ILC Settles Cybersecurity False Claims Act Case for $13 Million

Defense contractors handling sensitive military and space data now face a sharper financial reckoning for cybersecurity lapses, after a Delaware-based aerospace firm agreed to pay $13 million to settle allegations that it billed the government for work while failing to meet contract security requirements. CyberScoop reported that the settlement, announced Tuesday, counts as one of the larger settlements since the Justice Department started invoking the False Claims Act in 2022 to go after contractors for cybersecurity failures.

ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — resolved the allegations with three major federal agencies: the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration. According to federal authorities, between 2018 and 2024 the company submitted false or fraudulent claims for payment on those contracts because it knew it had not complied with the cybersecurity requirements written into them.

ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, leaving government information potentially exposed to bad actors seeking to exploit the United States’ technical innovation. The company also failed to develop and update the mandated security plans for each of its covered information systems, meaning the documentation meant to prove compliance did not exist or was not maintained as the contracts required.

“The best response to cyberattacks is to prevent them from happening in the first place,” said Benjamin Wallace, U.S. Attorney for the District of Delaware. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.”

The $13 Million Price of Inherited Risk

Ingersoll Rand, the American industrial manufacturing giant that owns ILC Dover, stated that the problem came with its acquisition of the firm in June 2024. “We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” said Sara Hasell, a spokesperson for Ingersoll Rand. The company agreed to resolve the matter with the U.S. Department of Justice without an admission of liability while maintaining its commitment to strong cybersecurity practices.

The $13 million settlement carries weight beyond this single company because it represents one of the bigger financial penalties since the Justice Department began deploying the False Claims Act in 2022 to penalize contractors over cybersecurity failures.

https://t.co/lvyQ8v3whA

— https://x.com/TheDebriefing17/status/2117916442465034290

How a Civil War-Era Law Catches Modern Cyber Gaps

The False Claims Act is a Civil War-era statute originally passed to deal with fraudulent contractors. Under the law, a private citizen can raise allegations that a contractor defrauded the government and is entitled to receive a portion of any settlement. Philip Root, the former director of cybersecurity at the company and the whistleblower in the ILC case, will receive $2.35 million from the resolution, giving insiders a direct financial stake in revealing security gaps before they compromise sensitive systems.

“To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division.

The full terms are detailed in the Justice Department’s press release and the settlement agreement posted by the department.