Digital Attacks
Cybersecurity compliance: ILC Dover and ILC Astrospace to pay $13 million to resolve allegations that they did not meet cybersecurity requirements in contracts with the US Army and NASA
Cybersecurity compliance in US contracts: ILC Dover and ILC Astrospace will pay $13M to resolve False Claims Act allegations, with no finding of liability.
In brief
- The US Justice Department announced on November 3, 2026 that defense and aerospace contractors ILC Dover and ILC Astrospace of Delaware will pay $13 million to resolve allegations under the False Claims Act.
- According to the allegations, between January 2018 and October 2024 the companies submitted claims for payment knowing they did not meet the cybersecurity requirements in contracts with the US Army, the Missile Defense Agency and NASA.
- The case was brought by a whistleblower, the companies' former Director of Cybersecurity, who will receive $2.35 million of the settlement.
- Status: civil settlement. According to the announcement, the claims are allegations only and there has been no determination of liability.
What the companies were alleged to have done
According to the Justice Department announcement, the allegations focus on five areas (US Justice Department):
- Storing controlled unclassified information (CUI) with a third-party cloud provider between February 2023 and October 2024, without ensuring the provider met security standards equivalent to the FedRAMP Moderate baseline.
- Not having a documented and updated system security plan for each covered information system, during parts of the period.
- Not fully implementing the controls in NIST SP 800-171 and NIST SP 800-53.
- Not having plans of action to correct deficiencies and reduce vulnerabilities, during parts of the period.
- Not submitting a current NIST SP 800-171 assessment to the US Department of Defense, between November 2020 and October 2024.
Who exposed it and who investigated
The case was brought under the whistleblower provisions of the False Claims Act, which allow a private person to sue on behalf of the government and receive a share of the recovery. It was filed in the federal court for the District of Delaware. The investigation involved, among others, the investigative units of the Department of Defense, the US Army and NASA.
Assistant Attorney General Brett A. Shumate said in the announcement that contractors must comply with the cybersecurity requirements in their federal contracts (US Justice Department).
What this means for companies and vendors
The settlement shows that a cybersecurity failure can turn into a fraud allegation when a company keeps billing under a contract that requires compliance with a standard. For a company choosing a vendor or partner that will hold sensitive information, due diligence should include a simple question: are its compliance statements backed by actual documentation. As happened here, an employee who knows the gap from the inside may be the one to expose it.
Sources: US Justice Department, 03.11.2026.
Further reading: Due diligence: what it is and when you need it, Background check before a deal, and Business intelligence and due diligence service.
The information in this section is general and is not legal advice. According to the Justice Department announcement, the claims resolved by the settlement are allegations only and there has been no determination of the companies' liability.
