$13M Cybersecurity Settlement Hits ILC Dover and ILC Astrospace Over Army, MDA and NASA Contracts

Two Delaware defense and aerospace suppliers will pay $13 million because, the government alleges, they took federal money for years while ignoring the cybersecurity rules written into their contracts. The case shows that a missing security plan or a stale self-assessment can turn into False Claims Act liability. The company's own former cybersecurity director brought the suit. ILC Dover LP and ILC Astrospace LLC, both of Frederica, Delaware, agreed to the settlement to resolve allegations tied to contracts with the Department of the Army, the Missile Defense Agency and NASA, the Justice Department announced on November 3, 2026.

The settlement covers claims for payment submitted from January 2018 to October 2024. The government alleges those claims were false or fraudulent because ILC knew it had not complied with the contracts' cybersecurity requirements. The claims are allegations only, and there has been no determination of liability.

"To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts," said Assistant Attorney General Brett A. Shumate of the Justice Department's Civil Division. "We will continue our efforts to hold accountable government contractors and subcontractors that fail to meet their cybersecurity commitments."

Five Alleged Gaps Behind the $13 Million Payment

The Justice Department lists five separate failures, each running for its own stretch of time.

Cloud storage without FedRAMP-equivalent protection. From February 2023 to October 2024, ILC allegedly used a third-party company to store controlled unclassified information in the cloud. It allegedly did so without requiring and ensuring that the provider met security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. ILC also allegedly failed to make sure the provider complied with Department of Defense requirements for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

Missing system security plans. From January 2018 to March 2022, and again from September 2022 to October 2024, ILC allegedly did not develop, document and periodically update a system security plan for each covered information system, as its DoD and NASA contracts required. Those plans are supposed to describe system boundaries, operating environments, how security requirements are implemented, and connections to other systems.

Unimplemented NIST controls. Across the full January 2018 to October 2024 period, ILC allegedly had not fully implemented all cybersecurity controls in National Institute of Standards and Technology Special Publications 800-171 and 800-53. The department says the gaps included controls whose absence could lead to significant exploitation of the network or exfiltration of controlled defense information.

No plans of action and milestones. From January 2018 to May 2019, and from January 2022 to September 2024, ILC allegedly had not developed and implemented plans of action and milestones designed to correct deficiencies and reduce or eliminate vulnerabilities in its systems.

Stale or missing DoD assessments. From November 2020 to October 2024, ILC Astrospace allegedly had not submitted to DoD any current assessment of its NIST SP 800-171 implementation. ILC Dover allegedly had not submitted an assessment that was current, based on a review of a system security plan, and conducted under the NIST SP 800-171 DoD Assessment Methodology.

How ILC's Former Director of Cybersecurity Triggered the Case

The settlement resolves a lawsuit filed under the whistleblower provisions of the False Claims Act, which let private parties sue on the government's behalf and share in any recovery. The whistleblower is Philip Root, ILC's former Director of Cybersecurity, who will receive $2.35 million of the settlement. The case is captioned United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.).

Every contractor should take note of who the relator was. The person who filed the suit had held the company's top cybersecurity role.

NASA's inspector general office welcomed the whistleblower's role. "Strict compliance with federal cybersecurity standards is non-negotiable for any company doing business with NASA," said Robert Steinau, Assistant Inspector General for Investigations at the NASA Office of Inspector General. "Those who jeopardize America's space program by ignoring government protocols will incur steep financial penalties. We are grateful to whistleblowers who do right by reporting these wrongs."

Six Investigative Agencies and a New Fraud Task Force

The Civil Division's Commercial Litigation Branch, Fraud Section, handled the matter together with the U.S. Attorney's Office for the District of Delaware. NASA OIG, the Defense Criminal Investigative Service, Army CID's Northeast Field Office, the Navy Criminal Investigative Service, the Air Force Office of Special Investigations and the GSA Office of Inspector General assisted. GSA OIG reposted the announcement on its own site.

"The best response to cyberattacks is to prevent them from happening in the first place," said U.S. Attorney Benjamin L. Wallace for the District of Delaware. "The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation."

The department linked the case to the Task Force to Eliminate Fraud and the National Fraud Enforcement Division, both launched this year. It said the Civil Division's False Claims Act work "will support and advance the mission" of those two bodies. Defense investigators were blunt as well. "Cybersecurity lapses place critical defense information at risk," said Acting Special Agent in Charge Jessica Herrington of DCIS's Northeast Field Office.

What It Means for Contractors

The ILC settlement treats the paperwork behind a cybersecurity program as part of the deal the government pays for. Three of the five alleged failures involve documents, not breaches: system security plans, plans of action and milestones, and current NIST SP 800-171 assessments filed with DoD. DOJ's announcement does not allege that any data was stolen. Under the government's theory, billing on a contract while knowing those obligations are unmet can make each invoice a potentially false claim.

The cloud allegation needs particular attention. ILC allegedly stored controlled unclassified information with an outside provider without requiring FedRAMP Moderate-equivalent security and DoD incident-reporting terms. Contractors that rely on commercial cloud, file-sharing or managed service providers should confirm that those agreements pass the same requirements down. Having a vendor is not the same as having a compliant vendor.

The case also covers more than one entity. The alleged failures belonged to both ILC Dover and its affiliate ILC Astrospace, and each had its own assessment problem. Companies with several subsidiaries holding separate contracts need a current, accurate assessment on file for each one.

Finally, the $2.35 million award to a former cyber director gives security staff a strong financial reason to report problems to the government. A company that fixes known gaps, documents the fixes and corrects any inaccurate assessment score it has filed takes much of the risk out of a future qui tam suit. Contractors should take those steps before a dissatisfied insider or a federal investigator finds the problems first.