Contractor Cyber Lapses Now Trigger Fraud Claims
A $13 million settlement shows the False Claims Act reaching government contractors' cybersecurity compliance, a use that is expected to expand.
Updated on Nov. 3, 2026 in Cybersecurity
Live Poll
Do you trust large companies to protect sensitive data they handle for the government?
ILC, the collective government name for ILC Dover and ILC Astrospace, agreed to pay $13 million to resolve False Claims Act allegations that it submitted false claims for payment on Army, Missile Defense Agency and NASA contracts between 2018 and 2024. The settlement is a resolved federal enforcement action, not a new product or capability, and Ingersoll Rand, parent of ILC Dover, agreed to resolve the matter without an admission of liability.
Why it matters
The government alleges ILC knew it had not met contract cybersecurity requirements, including allegedly storing sensitive data with a third-party cloud provider without proper safeguards and failing to develop mandated security plans. The case shows the False Claims Act being applied to cybersecurity compliance, a use the Justice Department began in 2022.
The settlement is a monetary resolution rather than a technical benchmark, with the $13 million figure paid under the False Claims Act's qui tam provisions. The alleged failures were procedural: missing security plans for covered information systems and unsafeguarded cloud storage of sensitive data, not a specific technical performance shortfall.
The players
ILC Dover
A defense and aerospace manufacturer whose work includes government contracts with the Army, Missile Defense Agency and NASA, now owned by Ingersoll Rand.
Ingersoll Rand
The industrial equipment company that is the parent of ILC Dover and acquired it in June 2024.
U.S. Attorney's Office for the District of Delaware
The federal prosecutor's office that announced the settlement under the False Claims Act.
The details
Under the False Claims Act, a private citizen can file allegations that a contractor defrauded the government and receive a share of any recovery. Here, former ILC cybersecurity director Philip Root brought the claims, and the government alleges ILC billed the government while knowing its systems did not meet contract cybersecurity requirements. Those requirements include the security plans each covered information system must carry and controls over where sensitive data is kept.
Timeline
June 2024: Ingersoll Rand acquires ILC Dover.
October 2024: Ingersoll Rand reports compliance with applicable requirements.
2018 to 2024: Period of alleged noncompliance by ILC.
2022: Justice Department begins using the False Claims Act for cybersecurity cases.
November 2026: Justice Department announces the ILC settlement.
The Tech Race
The case applies the False Claims Act, a Civil War-era statute that lets private whistleblowers recover fraud against the government, to cybersecurity compliance rather than to the billing errors it was traditionally used for. Justice Department cyber-related False Claims Act actions have been building since 2022, and this settlement shows the theory reaching a defense-sector manufacturer.
Federal contractors that handle government data face heightened exposure to False Claims Act liability if their cybersecurity controls fall short of contract terms. Companies in the defense and aerospace supply chain should expect scrutiny of their security plans and cloud storage practices.
The takeaway
Contractors should treat cybersecurity clauses in federal contracts as billing-relevant obligations, since false compliance representations can now create False Claims Act liability. Watch for the forthcoming regulatory overhaul the source projects, which could extend these exposures to more companies.
Further reading
For background on the security controls at issue, see our Cybersecurity coverage.
Source note: This article includes information reported by CyberScoop.
Live Poll
Do you trust large companies to protect sensitive data they handle for the government?
