The Justice Department alleges the contractors submitted false and fraudulent claims for payment while failing to meet contractual cybersecurity requirements.
Two defense and aerospace contractors will pay $13 million to settle allegations that for years they knowingly misrepresented compliance with cybersecurity requirements in their contracts with the Army, Missile Defense Agency and NASA.
The Justice Department alleges that ILC Dover LP and ILC Astrospace LLC submitted false and fraudulent claims for payment while failing to meet their contractual cybersecurity requirements mandated by those agencies from January 2018 to October 2024.
This settlement resolves allegations against the companies. “There has been no determination of liability,” the Justice Department said in a statement.
The government alleges that ILC used an external cloud service provider to store controlled-unclassified information without ensuring that the cloud provider met Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline requirements and complied with the Defense Federal Acquisition Regulation Supplement’s requirements.
The contractor is also accused of not fully implementing all cybersecurity controls under National Institute of Standards and Technology Special Publications 800-171 and 800-53, including “controls that, if not implemented, could lead to significant exploitation of the network or exfiltration of controlled defense information and controls that, if not implemented, could have a specific and confined effect on the security of the network and its data.”
Beyond failing to implement controls, the government alleges that ILC failed to develop, implement and update system security plans for each of its covered information systems, as required by Defense Department and NASA contracts.
The company also allegedly did not develop and implement plans of action and milestones, or POA&Ms, designed to identify and mitigate cybersecurity weaknesses in its systems.
The settlement is focused on the potential security risks created by the companies’ alleged cybersecurity deficiencies.
“The best response to cyberattacks is to prevent them from happening in the first place. The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation,” U.S. Attorney Benjamin Wallace for the District of Delaware said in a statement.
The settlement resolves a whistleblower lawsuit filed by Philip Root, ILC’s former Director of Cybersecurity, raising similar allegations. Root will receive a $2.35 million share of the settlement amount. The contractor will also pay the whistleblower’s attorney $288,000 to cover expenses and fees.
The $13 million agreement with ILC Dover LP and ILC Astrospace LLC is the largest False Claims Act cybersecurity settlement to date.
If you would like to contact this reporter about recent changes in the federal government, please email anastasia.obis@federalnewsnetwork.com or reach out on Signal at (301) 830-2747.
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
