Access Denied: Court Dismisses Cybersecurity False Claims Act Complaint for Lack of Materiality

Since launching its Civil Cyber-Fraud Initiative in 2021, the U.S. Department of Justice (DOJ) has secured, by our count, 17 False Claims Act cybersecurity settlements across various industries, including defense, private equity, education, and healthcare. However, the theories underlying these cases are rarely litigated. Enter Judge Sunil R. Harjani of the Northern District of Illinois, who recently dismissed a cybersecurity FCA qui tam complaint in United States ex rel. Pannek v. Archer Daniels Midland Company primarily on materiality grounds. This decision underscores the high bar relators (and the government) face when these claims are litigated even as the DOJ continues to prioritize the Civil Cyber-Fraud Initiative.

Background

Relator Mark Pannek, a former senior IT governance and compliance official at Archer Daniels Midland Company (ADM), filed a qui tam against ADM in 2023. After the DOJ declined to intervene, Pannek filed an amended complaint, which alleges that ADM received over $1 billion in federal grants and contracts from the U.S. Department of Agriculture and the U.S. Department of Energy while “fail[ing] to remedy persistent and pervasive cybersecurity deficiencies.” Specifically, the complaint alleges that ADM created a large, unencrypted “data lake” which was accessible to hundreds of employees and contractors with no documented business justification, in addition to having deficient audit logging and inadequate encryption of sensitive data, among other deficiencies — practices Pannek alleges violated NIST SP 800-171 standards, Controlled Unclassified Information (CUI) regulations, and Federal Acquisition Regulation requirements. In light of these issues, Pannek alleges that ADM made a series of false statements and certifications, including annual certifications to the government through the System for Award Management (SAM) and false certifications and misleading half-truths about cybersecurity compliance in hundreds of grants and contracts.

The Court’s Analysis

The court granted ADM’s motion to dismiss primarily on materiality grounds but offered additional guidance on the sufficiency of the alleged false statements, falsity, scienter, and the applicability of the cybersecurity regulations in the event Pannek seeks to replead his allegations in a second amended complaint.

Materiality

Pannek broadly alleges that “[c]ybersecurity is … a material concern of the Government generally,” pointing to various U.S. Department of Agriculture and U.S. Department of Energy cybersecurity policies and prior FCA settlements. The court determined that these allegations were insufficient to plead materiality with particularity because, although this may show the government cares about cybersecurity generally, the complaint contains “no facts to suggest that the government’s payment decisions would have been significantly affected had it known about the company’s purported cybersecurity deficiencies.” The court recognized that while adherence to cybersecurity regulations may be a condition of payment for ADM’s grants or contracts, the U.S. Supreme Court’s decision in Universal Health Services, Inc. v. United States, 579 U.S. 176, 194 (2016) requires more than alleged contractual noncompliance to demonstrate materiality. It noted that “Pannek must include allegations that the government relied on [ADM’s] cybersecurity practices in some way in making its payment decisions.”

Alleged False Statements

Although the complaint could be dismissed on materiality alone, the court did not end its analysis there because it gave Pannek until September 23, 2026 to file an amended complaint to address his pleading deficiencies. The court determined a subset of the allegedly false statements satisfy Rule 9(b) because the complaint alleges “who signed the grant, when it was signed, and the amount awarded” in addition to the “grant … conditions that required ADM to take various cybersecurity precautions” and that by accepting the grants, ADM “affirmed its compliance with those requirements.” In contrast, the court distinguished those plausibly alleged false statements from conclusory allegations that, by accepting certain grants, ADM represented it would comply with all applicable federal laws and regulations without tying any alleged regulatory violation to a false statement by ADM.

Falsity, Scienter, and Regulatory Applicability

As to the falsity of the alleged statements, the court found that if ADM did make statements about its cybersecurity compliance, the complaint alleges deficiencies that would render those representations false. As to scienter, the court found that the complaint plausibly alleges scienter because it discusses the results of a cybersecurity audit and report that identified concerns with the company’s data storage and controls, findings which were shared with ADM’s executive leadership. Finally, the court declined to resolve whether certain cybersecurity regulations apply to ADM, noting that the complaint’s well-pled allegations must be accepted as true at the motion to dismiss stage.

Takeaways

The decision is instructive as it confirms that cybersecurity-based FCA claims face the same strict materiality requirements as any other FCA claim, and it is insufficient to merely point to the government’s general cybersecurity focus to meet this demanding requirement. It also underscores that any complaint alleging cybersecurity violations must tie the alleged violations to specific misrepresentations or omissions made to the government. For companies that hold government contracts or grants with cybersecurity obligations, Pannek is a reminder to be mindful of the representations they make about their cybersecurity practices, and to ensure they can substantiate those representations with concrete compliance measures. Finally, it also demonstrates the risks associated with not remediating cybersecurity deficiencies that are identified in cybersecurity audits or assessments when it comes to assessing a defendant’s scienter under the FCA.

We at Qui Notes will be watching the docket to see how any amended complaint filed by Pannek fares. And, as always, we will continue to monitor ongoing developments in cybersecurity FCA cases that may be of interest to our readers.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.