Defense Contractor Settles Cybersecurity Allegations for $13 Million
A Delaware-based defense and aerospace firm has agreed to pay a $13 million settlement to resolve government allegations that it neglected mandatory cybersecurity obligations across multiple federal contracts, CyberScoop reported. The agreement resolves claims involving ILC Dover and ILC Astrospace—collectively referred to by the government as ILC—and covers contracts tied to the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration.
Federal authorities asserted that the company submitted false or fraudulent claims for payment between 2018 and 2024 despite knowing it failed to meet contractual cybersecurity requirements. According to the government, the firm utilized a third-party cloud provider to store sensitive data without proper safeguards and neglected to develop and update required security plans for covered information systems. Benjamin Wallace, U.S. Attorney for the District of Delaware, emphasized the enforcement priority in a news release issued on Tuesday.
“The best response to cyberattacks is to prevent them from happening in the first place,” Wallace said. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.”
https://t.co/lvyQ8v3whA
Ingersoll Rand Resolves Acquired Compliance Gaps
American industrial manufacturing giant Ingersoll Rand acquired ILC Dover in June 2024, inheriting the legal and regulatory exposure tied to the past contract performance. Sara Hasell, a spokesperson for Ingersoll Rand, noted that the parent company acted quickly upon discovering the compliance gaps following the buyout.
“We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” Hasell said. She added that the organization agreed to resolve this matter with the U.S. Department of Justice without an admission of liability and remains committed to maintaining strong cybersecurity practices.
The penalty stands as one of the larger financial resolutions secured since the Justice Department began using the Civil War-era False Claims Act in 2022 to penalize federal contractors for cybersecurity shortcomings. Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division said that defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts to protect sensitive information from cyber threats.
To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts.
Whistleblower Receives Portion of Recovered Funds
Under the provisions of the False Claims Act, private citizens can bring forward allegations of government fraud and receive a portion of the recovered funds. Philip Root, the company’s former director of cybersecurity and the whistleblower in the case, will receive $2.35 million from the settlement.
Government contract attorneys point out that upcoming regulatory updates could broaden the scope of False Claims Act enforcement, exposing additional firms to liability if compliance standards are unmet across the defense supply chain.
