In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in  United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.

Background

Archer Daniels Midland (ADM) is a company that receives federal grants and contracts related to food commodities and biofuel processing. On February 17, 2026, Mark Pannek, a former ADM employee, amended an earlier FCA complaint against ADM to allege that ADM had cybersecurity deficiencies, failed to comply with applicable cybersecurity regulations, and made false statements and certifications by entering into contracts and grants with terms and conditions related to cybersecurity and in the government’s System for Award Management. On April 20, 2026, ADM filed a motion to dismiss, arguing that Pannek failed to plead any element of the alleged fraud with sufficient particularity and that ADM is not bound by many of the cybersecurity regulations and standards Pannek alleged.

The Decision

To bring a successful FCA claim, a plaintiff must demonstrate that the false statement was “material” to the government, i.e., that it would have “significantly affected the government’s actions” on whether to pay the contractor. United States v. Molina Healthcare of Illinois, Inc., 17 F.4th 732, 743 (7th Cir. 2021). Judge Harjani held that Pannek had not demonstrated that any of ADM’s statements about its cybersecurity were likely to have affected the government’s payment decisions. The court found that Pannek pled only general and conclusory assertions about the government’s usual interest in cybersecurity, including references to other FCA cybersecurity settlements. Pannek did not present specific facts showing the government was particularly interested in ADM’s cybersecurity compliance when deciding whether to fund ADM’s contracts and grants. 

Although Pannek alleged that adhering to certain cybersecurity regulations was a condition of payment for ADM’s contracts and grants, Judge Harjani found that the government’s mere designation of regulatory or contractual compliance as a condition of payment was insufficient to demonstrate materiality, noting that the U.S. Supreme Court in Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016) specifically rejected that theory of materiality. Accordingly, Pannek failed to demonstrate materiality and did not sufficiently plead an FCA violation.

Judge Harjani’s decision contained other key findings:

• Particularity: Pannek alleged that ADM made multiple false statements about its cybersecurity. Although the court found that Pannek provided sufficient details about three false statements (akin to affirmative representations) that ADM allegedly made to receive certain grants, it found that other allegations were “conclusory” and not sufficiently particular. Notably, the court found Pannek’s allegation that ADM “implicitly” certified its regulatory compliance was insufficient because, under an implicit certification theory, the relator must identify some affirmative statement the defendant made that involved a half-truth or omission, but Pannek did not identify any such specific statements.
• Falsity: If ADM did make statements about its compliance with cybersecurity regulations, Pannek sufficiently pled a variety of deficiencies that would render such statements false — for example, that hundreds of individuals had access to sensitive information in violation of NIST requirements and that the company failed to maintain adequate records of such access.
• Scienter: Pannek adequately pled the requisite scienter with respect to certain false statements by alleging that ADM’s executive leadership was aware of a 2019 audit and a 2022 report that identified cybersecurity issues at the company while the company was making alleged statements about its compliance with cybersecurity regulations.
• Applicability of Cybersecurity Regulations: Because the court found it plausible that ADM had controlled unclassified information (CUI) on its systems, it dismissed the complaint without prejudice, allowing Pannek to file an amended complaint if he addressed the materiality and particularity deficiencies. If Pannek does not file an amended complaint by September 23, 2026, then the dismissal will automatically convert to a dismissal with prejudice.

Key Takeaways:

• Materiality Matters: This decision confirms that FCA cybersecurity complaints are subject to “rigorous” materiality requirements. See Escobar, 579 U.S. at 181, 192. The mere presence of cybersecurity clauses in a contract, even if designated as a condition of payment, is not enough to show materiality. Nevertheless, given the limited precedent for when materiality is sufficiently pleaded, contractors should remain vigilant in complying with the clauses in their contracts and remediating any cybersecurity problems identified. 
• It’s About What You Know: This case illustrates how negative internal audit or investigation findings shared with executive leadership could potentially provide support for scienter in an FCA case, or at least pleading scienter. Although conducting audits or investigations under attorney-client privilege can provide some protection amid government scrutiny, contractors should be mindful about subsequent representations if they are unable to promptly remediate identified gaps or deficiencies.
• Know Your Data, Know Your Network: If a relator alleges that a defendant has CUI on its network, a defendant with a firm grasp of its data flow may be able to efficiently and convincingly refute that allegation, presenting an effective defense at later stages of litigation.