. On information and belief, more 14 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 16 of 25 1 than 100 affected users reside in the United States or Canada, and the precise North American count 2 is ascertainable from Paidwork's account, breach, notification, payout, and database records. 3 84. Commonality. Common questions of law and fact include: 4 A. whether Paidwork owed duties to use reasonable security and incident- 5 response practices; 6 B. whether and when unauthorized actors accessed, acquired, or exfiltrated 7 8 Paidwork data; 9 C. which systems, tables, records, and data fields were compromised; 10 D. whether Paidwork's security architecture, access controls, monitoring, 11 retention, password protections, vendor management, and incident response 12 were reasonable; 13 E. when Paidwork discovered or reasonably should have discovered the Data 14 15 Breach; 16 F. whether Paidwork provided timely and adequate notice; 17 G. whether Paidwork's conduct caused or increased the risk of credential stuffing, 18 account takeover, payment fraud, and identity theft; 19 H. whether an implied contract or confidential relationship required Paidwork to 20 safeguard Private Information and provide prompt notice; 21 I. whether Paidwork was unjustly enriched by collecting and retaining user data 22 23 while avoiding reasonable security expenditures; 24 J. whether Plaintiff and Class members are entitled to damages, restitution, 25 declaratory relief, and injunctive relief; and 26 K. whether Paidwork's April 16, 2026 arbitration and class-waiver terms were 27 effectively communicated to and accepted by preexisting users. 28 15 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 17 of 25 1 85. Typicality. Plaintiff's claims arise from the same course of conduct as the claims of 2 the Classes: Paidwork collected and retained her Private Information, failed to protect it, failed to 3 warn her promptly, and exposed her to the same categories of credential, identity, banking, and 4 transaction misuse. Her Canadian citizenship and residence do not alter the common security, breach- 5 response, notice, causation, and remediation questions. Plaintiff also suffered the completed and 6 7 attempted account misuse that defines the Actual Misuse Subclass. 8 86. Adequacy. Plaintiff will fairly and adequately protect the interests of the Classes. She 9 is a member of both proposed Classes, her interests are aligned with those of other affected users, she 10 has no known disabling conflict, she understands her obligation to participate in discovery and protect 11 absent members, and she has retained counsel experienced in class and data-breach litigation. Plaintiff 12 is willing and able to participate in discovery and proceedings in the United States. Her Canadian 13 citizenship and residence create no inherent conflict with U.S. Class members. 14 15 87. Predominance. Common liability questions concerning Paidwork's systems, 16 safeguards, breach response, notice, data practices, and uniform conduct predominate over 17 individualized issues. Differences in damages or applicable law do not defeat the common liability 18 case and can be addressed, as necessary, through subclasses, issue certification under Rule 23(c)(4), 19 damages methodologies, and claims administration. 20 88. Superiority. A class action is superior to thousands or millions of separate actions 21 because individual damages may be too small to justify standalone litigation, the relevant security 22 23 evidence is concentrated in Paidwork's possession, and common adjudication will promote efficiency 24 and consistent results. 25 89. Rule 23(b)(2). Paidwork has acted or refused to act on grounds generally applicable to 26 the Classes by maintaining common data systems, security practices, retention policies, and incident- 27 response procedures. Declaratory and injunctive relief respecting those systems is appropriate for the 28 Classes as a whole. 16 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 18 of 25 1 90. Ascertainability. Class membership is administratively feasible and objectively 2 determinable from Paidwork's affected-user records, breach dataset, account databases, notification 3 files, payout records, and records of reported actual misuse. 4 91. Manageability. The Court can sequence common liability issues before individualized 5 damages, use U.S., state, provincial, or injury-based subclasses where substantive law materially 6 differs, and certify issues under Rule 23(c)(4) or subclasses under Rule 23(c)(5) as appropriate. 7 Plaintiff anticipates adding U.S. and state-specific representatives where doing so will assist 8 certification of particular claims, but no such addition is necessary to establish Plaintiff's standing or 9 to commence this action. 10 GOVERNING LAW AND CLASS ARCHITECTURE 11 92. Plaintiff pleads the common-law claims below under the law the Court determines 12 governs her claims and the claims of materially similar Class members. Plaintiff does not contend 13 that one jurisdiction's law must govern every Class member if California choice-of-law rules require 14 otherwise; she requests subclasses, issue certification, or other appropriate case-management 15 measures where material differences in governing law exist. 16 TOLLING AND DELAYED DISCOVERY 17 93. Any applicable limitations periods were tolled by the delayed discovery rule because 18 Paidwork controlled the relevant systems and incident information, the intrusion and exfiltration were 19 inherently undiscoverable to ordinary users, and Plaintiff did not learn that her Paidwork account 20 appeared in the breach dataset until HIBP notified her on July 19, 2026. 21 94. To the extent Paidwork knew of the intrusion or sale before providing notice, its failure 22 to disclose material facts concerning the Data Breach prevented Plaintiff and Class members from 23 24 discovering their claims and supports equitable tolling and estoppel. 25 95. Plaintiff and Class members acted reasonably. They had no practical means to inspect 26 Paidwork's internal databases, logs, security alerts, incident reports, or communications with threat 27 actors and could not have discovered the relevant security failures through ordinary diligence. 28 17 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 19 of 25 1 COUNT I NEGLIGENCE 2 (On Behalf of Plaintiff and the Classes) 3 96. Plaintiff incorporates the preceding allegations as though fully set forth here. 4 97. Paidwork owed Plaintiff and Class members a duty to exercise reasonable care in 5 6 collecting, storing, securing, using, retaining, and deleting their Private Information and in detecting, 7 investigating, containing, and providing notice of unauthorized access. 8 98. The duty arose from Paidwork's affirmative collection and custody of sensitive 9 information; the special relationship created when users entrusted credential and financial data for 10 account and payout purposes; Paidwork's superior knowledge and control; the foreseeability of 11 criminal misuse; Paidwork's representations and undertakings; generally accepted cybersecurity 12 practices; and applicable statutory and regulatory standards that inform reasonable care. 13 14 99. Paidwork had a duty to use safeguards proportionate to the volume and sensitivity of 15 the data, to test and monitor those safeguards, to minimize and securely dispose of unnecessary 16 information, to limit and audit access, to protect credential and payment data, to maintain an effective 17 incident-response plan, and to warn users promptly when a breach created a foreseeable risk of 18 credential and financial-account misuse. 19 100. Paidwork breached those duties by, among other things, failing to implement or 20 maintain reasonable access controls, segmentation, monitoring, vulnerability management, 21 22 exfiltration detection, credential protections, encryption and key management, data minimization, 23 vendor controls, incident-response procedures, and timely notification; retaining sensitive 24 information longer or more broadly than reasonably necessary; and failing to act promptly after the 25 breach was or should have been discovered. 26 27 28 18 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 20 of 25 1 101. Paidwork's breaches caused and substantially contributed to the unauthorized access, 2 acquisition, dissemination, and misuse of Private Information and deprived Plaintiff and Class 3 members of the opportunity to mitigate foreseeable harm. 4 102. The account-takeover and financial misuse suffered by Plaintiff were foreseeable 5 consequences of exposing credential and payment-related data and delaying notice. The intervening 6 7 criminal acts were the very risks that reasonable data security and incident response were required to 8 guard against. 9 103. Plaintiff and Class members suffered damages including actual financial loss and loss 10 of use of funds; unauthorized account creation, access, and transactions; impaired or negative account 11 balances; fees; collection and credit risk; replacement of telephone numbers and devices; credit- 12 monitoring, identity-protection, and fraud-alert expenses and burdens; extensive mitigation time; loss 13 of account functionality, access, and control; loss of privacy and confidentiality; diminished value of 14 15 Private Information; and continuing risk requiring monitoring and protective measures. 16 104. As a direct and proximate result, Plaintiff and the Classes are entitled to compensatory, 17 nominal, consequential, and other damages available under the governing law, together with 18 appropriate equitable relief. 19 20 COUNT II BREACH OF IMPLIED CONTRACT 21 (On Behalf of Plaintiff and the Classes) 22 105. Plaintiff incorporates the preceding allegations as though fully set forth here. 23 106. When Plaintiff and Class members created Paidwork accounts and supplied Private 24 Information, the parties formed an implied contract. Plaintiff and Class members agreed to provide 25 account credentials, profile data, engagement, labor or task activity, and payout information for 26 27 Paidwork's limited business purposes; Paidwork implicitly agreed to use the information only for 28 19 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 21 of 25 1 those purposes, apply reasonable security, and provide reasonably prompt notice of a breach so users 2 could protect themselves. 3 107. The security and notice promises were material because no reasonable user would 4 knowingly provide credential and financial information to a platform that intended to store it without 5 reasonable safeguards or remain silent while attackers sold or weaponized it. 6 108. Plaintiff and Class members performed by creating and maintaining accounts, 7 8 providing information, engaging with Paidwork's platform, and conferring the commercial benefits 9 described above. Plaintiff's failure to receive a payout does not eliminate the exchange or Paidwork's 10 duty to protect the data it chose to retain. 11 109. Paidwork breached the implied contract by failing to safeguard Private Information, 12 allowing it to be accessed and exfiltrated, failing to contain and remediate the incident reasonably, 13 and failing to provide timely and adequate notice. 14 15 110. Paidwork's breach caused Plaintiff and Class members the damages and injuries 16 described above. Plaintiff seeks contract damages and other relief available under the governing law. 17 COUNT III 18 BREACH OF CONFIDENCE (On Behalf of Plaintiff and the Classes) 19 20 111. Plaintiff incorporates the preceding allegations as though fully set forth here. 21 112. Plaintiff and Class members conveyed Private Information to Paidwork in confidence 22 and for limited purposes related to account administration, authentication, task activity, fraud 23 prevention, and withdrawals. This claim is asserted to the extent recognized under the governing law 24 applicable to Plaintiff and any materially similar Class members. 25 113. The nature of the information and Paidwork's role created a reasonable understanding 26 27 that Paidwork would maintain confidentiality, restrict access, and not permit the information to be 28 disclosed to unauthorized actors or the public. 20 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 22 of 25 1 114. Paidwork accepted the information under those circumstances and knew or should 2 have known that unauthorized disclosure would create a serious risk of identity, credential, and 3 financial harm. 4 115. Paidwork breached that confidence by failing to maintain reasonable controls and 5 permitting Private Information to be accessed, acquired, offered for sale, and publicly disclosed 6 7 outside the purposes for which it was entrusted. 8 116. Plaintiff and Class members were injured as a direct and proximate result and are 9 entitled to damages, restitution, and equitable relief available under the governing law. 10 COUNT IV 11 RESTITUTION / UNJUST ENRICHMENT 12 (On Behalf of Plaintiff and the Classes; Pleaded in the Alternative) 13 117. Plaintiff incorporates the preceding allegations as though fully set forth here. 14 118. Paidwork received and retained valuable benefits from Plaintiff and Class members, 15 including their Private Information, account registrations, attention, engagement, labor or task 16 activity, data used to operate and monetize the platform, and the cost savings obtained by retaining 17 information for future use. 18 19 119. Paidwork also retained the benefit of security expenditures it should have made but 20 avoided, while shifting the costs and risks of deficient security and delayed notice to users whose data 21 it collected. 22 120. It would be unjust for Paidwork to retain those benefits without compensating affected 23 users or funding adequate remediation after failing to provide the reasonable security and incident 24 response that formed part of the exchange. 25 121. To the extent no enforceable contract governs, Plaintiff and the Classes seek 26 27 restitution, disgorgement of benefits wrongfully retained, and other equitable monetary relief 28 permitted by law. This Count is pleaded in the alternative and does not seek duplicative recovery. 21 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 23 of 25 1 COUNT V DECLARATORY AND INJUNCTIVE RELIEF 2 (On Behalf of Plaintiff and the Classes) 3 122. Plaintiff incorporates the preceding allegations as though fully set forth here. 4 123. An actual and continuing controversy exists concerning Paidwork's duties, the 5 6 reasonableness of its data-security and notification practices, the continued retention of compromised 7 information, and the measures required to reduce ongoing risk. 8 124. Money damages alone are inadequate because the dataset has reportedly been publicly 9 distributed, the exposed identity and financial information cannot all be changed, Paidwork continues 10 to possess user information, and Class members face continuing risk of account takeover, identity 11 theft, payment fraud, and targeted attacks. 12 125. Plaintiff seeks a declaration that Paidwork owed and breached duties to use reasonable 13 14 security and provide reasonable incident response and notice, and that Paidwork must protect, 15 minimize, and remediate the compromised information consistent with law and reasonable 16 cybersecurity practice. 17 126. Plaintiff further seeks an injunction requiring, as appropriate after discovery: an 18 independent security assessment; remediation of identified vulnerabilities; reasonable access 19 controls, monitoring, segmentation, credential protection, and incident response; data minimization 20 and secure deletion; identification of affected data fields; adequate individualized notice; monitoring 21 22 for misuse of exposed credentials and payout identifiers; reasonable identity and account-protection 23 services; and periodic compliance reporting to the Court or an independent assessor. 24 127. The requested relief is narrowly directed to the continuing risks created by Paidwork's 25 common systems and conduct and will benefit the Classes as a whole. 26 27 28 22 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 24 of 25 1 PRAYER FOR RELIEF 2 WHEREFORE, Plaintiff, individually and on behalf of the proposed Classes, respectfully 3 requests that the Court enter judgment in her favor and against Paidwork and award the following 4 relief: 5 A. Certify the proposed Classes under Federal Rule of Civil Procedure 23 and any 6 appropriate subclasses or issues; appoint Plaintiff as class representative; and appoint her counsel as 7 class counsel; 8 B. Declare that Paidwork's acts and omissions alleged herein were wrongful and violated 9 the duties alleged; 10 11 C. Award actual, compensatory, consequential, nominal, restitutionary, and other 12 damages available under the governing law in an amount to be determined at trial; 13 D. Award restitution, disgorgement, and equitable monetary relief to the extent permitted 14 and not duplicative; 15 E. Award punitive or exemplary damages to the extent permitted and supported by proof 16 of conscious disregard, oppression, fraud, or malice; 17 F. Enter appropriate declaratory and injunctive relief, including the security, notice, 18 19 monitoring, minimization, deletion, and remediation measures described above; 20 G. Award prejudgment and post-judgment interest; 21 H. Award reasonable attorneys' fees, litigation expenses, and costs as permitted by law 22 and the common-fund or substantial-benefit doctrines; 23 I. Retain jurisdiction to administer any classwide relief and enforce compliance; and 24 J. Grant such other and further relief as the Court deems just and proper. 25 JURY TRIAL DEMANDED 26 Plaintiff demands a trial by jury of all claims so triable. 27 28 23 CLASS ACTION COMPLAINT Case 2:26-at-01250 Document 1 Filed 07/24/26 Page 25 of 25 1 Dated: July 24, 2026 Respectfully Submitted, 2 /s/ Margot Cutter 3 Margot Cutter (SBN 306789) mcutter@cutterlaw.com 4 CUTTER LAW, PC 401 Watt Ave. 5 Sacramento, CA 95864 6 Telephone: 916.290.9400 Facsimile: 916.588.9314 7 Tina Wolfson (SBN 174806) 8 twolfson@ahdootwolfson.com Jeff S. Westerman (SBN 94559) 9 jwesterman@ahdootwolfson.com Lisa Cintron (SBN 356009) 10 lcintron@ahdootwolfson.com AHDOOT & WOLFSON, PC 11 2600 West Olive Avenue, Suite 500 Burbank, CA 91505 12 Tel: (310) 474-9111 13 Nicholas Andrew Hall Texas Bar No. 24069863 14 nhall@hallattorneys.com 15 HALL ATTORNEYS, PC P.O. Box 1370 16 Edna, Texas 77957 Telephone: (713) 428-8967 17 Attorneys for Plaintiff and the Proposed Class 18 19 20 21 22 23 24 25 26 27 28 24 CLASS ACTION COMPLAINT JS 44 (Rev. 04/21) CIVIL COVER SHEET Case The JS 44 civil cover sheet and the 2:26-at-01250 information Document contained herein neither 1-1 theFiled replace nor supplement 07/24/26 filing and Page service of pleadings 1papers or other of 2as required by law, except as provided by local rules of court. This form, approved by the Judicial Conference of the United States in September 1974, is required for the use of the Clerk of Court for the purpose of initiating the civil docket sheet. (SEE INSTRUCTIONS ON NEXT PAGE OF THIS FORM.) I. (a) PLAINTIFFS DEFENDANTS MAGEN MELISSA VENNOR, individually and on behalf PAIDWORK LLC of all others similarly situated (b) County of Residence of First Listed Plaintiff Edmonton, Canada County of Residence of First Listed Defendant Sacramento (EXCEPT IN U.S. PLAINTIFF CASES) (IN U.S. PLAINTIFF CASES ONLY) NOTE: IN LAND CONDEMNATION CASES, USE THE LOCATION OF THE TRACT OF LAND INVOLVED. (c) Attorneys (Firm Name, Address, and Telephone Number) Attorneys (If Known) Margot Cutter, Cutter Law P.C., 401 Watt Ave., Sacramento CA 95864 II. BASIS OF JURISDICTION (Place an “X” in One Box Only) III. CITIZENSHIP OF PRINCIPAL PARTIES (Place an “X” in One Box for Plaintiff (For Diversity Cases Only) and One Box for Defendant) 1 U.S. Government 3 Federal Question PTF DEF PTF DEF Plaintiff (U.S. Government Not a Party) Citizen of This State 1 1 Incorporated or Principal Place 4 ✖ 4 of Business In This State 2 U.S. Government ✖ 4 Diversity Citizen of Another State 2 2 Incorporated and Principal Place 5 5 Defendant (Indicate Citizenship of Parties in Item III) of Business In Another State Citizen or Subject of a ✖ 3 3 Foreign Nation 6 6 Foreign Country IV. NATURE OF SUIT (Place an “X” in One Box Only) Click here for: Nature of Suit Code Descriptions. CONTRACT TORTS FORFEITURE/PENALTY BANKRUPTCY OTHER STATUTES 110 Insurance PERSONAL INJURY PERSONAL INJURY 625 Drug Related Seizure 422 Appeal 28 USC 158 375 False Claims Act 120 Marine 310 Airplane 365 Personal Injury - of Property 21 USC 881 423 Withdrawal 376 Qui Tam (31 USC 130 Miller Act 315 Airplane Product Product Liability 690 Other 28 USC 157 3729(a)) 140 Negotiable Instrument Liability 367 Health Care/ INTELLECTUAL 400 State Reapportionment 150 Recovery of Overpayment 320 Assault, Libel & Pharmaceutical PROPERTY RIGHTS 410 Antitrust & Enforcement of Judgment Slander Personal Injury 820 Copyrights 430 Banks and Banking 151 Medicare Act 330 Federal Employers’ Product Liability 830 Patent 450 Commerce 152 Recovery of Defaulted Liability 368 Asbestos Personal 835 Patent - Abbreviated 460 Deportation Student Loans 340 Marine Injury Product New Drug Application 470 Racketeer Influenced and (Excludes Veterans) 345 Marine Product Liability 840 Trademark Corrupt Organizations 153 Recovery of Overpayment Liability PERSONAL PROPERTY LABOR 880 Defend Trade Secrets 480 Consumer Credit of Veteran’s Benefits 350 Motor Vehicle 370 Other Fraud 710 Fair Labor Standards Act of 2016 (15 USC 1681 or 1692) 160 Stockholders’ Suits 355 Motor Vehicle 371 Truth in Lending Act 485 Telephone Consumer 190 Other Contract Product Liability 380 Other Personal 720 Labor/Management SOCIAL SECURITY Protection Act 195 Contract Product Liability ✖ 360 Other Personal Property Damage Relations 861 HIA (1395ff) 490 Cable/Sat TV 196 Franchise Injury 385 Property Damage 740 Railway Labor Act 862 Black Lung (923) 850 Securities/Commodities/ 362 Personal Injury - Product Liability 751 Family and Medical 863 DIWC/DIWW (405(g)) Exchange Medical Malpractice Leave Act 864 SSID Title XVI 890 Other Statutory Actions REAL PROPERTY CIVIL RIGHTS PRISONER PETITIONS 790 Other Labor Litigation 865 RSI (405(g)) 891 Agricultural Acts 210 Land Condemnation 440 Other Civil Rights Habeas Corpus: 791 Employee Retirement 893 Environmental Matters 220 Foreclosure 441 Voting 463 Alien Detainee Income Security Act FEDERAL TAX SUITS 895 Freedom of Information 230 Rent Lease & Ejectment 442 Employment 510 Motions to Vacate 870 Taxes (U.S. Plaintiff Act 240 Torts to Land 443 Housing/ Sentence or Defendant) 896 Arbitration 245 Tort Product Liability Accommodations 530 General 871 IRS—Third Party 899 Administrative Procedure 290 All Other Real Property 445 Amer. w/Disabilities - 535 Death Penalty IMMIGRATION 26 USC 7609 Act/Review or Appeal of Employment Other: 462 Naturalization Application Agency Decision 446 Amer. w/Disabilities - 540 Mandamus & Other 465 Other Immigration 950 Constitutionality of Other 550 Civil Rights Actions State Statutes 448 Education 555 Prison Condition 560 Civil Detainee - Conditions of Confinement V. ORIGIN (Place an “X” in One Box Only) ✖ 1 Original 2 Removed from 3 Remanded from 4 Reinstated or 5 Transferred from 6 Multidistrict 8 Multidistrict Proceeding State Court Appellate Court Reopened Another District Litigation - Litigation - (specify) Transfer Direct File Cite the U.S. Civil Statute under which you are filing (Do not cite jurisdictional statutes unless diversity): Class Action Fairness Act, 28 U.S.C. § 1332(d) VI. CAUSE OF ACTION Brief description of cause: (1) Negligence (2) Breach of Implied Contract (3) Breach of Confidence (4) Unjust Enrichment related to data breach resulting in disclosure of PII VII. REQUESTED IN ✖ CHECK IF THIS IS A CLASS ACTION DEMAND $ CHECK YES only if demanded in complaint: COMPLAINT: UNDER RULE 23, F.R.Cv.P. 5,000,000 JURY DEMAND: ✖ Yes No VIII. RELATED CASE(S) (See instructions): IF ANY JUDGE DOCKET NUMBER DATE SIGNATURE OF ATTORNEY OF RECORD July 24, 2026 /s/ Margot Cutter FOR OFFICE USE ONLY RECEIPT # AMOUNT APPLYING IFP JUDGE MAG. JUDGE JS 44 Reverse (Rev. 04/21) Case 2:26-at-01250 Document 1-1 Filed 07/24/26 Page 2 of 2 INSTRUCTIONS FOR ATTORNEYS COMPLETING CIVIL COVER SHEET FORM JS 44 Authority For Civil Cover Sheet The JS 44 civil cover sheet and the information contained herein neither replaces nor supplements the filings and service of pleading or other papers as required by law, except as provided by local rules of court. This form, approved by the Judicial Conference of the United States in September 1974, is required for the use of the Clerk of Court for the purpose of initiating the civil docket sheet. Consequently, a civil cover sheet is submitted to the Clerk of Court for each civil complaint filed. The attorney filing a case should complete the form as follows: I.(a) Plaintiffs-Defendants. Enter names (last, first, middle initial) of plaintiff and defendant. If the plaintiff or defendant is a government agency, use only the full name or standard abbreviations. If the plaintiff or defendant is an official within a government agency, identify first the agency and then the official, giving both name and title. (b) County of Residence. For each civil case filed, except U.S. plaintiff cases, enter the name of the county where the first listed plaintiff resides at the time of filing. In U.S. plaintiff cases, enter the name of the county in which the first listed defendant resides at the time of filing. (NOTE: In land condemnation cases, the county of residence of the "defendant" is the location of the tract of land involved.) (c) Attorneys. Enter the firm name, address, telephone number, and attorney of record. If there are several attorneys, list them on an attachment, noting in this section "(see attachment)". II. Jurisdiction. The basis of jurisdiction is set forth under Rule 8(a), F.R.Cv.P., which requires that jurisdictions be shown in pleadings. Place an "X" in one of the boxes. If there is more than one basis of jurisdiction, precedence is given in the order shown below. United States plaintiff. (1) Jurisdiction based on 28 U.S.C. 1345 and 1348. Suits by agencies and officers of the United States are included here. United States defendant. (2) When the plaintiff is suing the United States, its officers or agencies, place an "X" in this box. Federal question. (3) This refers to suits under 28 U.S.C. 1331, where jurisdiction arises under the Constitution of the United States, an amendment to the Constitution, an act of Congress or a treaty of the United States. In cases where the U.S. is a party, the U.S. plaintiff or defendant code takes precedence, and box 1 or 2 should be marked. Diversity of citizenship. (4) This refers to suits under 28 U.S.C. 1332, where parties are citizens of different states. When Box 4 is checked, the citizenship of the different parties must be checked. (See Section III below; NOTE: federal question actions take precedence over diversity cases.) III. Residence (citizenship) of Principal Parties. This section of the JS 44 is to be completed if diversity of citizenship was indicated above. Mark this section for each principal party. IV. Nature of Suit. Place an "X" in the appropriate box. If there are multiple nature of suit codes associated with the case, pick the nature of suit code that is most applicable. Click here for: Nature of Suit Code Descriptions. V. Origin. Place an "X" in one of the seven boxes. Original Proceedings. (1) Cases which originate in the United States district courts. Removed from State Court. (2) Proceedings initiated in state courts may be removed to the district courts under Title 28 U.S.C., Section 1441. Remanded from Appellate Court. (3) Check this box for cases remanded to the district court for further action. Use the date of remand as the filing date. Reinstated or Reopened. (4) Check this box for cases reinstated or reopened in the district court. Use the reopening date as the filing date. Transferred from Another District. (5) For cases transferred under Title 28 U.S.C. Section 1404(a). Do not use this for within district transfers or multidistrict litigation transfers. Multidistrict Litigation – Transfer. (6) Check this box when a multidistrict case is transferred into the district under authority of Title 28 U.S.C. Section 1407. Multidistrict Litigation – Direct File. (8) Check this box when a multidistrict case is filed in the same district as the Master MDL docket. PLEASE NOTE THAT THERE IS NOT AN ORIGIN CODE 7. Origin Code 7 was used for historical records and is no longer relevant due to changes in statute. VI. Cause of Action. Report the civil statute directly related to the cause of action and give a brief description of the cause. Do not cite jurisdictional statutes unless diversity. Example: U.S. Civil Statute: 47 USC 553 Brief Description: Unauthorized reception of cable service. VII. Requested in Complaint. Class Action. Place an "X" in this box if you are filing a class action under Rule 23, F.R.Cv.P. Demand. In this space enter the actual dollar amount being demanded or indicate other demand, such as a preliminary injunction. Jury Demand. Check the appropriate box to indicate whether or not a jury is being demanded. VIII. Related Cases. This section of the JS 44 is used to reference related pending cases, if any. If there are related pending cases, insert the docket numbers and the corresponding judge names for such cases. Date and Attorney Signature. Date and sign the civil cover sheet.