The government's allegation and the settlement
A Delaware-based defense and aerospace company that the government refers to as ILC — the collective name for ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve False Claims Act allegations that it failed to meet contract cybersecurity requirements. The case centers on work performed under contracts with the Department of the Army, the Missile Defense Agency and the National Aeronautics and Space Administration (NASA).
What the government says ILC did — and did not do
According to the Justice Department’s allegations, ILC submitted “false or fraudulent claims for payment” because it knew it had not complied with cybersecurity obligations in its contracts over a period between 2018 and 2024. The government specifically alleges that ILC used a third‑party company to store sensitive data in the cloud without proper safeguards and failed to develop and update mandated security plans for each of its covered information systems.
Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division said, “To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleILC, Ingersoll Rand, and the corporate timeline
Ingersoll Rand, the parent company of ILC Dover, said it inherited the problem when it purchased the firm. “We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” spokesperson Sara Hasell said. Hasell added that the company “have agreed to resolve this matter with the U.S. Department of Justice without an admission of liability and remain committed to maintaining strong cybersecurity practices.”
Financial consequences and the whistleblower
The $13 million payment resolves the government’s False Claims Act allegations and is described in the source as “one of the bigger settlements since the Justice Department began using the False Claims Act in 2022 to penalize contractors over cybersecurity shortcomings.” The source notes that the False Claims Act is a Civil War‑era law originally enacted to deal with fraudulent contractors.
Under the statute, private citizens can bring allegations on the government’s behalf and receive a share of any recovery. In this case, the whistleblower, Philip Root — identified as ILC’s former director of cybersecurity — will receive $2.35 million from the settlement.
What this means for defense and aerospace contractors, procurement officials, and cybersecurity teams
- Defense and aerospace contractors: The size of the settlement, and the Justice Department’s stated posture, signal that noncompliance with contract cybersecurity requirements can produce substantial False Claims Act exposure, including whistleblower suits. Contractors that enter into or inherit legacy systems should pay attention to contractual cybersecurity obligations tied to federal work.
- Procurement officials (Army, Missile Defense Agency, NASA): The agencies named in the settlement are the direct contracting parties cited by the government. Contracting officers and program managers responsible for oversight are likely to see this case as reinforcing the need for verification that prime contractors meet security plan and cloud‑storage safeguards spelled out in contracts.
- Cybersecurity teams: The allegations highlight two concrete compliance focal points — cloud storage safeguards when using third parties, and the creation and updating of mandated security plans for covered information systems. The settlement underscores the legal and financial stakes of gaps in these areas.
Government contract attorneys, cited in the reporting, warned that a forthcoming regulatory overhaul could expose more companies to False Claims Act punishments — a direct note that enforcement posture and rulemaking dynamics are converging on contractor cybersecurity performance. The ILC settlement closes this particular chapter with a large payment and a substantial whistleblower award, but it also raises a pointed operational question for firms that carry federal contracts: when contractually required cybersecurity measures are incomplete or inherited, who bears the liability and how quickly must corrective action be documented to avoid civil exposure?
