ILC Dover to Pay $13 Million to Settle Cybersecurity Fraud Allegations

ILC Dover and its subsidiary ILC Astrospace have agreed to pay $13 million to settle federal allegations that they knowingly failed to meet cybersecurity requirements on government contracts while continuing to submit claims for payment, the Justice Department announced Tuesday, November 3, Delaware Business Now and Daily Security Review reported.

The settlement resolves a whistleblower case brought by Philip Root, the company’s former director of cybersecurity, who will collect $2.35 million from the recovery under the False Claims Act. That law allows private individuals to file suit on behalf of the government and share in any money recovered, creating a direct financial incentive for insiders in compliance and security roles to report failures rather than stay silent. Root’s award represents a significant portion of the total, reflecting the statute’s design to encourage internal reporting of fraud.

The allegations cover a six-year stretch from 2018 to 2024 and involve contracts with three major government customers: the U.S. Army, the Missile Defense Agency and NASA. According to the government’s claims, ILC stored sensitive data with a third-party cloud provider without implementing proper safeguards and failed to develop or update the security plans that its contracts explicitly required for each covered system. The six-year span makes the settlement a look back across several contract cycles. Neither example involves a reported breach or intrusion; the case rests entirely on the non-compliance itself rather than on harm from unauthorized access to the data.

ILC Dover Pays $13M to Settle Cybersecurity Fraud Claims — Photo: dailysecurityreview.com

A Timeline That Spans Two Owners

The 2018-to-2024 window cuts across a significant change in corporate ownership that complicates questions of responsibility. Ingersoll Rand became ILC Dover’s parent company in June 2024, and the company maintains that it inherited the compliance gaps rather than caused them. Ingersoll Rand says it identified the issues after the acquisition and fixed them by October 2024, roughly four months later. Both ILC entities settled without admitting liability, which means the allegations remain claims by the government rather than established legal findings, and the settlement does not include an admission that the lapses occurred.

Several details remain undisclosed in the public record. The Justice Department does not say how the $13 million figure was calculated or what portion each ILC company will pay. Nor do the sources indicate whether investigators found evidence that unauthorized parties actually accessed the sensitive data during the six-year period. The settlement resolves the claims without answering those questions, leaving open whether any information was compromised despite the lack of a reported breach.

Part of a Broader Enforcement Push Since 2022

This case fits a pattern the Justice Department established in 2022, when it began systematically using the False Claims Act against contractor cybersecurity lapses. The approach treats a contractor’s promise to meet cybersecurity requirements as a condition of payment, meaning that billing the government while knowing those requirements are unmet can produce liability even without a data breach. At $13 million, this settlement ranks among the larger resolutions in that ongoing enforcement effort, signaling that the government considers cybersecurity compliance a billing issue, not just an IT issue.

The False Claims Act mechanism puts the enforcement trigger in the hands of employees. When someone with responsibility for cybersecurity raises the issue, the case moves through the statutory process, and the whistleblower’s share is an incentive written directly into the law. This structure means contractors cannot rely on silence from internal compliance staff.

For companies in the defense and space sector, the settlement sends a concrete signal about documentation and governance requirements. Security plans must exist for each covered system, they must be kept current, and sensitive data stored with outside cloud providers requires the specific safeguards outlined in the contracts. The two examples in the allegations—cloud storage without safeguards and missing security plans—show exactly what the government considers a failure under this enforcement theory, touching both the handling of information and the documentation requirements.

The whistleblower’s $2.35 million payout shows employees in compliance and security roles can easily prompt enforcement actions. When a former director of cybersecurity brings the case, the message to other contractors is clear: internal compliance officers hold both the standing and the financial incentive to expose gaps. For the Army, Missile Defense Agency and NASA, the stakes involve the integrity of systems that handle sensitive national security information, making the $13 million settlement a marker in the government’s effort to ensure contractors keep their cybersecurity promises when they bill taxpayers.

Worth a look