Defense Contractor ILC Settles $13 Million Over Cybersecurity Contract Failures
Defense contractor ILC has agreed to a $13 million settlement with U.S. agencies to resolve allegations of violating cybersecurity contract requirements between 2018 and 2024.
Defense and aerospace firm ILC has agreed to pay $13 million to U.S. agencies to settle allegations that it failed to meet cybersecurity contract requirements between 2018 and 2024. The settlement resolves claims under the False Claims Act, which the government has increasingly used to penalize contractors for cybersecurity shortcomings.
According to the Department of Justice, ILC submitted false or fraudulent claims for payment on contracts with the Department of the Army, Missile Defense Agency, and NASA because it knowingly failed to comply with mandated cybersecurity protocols. Specific allegations include the improper use of a third-party company for storing sensitive data in the cloud without adequate safeguards and a failure to develop and update required security plans for its covered information systems.
Benjamin Wallace, U.S. Attorney for the District of Delaware, emphasized the importance of these cybersecurity obligations, stating, "The best response to cyberattacks is to prevent them from happening in the first place." He added that the violated requirements are crucial for protecting the United States' technical innovation from malicious actors.
Ingersoll Rand, the parent company of ILC Dover, which acquired the firm in June 2024, acknowledged the issue. A spokesperson for Ingersoll Rand stated that the company took prompt action upon becoming aware of the matter and had achieved compliance with applicable requirements by October 2024. The company agreed to the settlement without admitting liability, reaffirming its commitment to strong cybersecurity practices.
This $13 million settlement is notable, representing one of the larger resolutions since the Justice Department began leveraging the False Claims Act for cybersecurity non-compliance in 2022. The law, originally enacted during the Civil War to combat fraudulent contractors, allows private citizens, known as whistleblowers, to bring forward allegations of fraud against the government.
In this case, the whistleblower, Philip Root, a former director of cybersecurity at ILC, is set to receive $2.35 million of the settlement. Government contract attorneys suggest that upcoming regulatory changes may expose more companies to similar False Claims Act penalties.
The settlement underscores the U.S. government's increasing scrutiny of cybersecurity practices among its defense and aerospace contractors. Ensuring compliance with these requirements is paramount to protecting sensitive government data and critical infrastructure from evolving cyber threats.