Two defense and aerospace manufacturers will pay $13 million to settle federal allegations that they told the government they were protecting sensitive defense data when they were not. It is a clear warning to every contractor that has signed a cybersecurity clause and never gone back to check it.

The Justice Department announced on Nov. 3, 2026 that ILC Dover LP and ILC Astrospace LLC agreed to the payment to resolve False Claims Act (FCA) allegations tied to contracts with the U.S. Army, the Missile Defense Agency (MDA) and NASA. The alleged conduct runs from January 2018 through October 2024, almost seven years. The case started as a whistleblower suit filed by Philip Root, whom DOJ and CyberScoop identify as ILC's former director of cybersecurity. He will receive $2.35 million of the settlement.

As with all such settlements, the claims are allegations only. The DOJ release states that there has been no determination of liability.

What the government says went wrong

The DOJ release reads like an inventory of the paperwork and controls that federal contracts require from companies handling controlled unclassified information (CUI), meaning sensitive but unclassified government data. Contractors that hold it have to implement the controls in NIST Special Publication 800-171 and, under some contracts, NIST SP 800-53.

According to the government, the companies:

  • Stored CUI with an unvetted cloud provider. From February 2023 to October 2024 they allegedly used a third-party company to store CUI in the cloud without requiring and ensuring that it met security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and complied with DoD requirements for cyber incident reporting and related obligations.
  • Had no system security plan. The government says ILC did not develop, document and periodically update a system security plan (SSP) for each covered information system from January 2018 to March 2022, and again from September 2022 to October 2024. DOJ describes the SSP as covering system boundaries, operating environments, how security requirements are implemented and connections to other systems.
  • Did not fully implement required controls. From January 2018 to October 2024, NIST SP 800-171 and 800-53 controls were allegedly not fully in place, including controls whose absence could lead to significant exploitation of the network or exfiltration of controlled defense information.
  • Had no plans of action and milestones. According to DOJ, from January 2018 to May 2019 and from January 2022 to September 2024, ILC had not developed and implemented plans of action and milestones (POA&Ms), which are designed to correct deficiencies and reduce or eliminate vulnerabilities.
  • Skipped the assessment. From November 2020 to October 2024, ILC Astrospace allegedly submitted no current NIST SP 800-171 assessment to DoD, and ILC Dover allegedly submitted no assessment that was current and conducted under the DoD assessment methodology.

The Whistleblower Law Collaborative, which represents Root, describes his concerns in similar terms: no consolidated system security plan, third-party cloud services that did not meet federal security requirements and improperly inflated assessment scores posted in the Supplier Performance Risk System (SPRS) with the Defense Department. The firm is an advocate for the relator, and the characterization of the scores as "inflated" is its own; the DOJ release does not use it.

Why this is a fraud case, not a breach case

The DOJ release does not describe a breach or allege that anyone stole ILC's data. The case is about what the companies certified, not about an attacker. DOJ alleges that ILC submitted false or fraudulent claims for payment on contracts because it knew it had not complied with their cybersecurity requirements. In cybersecurity, that means a missing SSP or an assessment that does not match reality can become a fraud exposure on its own.

The FCA's qui tam provisions also allow private individuals to sue on the government's behalf and share in any recovery. That describes Root: a security leader inside the company who, according to his lawyers, filed suit in January 2025. Those lawyers also say the government filed a notice of its intention to intervene for the purpose of settlement on Nov. 3, 2026. The case is United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70, in the U.S. District Court for the District of Delaware.

How big is $13 million?

Relator's counsel calls the settlement the largest government cybersecurity fraud recovery to date under DOJ's Civil Cybersecurity Fraud program, which the department announced in October 2021. That is the law firm's claim. CyberScoop describes it more cautiously, as one of the bigger settlements since DOJ began using the FCA for cybersecurity cases in 2022. Either way, it is a large number in a category of enforcement that is still young, and it went to a single whistleblower-driven case about documentation and assessment failures.

U.S. Attorney Benjamin L. Wallace of the District of Delaware said in the DOJ release that the obligations ILC allegedly violated "exist to prevent bad actors from taking advantage of the United States' technical innovation."

The acquisition angle

ILC Dover is now owned by Ingersoll Rand. Sara Hasell, a spokesperson for Ingersoll Rand, told CyberScoop the company became aware of the matter after it acquired ILC Dover in June 2024. She said it took prompt action, was in compliance by October 2024, and agreed to resolve the matter without an admission of liability. That timeline matches the end of the alleged conduct window in the DOJ release.

For companies buying defense suppliers, the lesson is that the acquired company's cyber compliance history comes with it. By the company's own account, the alleged conduct began more than six years before the June 2024 deal, and the parent said it inherited the issue.

What It Means for Defenders

Who is affected: Any company holding Army, MDA, NASA or other federal contracts that involve CUI. CyberScoop reports that government contract attorneys say a forthcoming regulatory overhaul could expose more companies to FCA punishments. Treat this case as an example of what enforcement may look like, not a one-off.

There is no software patch for this. The fixes are about governance. Based on the specific failures DOJ alleged, check the following:

  • Your system security plan exists, is current and covers every system that touches CUI. ILC allegedly went years without one, with a short stretch in 2022 in between. An SSP written once and never updated after a network change is a liability.
  • Your SPRS score matches your SSP. If you posted a score, someone inside your organization should be able to trace each point to an implemented control. The relator's lawyers allege inflated scores. An optimistic self-assessment is exactly what a whistleblower can document.
  • Your assessment is current. ILC Astrospace allegedly went almost four years without submitting a current 800-171 assessment. Put the renewal date on a calendar with an owner.
  • Every gap has a POA&M. Unimplemented controls with a dated remediation plan are a known, managed risk. Unimplemented controls without one look like misrepresentation.
  • Audit where CUI actually lives. The cloud allegation covered February 2023 to October 2024, which suggests a newer service adopted outside the compliance process. Inventory file-sharing, collaboration and backup services, and confirm that any cloud provider holding CUI meets FedRAMP Moderate or equivalent and supports DoD incident-reporting obligations.
  • Take your security staff seriously. The whistleblower was the company's own former director of cybersecurity. If your security lead tells you a certification is not accurate, fixing it is cheaper than litigating it.
  • Do cyber due diligence in acquisitions. Ask for the target's SSP, POA&Ms, SPRS submissions and cloud inventory before closing, not after.

The ILC case does not turn on advanced attacks or exotic controls. It turns on missing documents, outdated assessments and a cloud service nobody vetted, the same quiet gaps that many small and mid-size contractors may still have. The difference now is that those gaps can carry an eight-figure price.

Sources