Record $13 Million Cybersecurity Settlement Reached
ILC Dover and ILC Astrospace will pay the United States $13 million to resolve a case in which the companies were accused of making false claims about cybersecurity requirements. According to the Whistleblower Law Collaborative, this is the largest cybersecurity fraud recovery to date under the U.S. Department of Justice program.
- ILC Dover and ILC Astrospace will pay $13 million to resolve the case.
- The allegations concerned cybersecurity controls required to protect government data.
- The case was triggered by a whistleblower lawsuit filed under the False Claims Act.
- The payment is the largest cybersecurity fraud recovery to date under the program.
- Whistleblowers can receive between 15 and 30 percent of the government's recovery in successful cases.
Allegations involving the protection of government data
ILC Dover and ILC Astrospace will pay $13 million to resolve the case. The companies manufacture spacesuits and protective equipment for NASA and the U.S. Army. The settlement concerns allegations that the companies falsely claimed to have implemented the cybersecurity controls required to protect government information.
According to the announcement, the agreement is the largest government cybersecurity fraud recovery under the Department of Justice's Civil Cybersecurity Fraud program. The program was announced in October 2021. The settlement does not mean that the court found the companies liable. Instead, the parties agreed to the payment to resolve the allegations.
ILC Dover is headquartered in Frederica, Delaware, and provides engineering and manufacturing services for the aerospace, medical device, pharmaceutical and biopharmaceutical industries. Ingersoll Rand acquired the company in 2024.
Whistleblower lawsuit triggered the proceedings
A whistleblower filed the lawsuit in January 2025. The whistleblower alleged that ILC Dover had not fully implemented the controls required under the NIST SP 800-171 standard, which are intended to protect sensitive government data. The whistleblower also alleged that the company's information systems did not provide adequate protection when processing, storing and transmitting the data.
The lawsuit included additional allegations. These included the absence of a consolidated system security plan, the use of external cloud services that did not comply with applicable federal security requirements, and the submission of allegedly artificially inflated SPRS assessment scores to the U.S. Department of Defense.
The whistleblower filed a so-called qui tam lawsuit under the False Claims Act. This allows a private individual, known as a relator, to report suspected fraud on behalf of the government in a sealed filing. If the case succeeds, the whistleblower is entitled to between 15 and 30 percent of the amount recovered by the government.
Authorities continue cybersecurity reviews
The U.S. government investigated the allegations and then announced on November 3, 2026, that it intended to intervene in the case against ILC Dover for the purpose of reaching a settlement. Brett A. Shumate, the deputy attorney general, said defense and aerospace contractors must comply with the cybersecurity requirements included in federal contracts and subcontracts. He added that the department would continue to hold contractors and subcontractors accountable when they fail to meet their cybersecurity commitments.
Benjamin L. Wallace, the U.S. attorney for Delaware, said the requirements are intended to prevent the exploitation of U.S. technological innovation and that his office is responsible for enforcing contractual cybersecurity requirements. Robert Steinau, an official with the NASA Office of Inspector General, said the government was grateful to whistleblowers who do the right thing by reporting violations.
The Whistleblower Law Collaborative said the case represents another step toward enforcing cybersecurity compliance across the defense industrial base. The statement said it expects the Department of Justice, the Department of Defense, NASA and other government agencies to continue investigating and pursuing failures to implement the controls needed to protect sensitive government data.
