The $1 million payout to a Danish security expert is believed to be the first in a cybersecurity case brought under the False Claims Act.