US Defence Contractor Pays $13 Million Over Alleged Cybersecurity Contract Failures

A Delaware-based defence and aerospace company, referred to by the US government as ILC (covering ILC Dover and ILC Astrospace), has agreed to pay $13 million to settle allegations under the False Claims Act. The case involved contracts with the US Army, the Missile Defense Agency and NASA. The government alleged that ILC submitted claims for payment while knowing it had not met the cybersecurity requirements in those contracts between 2018 and 2024.

Examples cited include using a third-party company to store sensitive data in the cloud without proper safeguards, and failing to develop and update required security plans for each of its covered information systems. US Attorney Benjamin Wallace said the best response to cyberattacks is to prevent them in the first place.

Ingersoll Rand, the parent company of ILC Dover, said it inherited the issue when it acquired the business in June 2024. It said it acted promptly and was compliant by October 2024. The settlement was reached without an admission of liability. It is one of the larger settlements since the Justice Department began using the False Claims Act in 2022 to penalise contractors for cybersecurity shortcomings.