A Delaware maker of spacesuits and protective gear has agreed to pay $13 million to end a whistleblower lawsuit claiming it billed the federal government while knowingly falling short of the cybersecurity terms in its contracts. The Justice Department announced the deal on November 3, 2026. ILC Dover LP and ILC Astrospace LLC, both based in Frederica, Delaware, and now owned by the industrial manufacturer Ingersoll Rand, will resolve allegations tied to contracts with the Department of the Army, the Missile Defense Agency and NASA.
The settlement is not an admission. The Justice Department’s announcement says the claims “are allegations only and there has been no determination of liability,” and Ingersoll Rand said it agreed to resolve the matter “without an admission of liability.” What makes the case worth studying is less the dollar figure than the path the government says the problems took: through a cloud vendor, through missing paperwork, through self-reported scores, and then through a corporate acquisition.
What the government alleged
According to the Justice Department, ILC submitted false or fraudulent claims for payment between January 2018 and October 2024 because it knew it was not meeting its contracts’ cybersecurity requirements. The settlement covers five sets of allegations, each with its own time window:
- A cloud provider that did not meet the bar. From February 2023 to October 2024, ILC allegedly stored controlled unclassified information (CUI) with a third-party cloud company without requiring and ensuring that the provider met security standards equivalent to the FedRAMP Moderate baseline, or that it complied with Defense Department rules on cyber incident reporting, malicious software, media preservation, forensic access and damage assessment.
- No system security plan. For most of the period from January 2018 to October 2024, ILC allegedly did not develop, document and update a system security plan for each covered information system describing its boundaries, environment, implemented controls and connections to other systems.
- Controls not in place. Throughout the period, ILC allegedly had not fully implemented the controls in National Institute of Standards and Technology (NIST) Special Publications 800-171 and 800-53, including some whose absence could lead to significant exploitation of the network or exfiltration of defense information.
- No remediation plans. For parts of the period, ILC allegedly had no plans of action and milestones to fix known deficiencies.
- Missing or stale assessments. From November 2020 to October 2024, ILC Astrospace allegedly never submitted a current NIST SP 800-171 self-assessment to the Defense Department, and ILC Dover allegedly did not submit one that was current, grounded in a system security plan, and done under the department’s assessment methodology.
Nothing in the announcement says anyone broke into ILC’s systems or stole data. That is typical. Cyber cases under the False Claims Act turn on the gap between what a contractor promised and what it did, not on whether attackers got in. A company can have a quiet incident record and still face treble damages if its certifications did not match reality.
The whistleblower and the money
The case began as a qui tam suit, the False Claims Act mechanism that lets a private person sue on the government’s behalf and share in any recovery. The relator is Philip Root, ILC’s former director of cybersecurity, who will receive $2.35 million, about 18 percent of the settlement. The case is United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70, in federal court in Delaware, filed in January 2025 according to his lawyers.
Root’s counsel at Whistleblower Law Collaborative described the result as a record for the Justice Department’s Civil Cyber-Fraud Initiative, which the department launched in October 2021 to bring False Claims Act cases over cybersecurity misrepresentations. That claim depends on how you count. Independent trackers of these settlements put a 2025 case against IT firm Hill ASC, which involved billing for cybersecurity services under a General Services Administration schedule, at “at least” $14.75 million. Among cases tied to defense or NASA contracts, though, ILC’s $13 million appears to be the largest announced so far, ahead of the $11.25 million Health Net Federal Services paid in February 2025 and the $8.4 million Raytheon and Nightwing paid that May.
The investigation drew in a long list of agencies: NASA’s inspector general, the Defense Criminal Investigative Service, Army CID, the Naval Criminal Investigative Service, the Air Force Office of Special Investigations and the GSA inspector general. That breadth is a signal in itself. Contract cybersecurity is no longer a niche concern for a single program office.
The acquisition problem
Ingersoll Rand bought ILC Dover in June 2024. “We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” Ingersoll Rand spokesperson Sara Hasell told CyberScoop. The government’s allegation windows all close in October 2024, which fits that account.
The buyer still paid. ILC Dover itself remained the defendant. When a company is bought whole, its liabilities, including False Claims Act exposure built up before the deal, generally travel with it. The Raytheon and Nightwing settlement in 2025 made the same point from a different angle, with a successor business taking on allegations about systems run years before. For acquirers in the defense industrial base, cybersecurity diligence is not a box on the IT checklist. It is a liability question that belongs alongside tax and environmental exposure in the deal model, and the kind of due diligence teams already run on vendors should extend to the target company itself.
Why this lands harder now that CMMC is paused
The timing matters. On July 13, 2026, the Pentagon suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program, which had been set to start on November 10, 2026 and would have made third-party assessments at Level 2 a condition of award for many contracts involving CUI. According to the Defense Department CIO’s CMMC page, Phase 1 self-assessment requirements “remain firmly in place,” a reform task force is reviewing the program, and the department will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments in the meantime.
The suspension was made by memo, not by rewriting the regulations, and contract clauses already signed still bind. Fewer outside assessors means more weight on the contractor’s own word. Under Phase 1, a senior official affirms compliance in the Supplier Performance Risk System, and an inflated score or a stale affirmation is exactly the kind of statement the ILC allegations describe. The ILC case shows the government does not need an outside assessor’s report to build a case. It needs an insider who knows the score was wrong.
Five checks for contractors handling federal data
None of this guarantees protection from a lawsuit, but the ILC allegations map neatly onto artifacts a company can test today:
- Inventory every place CUI lives. Include cloud storage, collaboration tools and file-sharing services that teams adopted without procurement. For each one, get evidence that the provider meets FedRAMP Moderate or an equivalent baseline and will honor incident reporting and forensic access duties. A vendor’s marketing page is not that evidence, and the type of access each vendor has should be written down.
- Write the system security plan for the system you actually run. The plan should describe real boundaries and connections, and it should be updated when the network changes. A document drafted once for a proposal and never revisited is a liability, not a control.
- Treat open findings as dated commitments. Every known gap needs a plan of action with an owner and a deadline. Missing milestones repeatedly is a pattern a relator can describe in a complaint.
- Re-score before you affirm. Compare the score in the government system with an honest internal review. If the score is too high, correct it before someone else points it out. Careful records that prove compliance are what a defense rests on later.
- Listen to your security staff. In this case and several before it, the relator was the person responsible for cybersecurity. An internal escalation path that ends in a fix is far cheaper than one that ends in a sealed complaint.
The same logic now runs through state law as well. Attorneys general are turning cybersecurity failures into enforcement cases under consumer protection statutes, so commercial companies that never touch a defense contract face their own version of the promise-versus-practice test.
FAQ
Did ILC admit wrongdoing?
No. The Justice Department says the claims are allegations only with no determination of liability, and Ingersoll Rand says it settled without admitting liability.
Does a contractor have to suffer a breach to face a cyber False Claims Act case?
No. Liability rests on knowingly false claims or certifications. The ILC announcement does not allege any intrusion or data theft.
What is CUI, and why does cloud storage matter?
Controlled unclassified information is government information that law or policy requires to be safeguarded even though it is not classified. Defense contracts require that cloud providers holding it meet security requirements equivalent to FedRAMP Moderate and support incident reporting and forensic access. Our glossary of cybersecurity legal terms covers related vocabulary.
How much can a whistleblower receive?
Generally 15 to 25 percent of the recovery when the government intervenes, and up to 30 percent when it does not. Root’s $2.35 million share is about 18 percent of $13 million.
Is CMMC dead?
No. Phase 2 and later phases are suspended pending a review, but Phase 1 self-assessments and the underlying NIST SP 800-171 obligations in DFARS 252.204-7012 remain in force.
The test left behind
For years, contractors treated cybersecurity scores as a gate to clear on the way to an award. The ILC settlement treats them as sworn statements with a long tail. With the Pentagon’s third-party assessments on hold, the people best placed to check those statements are the employees who wrote them. The open question for every security director in the defense supply chain is whether their company will hear the bad news from them first, or from the Justice Department.
