Defense Contractors to Pay $13M to Settle Cybersecurity Fraud Claims

Two defense and aerospace contractors agreed to pay $13 million on Thursday to settle federal allegations that they misrepresented their cybersecurity compliance on contracts with the Army, Missile Defense Agency, and NASA.

ILC Dover Settles $13 Million Cybersecurity Fraud Allegations

The Justice Department alleged that ILC Dover LP and ILC Astrospace LLC submitted false and fraudulent claims for payment between January 2018 and October 2024 while failing to meet contractual cybersecurity mandates. Federal News Network reported the $13 million agreement is the largest False Claims Act cybersecurity settlement to date.

The settlement resolves allegations against the companies without any determination of liability, according to the Justice Department. U.S. Attorney Benjamin Wallace for the District of Delaware said that the obligations violated by the contractors exist to prevent bad actors from exploiting technical innovation.

“The best response to cyberattacks is to prevent them from happening in the first place. The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.”

Wallace made that statement in a release detailing the resolution.

Contractors Allegedly Failed to Meet Cloud Security Standards

The government alleged that ILC stored controlled unclassified information with an external cloud service provider without ensuring the provider met Federal Risk and Authorization Management Program Moderate baseline requirements. The companies also allegedly failed to comply with Defense Federal Acquisition Regulation Supplement rules.

Contractors were accused of omitting National Institute of Standards and Technology Special Publications 800-171 and 800-53 controls. The Justice Department stated those omissions could lead to network exploitation or the exfiltration of controlled defense data.

The companies also allegedly failed to develop, implement, and update system security plans for covered information systems. They likewise did not establish plans of action and milestones to identify and mitigate system weaknesses.

Former Cybersecurity Director Receives Whistleblower Settlement Share

The settlement stems from a whistleblower lawsuit filed by Philip Root, who served as ILC’s former Director of Cybersecurity. Root will receive a $2.35 million share of the settlement amount.

The contractors will also pay $288,000 to cover the whistleblower’s attorney fees and expenses.