Employees File Class Action Over ADM Data Breach by Hacker Group Qilin
Former ADM employees sue after Qilin ransomware group claimed Sept 2026 cyberattack.
Why it matters: This lawsuit underscores rising corporate exposure to cybersecurity-related litigation. Legal pros should monitor how courts address breach liability amid increasing ransomware threats.
- On Sept 15, 2026, ransomware group Qilin claimed a cyberattack on Archer-Daniels-Midland (ADM).
- A class-action suit was filed Sept 18, 2026, in U.S. District Court, Northern District of Illinois by former employee Matthew Ranney.
- Plaintiffs allege ADM failed to implement basic cybersecurity safeguards, exposing sensitive employee data.
- Exposed information includes names, birth dates, addresses, Social Security numbers, and driver’s licenses.
On September 15, 2026, the Russian-speaking ransomware group Qilin, active since 2022, claimed responsibility for a cyberattack targeting Archer-Daniels-Midland Company (ADM), a global agribusiness leader. Qilin is known for combining data encryption and theft in its extortion tactics.
Three days later, former ADM employee Matthew Ranney filed a class-action lawsuit in the U.S. District Court for the Northern District of Illinois. The suit alleges that ADM neglected fundamental cybersecurity measures, resulting in the exposure of sensitive employee information on the dark web. According to the complaint, exposed data includes names, dates of birth, addresses, Social Security numbers, and driver’s license information.
Ranney’s filing notes uncertainty regarding how long the cybercriminals accessed ADM’s network before detection, raising concerns about the company’s breach response effectiveness. The suit represents at least 100 affected employees.
ADM has not publicly confirmed the breach or fully disclosed the scope of compromised data. This case highlights growing corporate liability risks as ransomware attacks increase. With ADM reporting pre-tax income of $1.1 billion for Q2 2026, the legal and compliance community should closely watch these developments.
Further details on the breach and litigation are available through the Justia docket. While the Almeida Law Group provides breach investigation updates, note this is a legal service provider, and independent confirmation of details remains limited.
By the numbers:
- Sept 15, 2026 — Date Qilin group announced the cyberattack on ADM
- Sept 18, 2026 — Date Matthew Ranney filed the class-action lawsuit
- $1.1 billion — ADM’s reported pre-tax income in Q2 2026
Yes, but: ADM has not confirmed the breach publicly, and exact details of data exposure remain unverified beyond plaintiffs’ allegations.
What's next: The litigation will proceed in federal court in Illinois; legal observers expect increased scrutiny of cybersecurity practices and data breach liability standards.