ILC Pays $13 Million to Settle Cybersecurity Fraud Claims
ILC agreed to resolve False Claims Act allegations that it misrepresented its cybersecurity compliance on defense and NASA contracts.
Updated on Nov. 3, 2026 in Cybersecurity
Live Poll
Do you trust large companies to protect sensitive data they handle for the government?
ILC, the collective name for ILC Dover and ILC Astrospace, agreed to pay $13 million to resolve False Claims Act allegations tied to contracts with the Department of the Army, Missile Defense Agency, and NASA. The government alleges the company submitted claims for payment between 2018 and 2024 without complying with contract cybersecurity requirements.
Why it matters
The case shows the Justice Department using the False Claims Act to enforce cybersecurity obligations in federal contracts. A forthcoming regulatory overhaul could expose more companies to similar penalties.
The alleged failures involved sensitive data stored in the cloud through a third-party company without proper safeguards, and security plans that were not developed or updated for each covered information system. The settlement terms do not specify which systems or safeguards were affected.
The players
ILC Dover
A Delaware-based defense and aerospace manufacturer that makes spacesuits and related equipment for government and commercial customers.
Ingersoll Rand
A publicly traded industrial manufacturer that acquired ILC Dover in June 2024 and is its parent company.
U.S. Attorney's Office for the District of Delaware
The federal prosecutor's office that announced the settlement and handled the False Claims Act resolution.
The details
A private whistleblower, Philip Root, the former director of cybersecurity at the company, raised the allegations under the False Claims Act and will receive $2.35 million of the settlement. Ingersoll Rand, which acquired ILC Dover in June 2024, agreed to resolve the matter without admitting liability.
Timeline
2018 to 2024: Period of alleged cybersecurity noncompliance.
June 2024: Ingersoll Rand acquires ILC Dover.
October 2024: Ingersoll Rand reports compliance with applicable requirements.
Tuesday, November 2026: Justice Department announces the settlement.
Roadmap
The Justice Department began using the False Claims Act to pursue cybersecurity noncompliance in 2022, and this settlement extends that approach to a defense and space contractor. A forthcoming regulatory overhaul could expose more federal contractors to the same kind of penalties.
Companies that hold federal contracts may need to document and verify their cybersecurity controls more carefully to avoid False Claims Act liability. Employees who witness noncompliance may have a legal route to report it and share in any recovery.
The takeaway
Federal contractors can face fraud liability not only for overbilling but for certifying compliance with security requirements they have not met. Organizations should verify that required security plans exist and are maintained for every covered system.
Further reading
For more on how federal contractors are held to security rules, see Cybersecurity coverage.
Live Poll
Do you trust large companies to protect sensitive data they handle for the government?
