Insights

On September 30, 2025, the Department of Justice (DOJ) announced that Georgia Tech Research Corporation (GTRC) agreed to pay $875,000 to settle allegations that it violated the False Claims Act (FCA) and federal common law by failing to meet cybersecurity requirements under certain Air Force and Defense Advanced Research Projects Agency (DARPA) contracts.  The settlement adds to the growing list of recoveries under DOJ’s Civil Cyber-Fraud Initiative and is yet another example of DOJ’s ongoing enforcement focus on cybersecurity obligations for federal contractors handling sensitive government information.  The settlement also provides insight into how government contractors may challenge FCA liability when faced with allegations of cybersecurity noncompliance.

On July 31, 2025, the Department of Justice (DOJ) announced that Illumina, Inc. will pay $9.8 million to resolve allegations that it violated the False Claims Act (FCA) by selling genomic sequencing systems with software containing cybersecurity vulnerabilities to federal agencies. This is the first FCA settlement involving claims that a medical manufacturer failed to incorporate adequate product cybersecurity into its software design and development.The allegations were first made in United States ex rel. Lenore v. Illumina Inc., No. 1:23-cv-00372 (D.R.I.), a qui tam action filed by Illumina’s former Director for Platform Management, On-Market Portfolio in September 2023. The relator alleged that, between February 2016 and September 2023, Illumina knowingly sold genomic sequencing systems to government agencies without adequate security programs or quality systems to identify and address software vulnerabilities. The complaint further alleged that Illumina failed to properly resource personnel and processes responsible for product security, did not remediate design features introducing cybersecurity risks, and misrepresented the software’s adherence to required cybersecurity standards.According to the government, Illumina’s actions included:

On July 25, 2025, the Eleventh Circuit Court of Appeals issued its decision in United States ex. rel. Sedona Partners LLC v. Able Moving & Storage Inc. et al., holding that a district court cannot ignore new factual allegations included in an amended complaint filed by a False Claims Act qui tam relator based on the fact that those additional facts were learned in discovery, even while a motion to dismiss for failure to comply with the heightened pleading standard under Federal Rule of Civil Procedure 9(b) is pending.  Under Rule 9(b), allegations of fraud typically must include factual support showing the who, what, where, why, and how of the fraud to survive a defendant’s motion to dismiss.  And while that standard has not changed, Sedona gives room for a relator to file first and seek out discovery in order to amend an otherwise deficient complaint and survive a motion to dismiss, at least in the Eleventh Circuit.  Importantly, however, the Eleventh Circuit clarified that a district court retains the discretion to dismiss a relator’s complaint before or after discovery has begun, meaning that district courts are not required to permit discovery at the pleading stage.  Nevertheless, the Sedona decision is an about-face from precedent in the Eleventh Circuit, and many other circuits, where, historically, facts learned during discovery could not be used to circumvent Rule 9(b) by bolstering a relator’s factual allegations while a motion to dismiss was pending.  While the long-term effects of the decision remain to be seen, in the short term the decision may encourage relators to engage in early discovery in hopes of learning facts that they can use to survive otherwise meritorious motions to dismiss.

On June 23, 2025, the Ninth Circuit issued a long-awaited decision in Island Industries Inc. v. Sigma Corp. affirming a $26M False Claims Act (“FCA”) judgment against the defendant importer.  Sigma had appealed the judgment after a jury found the company violated the FCA by failing to pay customs duties owed to U.S. Customs and Border Protection (“CBP”).  The Ninth Circuit’s decision addresses an important jurisdictional issue and illustrates the significant financial exposure importers can face under the FCA at a time of increased tariffs and enforcement by the government.  

Underscoring the Administration’s intention to eradicate DEI preferences and mandates, the Department of Justice (DOJ) launched a new Civil Rights Fraud Initiative (Initiative) to be co-led by DOJ’s Civil Rights Division and Fraud Section. In response, Crowell launched its own DEI and Civil Fraud Initiative to support clients in managing the heightened risks associated with this new enforcement landscape.

On May 19, 2025, Deputy Attorney General Todd Blanche issued a Memorandum creating the Civil Rights Fraud Initiative that will “utilize the False Claims Act to investigate and . . . pursue claims against any recipient of federal funds that knowingly violates federal civil rights laws.” According to the Memorandum, though racial discrimination has “always been illegal,” the Administration posits that “many corporations and schools continue to adhere to racist policies and preferences—albeit camouflaged with cosmetic changes that disguise their discriminatory nature.” In an effort to prevent federal funds from being used in connection with or support of these purportedly racist policies and preferences, the Initiative will wield the power of the False Claims Act, the government’s most powerful tool to fight fraud, waste, and abuse.

On March 26, 2025, the Department of Justice (DOJ) announced that defense contractor MORSECORP Inc. (MORSE) will pay $4.6 million to settle allegations that MORSE violated the False Claims Act (FCA) by failing to comply with cybersecurity requirements and subsequently submitting false or fraudulent claims for payment in its contracts with the Departments of the Army and Air Force. This is the first FCA settlement that is based on a defense contractor’s failure to reevaluate and promptly update its self-assessment score in the Supplier Performance Risk System (SPRS) after a third-party assessment resulted in a lower score.

FY 2024 saw continued growth in False Claims Act enforcement, with a record year for new qui tam and government-initiated actions, and the highest total recovery in three years. Enforcement of pandemic-related fraud and cybersecurity noncompliance increased, and health care, procurement, and small business fraud violations were again priority areas. A groundbreaking opinion from the District Court for the Middle District of Florida may have teed up a potentially landscape-shifting decision about the viability of the qui tam mechanism in the not too distant future. And a landmark administrative law decision at the U.S. Supreme Court may impact many FCA cases to come. Significant decisions regarding retaliation, excessive fines, the first-to-file rule, and the public disclosure bar were also handed down by courts of appeals. Crowell attorneys discuss these highlights and others in a “Feature Comment” published in The Government Contractor.

Yesterday, less than an hour into the first day of confirmation hearings for attorney general nominee Pam Bondi, Senator Chuck Grassley (R-IA) questioned Bondi on her commitment to defending the constitutionality of the False Claims Act (FCA) if she is confirmed.  Bondi responded that she would “of course” defend the constitutionality of the FCA and that she understands the importance of whistleblowers, the FCA’s protections, and “the money it brings back to our country.”  Senator Grassley’s questioning indicated he was focused on the FCA’s qui tam provisions, as it comes on the heels of U.S. ex rel. Zafirov v. Florida Medical Associates, Inc., -- F.Supp.3d --, 2024 WL 4349242 (M.D. Fla. Sept. 30, 2024), a first-of-its-kind decision from Judge Kathryn Kimball Mizelle, who held that the FCA’s qui tam provisions improperly appoint a relator “an officer of the United States” in violation of the Appointments Clause in Article II of the Constitution, and are therefore unconstitutional.  Senator Grassley appeared to be seeking assurances about Bondi’s willingness to ensure the Department of Justice continues to defend the FCA’s qui tam provisions and commit the resources necessary to do so.

On October 22, 2024, the Department of Justice (DOJ) announced that Pennsylvania State University (Penn State) will pay $1.25 million to resolve allegations that it violated the False Claims Act (FCA) by failing to comply with contractually mandated cybersecurity requirements by the Department of Defense (DoD) and National Aeronautics and Space Administration (NASA).  The announcement marks the most recent settlement under DOJ’s Civil Cyber-Fraud Initiative although, unlike prior settlements, there is no allegation of a cybersecurity incident or breach that was related to or caused by the contractor’s alleged noncompliance.

Judge Kathryn Kimball Mizelle of the District Court for the Middle District of Florida recently declared the False Claims Act qui tam provisions unconstitutional in U.S. ex rel. Zafirov v. Fla. Med. Assocs., LLC, -- F.Supp.3d --, 2024 WL 4349242 (M.D. Fla. Sept. 30, 2024), turning up the heat on a simmering constitutional fight that is increasingly likely to reach the Supreme Court in the next few years. Judge Mizelle's decision was the first to strike down the FCA qui tam provisions, but not the first to consider the issue. Arguments challenging the constitutionality of the qui tam provisions proliferated after Justice Thomas indicated some doubt about the qui tam device in his dissent in U.S. ex rel. Polansky v. Exec. Health Res., 599 U.S. 419 (2023). But every other judge to consider the issue has upheld the constitutionality of the qui tam provisions.

In a novel False Claims Act (FCA) ruling, on September 30, 2024, Judge Kathryn Kimball Mizelle of the District Court for the Middle District of Florida upended decades of FCA jurisprudence in declaring the qui tam provisions of the FCA unconstitutional in U.S. ex rel. Zafirov v. Florida Medical Associates, LLC, 2024 WL 4349242 (M.D. Fla. Sept. 30, 2024). This decision follows Justice Thomas’ dissent in the recent Supreme Court decision, U.S. ex rel. Polansky v. Executive Health Resources, Inc., 599 U.S. 419 (2023), where he posited, “[t]here are substantial arguments that the qui tam device is inconsistent with Article II and that private relators may not represent the interests of the United States in litigation.” While Justice Thomas’ implicit constitutional challenge was not entirely new to FCA practitioners, including it in his Polansky dissent, with Justices Kavanaugh and Barrett in a concurring opinion noting their agreement that the Court should consider the constitutional questions in an appropriate case, swung wide open a door of opportunity for defendants and their counsel to attempt to dismiss FCA qui tam suits on constitutional grounds. Judge Mizelle’s decision in Zafirov is the first of its kind to actually dismiss a qui tam suit on constitutional grounds, and will likely lead to an avalanche of similar motions in nearly every non-intervened lawsuit brought by a relator.

On August 8, 2024, the U.S. Attorney’s Office for the Central District of California announced a $6.3 million False Claims Act settlement with West Coast Dental Administrative Services LLC (formerly West Coast Dental Services Inc.) and its founders and former owners due to seven improper second-draw Paycheck Protection Program loans received by West Coast Dental and affiliated dental offices. 

On August 5, 2024, in United States ex rel. Relator LLC v. Howard D. Kootstra and Golden Empire Mortgage, Inc., Case No. 1:22-cv-00924-TLN-CDB (E.D. Cal.), the District Court for the Eastern District of California granted a motion to dismiss allegations that a mortgage lender made false or fraudulent statements on its Paycheck Protection Program (PPP) application in violation of the False Claims Act where the relator could not overcome the FCA’s public disclosure bar.

On June 17, 2024, the Department of Justice (DOJ) announced a $11.3 million False Claims Act (FCA) settlement that touches on two key enforcement priorities:  the DOJ’s Civil Cyber-Fraud Initiative and pandemic-related fraud.  This settlement, the largest under the Civil Cyber-Fraud Initiative to date, resolved allegations that Guidehouse Inc. (Guidehouse) and its subcontractor, Nan McKay and Associates (Nan McKay), violated the FCA because they failed to conduct pre‑production cybersecurity testing on New York State’s Emergency Rental Assistance Program (ERAP) technology product before public launch, and that Guidehouse used an unapproved third-party data cloud software program to store personally identifiable information (PII).

On May 1, 2024, the Department of Justice (DOJ) announced that Insight Global LLC (Insight), an international staffing and services company, will pay $2.7 million to resolve allegations that it violated the False Claims Act (FCA) by failing to implement adequate cybersecurity measures to protect personal health information (PHI) and personally identifiable information (PII) under its contracts with the Pennsylvania Department of Health (PADOH) to provide staffing for COVID-19 contact tracing services.  Although contracts with state agencies generally fall outside the FCA’s ambit, PADOH paid Insight using funds received from the federal Centers for Disease Control and Prevention (CDC)—bringing the contract within the FCA’s scope. 

A recently-announced False Claims Act (FCA) settlement illustrates how government contractors and other FCA defendants can take advantage of a Department of Justice (DOJ) policy that rewards voluntary self-disclosure to, and subsequent cooperation with, the government.

2023 brought many important False Claims Act developments for companies with business involving government funds.  While overall recoveries remained down compared to pre-2022 levels, the total number of settlements and judgments exceeded any prior year.  Those settlements and judgments also highlight areas of particular focus for the Government, including cybersecurity compliance, pandemic fraud, and small business fraud, among others.  Of particular note, 2023 saw the U.S. Supreme Court issue decisions concerning the Government’s authority to dismiss qui tam actions and the critical element of scienter/knowledge that will have wide-reaching impact.  The courts of appeals also issued significant decisions on damages, materiality, and more.  Crowell attorneys discuss these highlights and others in a "Feature Comment" published in The Government Contractor.

On October 11, 2023, the Department of Justice announced a $9 million settlement with Victory Automotive Group Inc. (VAG) to resolve allegations that it violated the False Claims Act (FCA) by knowingly providing false information in support of its Paycheck Protection Program (PPP) loan. This settlement is one of the larger ones to date related to receipt of a PPP loan and one of the first in which affiliation rendered a PPP borrower other than small.

A False Claims Act (FCA) settlement recently announced by the U.S. Department of Justice stands at the intersection of two evolving trends:  DOJ’s increasing focus on cybersecurity lapses by government contractors as part of its Civil Cyber-Fraud Initiative, and DOJ policies incentivizing corporations to voluntarily self-disclose violations of federal law.