Nov 112026

DOJ Announces $13 Million Settlement with Defense and Aerospace Contractors, Alleging Failures to Meet Cybersecurity Requirements

Kristin Graham Koehler, Jaime L.M. Jones, H. Boyd Greene IV and Kyle J. Fiet
, , , ,

On November 3, 2026, DOJ announced a settlement with defense and aerospace contractors ILC Dover LP and ILC Astrospace LLC (together, “ILC”) to pay $13 million to resolve allegations that they violated the False Claims Act by failing to satisfy cybersecurity requirements in their contracts with the Department of the Army, the Missile Defense Agency, and NASA. This settlement involves yet another enforcement effort through the recently created Task Force to Eliminate Fraud, previously reported on here and here. Like DOJ’s June 2026 settlement with LOGZONE Inc., which we covered here, this resolution underscores cybersecurity compliance as a key focus of FCA enforcement.

The settlement concerns claims submitted or caused to be submitted to the Army, the Missile Defense Agency (“MDA”), and NASA between January 1, 2018 and October 30, 2024. According to the settlement agreement, the government contended that ILC failed to satisfy several contractual cybersecurity obligations. Those allegations fall into five categories.

First, from February 2023 to October 2024, ILC allegedly stored engineering, manufacturing, and quality documentation, including covered defense information (“CDI”), with an external cloud provider without ensuring Federal Risk and Authorization Management Program (“FedRAMP”) Moderate-equivalent security. Second, ILC allegedly lacked a system security plan (“SSP”) for each covered information system at various times during contract performance. Third, ILC allegedly did not fully implement NIST SP 800-171 and 800-53 controls. DOJ alleged that third-party consultants told ILC that dozens of controls were unimplemented, but ILC did not report the resulting scores or security vulnerabilities to DoD. Fourth, ILC allegedly lacked plans of action and milestones to correct deficiencies. Fifth, from November 30, 2020 to October 30, 2024, ILC was allegedly ineligible for DoD awards because ILC Astrospace had posted no Supplier Performance Risk System (“SPRS”) assessment and ILC Dover had not submitted a current one. ILC did not admit liability in the settlement.

Unlike LOGZONE, where DOJ focused on an inflated self-assessment score, the theory here is largely one of absence: missing SSPs, missing or stale SPRS postings, and undeveloped remediation plans. The allegations also show how third-party assessments can bear on knowledge: DOJ alleges ILC was told twice, six years apart, that dozens of controls were unimplemented. That suggests gap assessments not matched by documented remediation and a considered approach to reporting may become evidence of scienter. And as the cloud allegation and the Army subcontracts here illustrate, obligations extend to third-party providers and flow down to subcontractors.

The settlement arose from a qui tam action filed in January 2025 in the District of Delaware by Philip Root, ILC’s former director of cybersecurity. United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.). Root will receive $2.35 million of the government’s recovery. The agreement also provides for separate payments of $288,000 for the relator’s attorneys’ fees and costs and $180,000 to resolve claims outside the defined covered conduct. Of the $13 million payment to the United States, $6.5 million is designated as restitution, illustrating the typical 2x multiplier.

Cybersecurity compliance is fast becoming an area of increasing FCA enforcement focus. In announcing the settlement, Assistant Attorney General Brett Shumate emphasized that contractors “must comply with the cybersecurity requirements in their federal contracts and subcontracts.” DOJ’s continued emphasis in this area sends a clear message: government contractors should take stock of their cybersecurity compliance requirements to ensure that they are meeting these obligations, and, if they are not, should promptly implement a remediation plan.

A copy of the settlement can be found here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Contacts
Kristin Graham Koehler

Washington, D.C.

kkoehler@sidley.com

Jaime L.M. Jones

Chicago

jaime.jones@sidley.com

H. Boyd Greene IV

Washington, D.C.

bgreene@sidley.com

Kyle J. Fiet

Washington, D.C.

kfiet@sidley.com

You might also like
DOJ and EEOC Announce $29.5 Million Two-Part Settlement with Lockheed Martin, the Fourth FCA Resolution Targeting Alleged Employment Discrimination

On November 3, 2026, the Department of Justice (“DOJ”) and the Equal Employment Opportunity Commission (“EEOC”) announced a two-part settlement with Lockheed Martin Corporation (“Lockheed”) totaling approximately $29.5 million. Lockheed will pay $22 million, plus interest, to the United States to resolve False Claims Act (“FCA”) allegations tied to its federal contract certifications. The FCA settlement also resolves a qui tam action filed in July 2025 in the Northern District of Texas by Tim Booher, a former Lockheed vice president. DOJ intervened in part on October 28, 2026, and Mr. Booher will receive $4.4 million. This is DOJ’s fourth FCA settlement resolving alleged employment discrimination (we covered the prior three here, here, and here). Lockheed will also pay approximately $7.5 million to more than 1,000 employees under a separate settlement agreement with the EEOC.

DOJ and HHS Launch Healthcare FCA Self-Disclosure Pilot Program with Fixed Repayment Multiplier

On October 22, 2026, the Department of Justice (“DOJ”) Civil Division and the Department of Health and Human Services (“HHS”) announced a six-month Healthcare False Claims Act Self-Disclosure Pilot Program (“FCA SDPP”). The program offers healthcare companies a defined path to resolve potential FCA violations the government does not yet know about, in exchange for a “coordinated civil release” and a repayment within a set multiplier range. DOJ says the goal is to free up government resources to focus on “recalcitrant actors.”

DOJ Fraud Division and HHS-OIG Announce Joint Self-Disclosure Policy, Directing Healthcare Companies to Bring Potential Criminal Matters to DOJ First

On October 15, 2026, the Department of Justice’s National Fraud Enforcement Division (“NFED”) and the Department of Health and Human Services Office of Inspector General (“HHS-OIG”) announced a joint policy (the “Policy”) directing companies seeking to self-disclose potential criminal healthcare matters to NFED’s Health Care Fraud Section. The Policy promises companies deemed to have made good faith, voluntary self-disclosures credit under both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Self-Disclosure Protocol. It arrives two weeks after the Fraud Division issued Directive 26-12, Corporate Enforcement in the Fight Against Fraud (the “Directive”), in which NFED identified healthcare fraud as its top priority.  You can read more about the Directive here.