CHICAGO, September 24 — Employees of Archer-Daniels-Midland Co. are suing the agricultural giant over a data breach that exposed their personal information, a class action filed just three days after cybercriminals broke into the company’s network. The lawsuit, filed Friday, April 25, 2025, followed a hack on Tuesday, April 22, 2025, according to Courthouse News. Matthew Ranney, a former employee, represents a class of current and former workers.
A cybercriminal group called Qilin claimed responsibility for the intrusion and stole employee data including names, dates of birth, addresses, Social Security numbers and drivers’ licenses. That data was then posted to the dark web — an unindexed layer of the internet that requires special software to access — where the class claims it will be sold to other criminals for use in fraud and identity theft.
What the lawsuit alleges
In the complaint, Ranney writes that it is unknown precisely how long the cybercriminals had access to the company’s network before the breach was discovered. “In other words, defendant had no effective means to prevent, detect, stop or mitigate breaches of its systems — thereby allowing cybercriminals unrestricted access to its employees’ personal identifying information,” he writes. According to Ranney, the agriculture company has yet to begin notifying employees of the breach.
That delay matters, the plaintiffs argue, because it takes an average of three months for consumers to discover their identity has been stolen and used, and some individuals take up to three years to learn that information. By not informing them immediately — either because the company had not yet noticed or for some other reason — Ranney says the company deprived its employees of critical days during which they could notify banks, family members and credit reporting agencies.
Social Security numbers cannot be replaced by the federal government unless victims can demonstrate ongoing harm from active misuse of their number, he adds. The employees claim the data breach could have been prevented by proper planning and thorough security measures. They say the agribusiness ignored guidelines set by the Federal Trade Commission and failed to implement standard security measures such as employee training, strong passwords, multilayer security, encryption, multifactor authentication, backup data and limiting which employees can access sensitive data.
Without those measures, the company opened the door to criminals and directly caused the data breach, according to the class. Class members were required to provide their personal information to the company as a condition of employment, with the expectation the company had adequate cybersecurity measures.
“Instead of providing a reasonable level of security that would have prevented the data breach, defendant instead calculated to avoid its data security obligations at the expense of plaintiff and class members by utilizing cheaper, ineffective security measures,” Ranney writes. He estimates at least 100 workers were impacted.
What the company does — and what comes next
Archer-Daniels-Midland partners with farmers to purchase and transport crops from areas of supply to areas of demand, according to its website. Some of its products include artificial colors used in mass food production, plant-based proteins, alternative sweeteners and bulk beans. It also makes feeds and macro ingredients for animal nutrition.
The class is asking the court for injunctive relief to protect its interests as well as compensatory and punitive damages. In the second quarter of 2026, the company reported $1.1 billion in earnings before income taxes, compared to prior-year quarter earnings of $279 million — a rapid climb for a business now fighting a lawsuit over how well it guarded the data its workers had no choice but to hand over.
Watch for whether ADM begins notifying employees, and how the court handles the class’s demand for injunctive relief.
