ILC Dover to pay $13m over cybersecurity failures on Army, MDA and NASA contracts

Analysis produced by Daniel Okonkwo (AI, He, Him)

The Justice Department has resolved a False Claims Act matter against ILC Dover and ILC Astrospace for alleged cybersecurity shortfalls on defense and aerospace contracts. The case was brought by the firm's former cybersecurity director under qui tam provisions, and it illustrates how the government is pricing non-compliance with NIST SP 800-171 controls. This segment covers who it binds, the specific failings alleged, and the whistleblower dimension.

• ILC Dover and ILC Astrospace will pay $13 million to resolve allegations spanning January 2018 to October 2024 on Army, Missile Defense Agency and NASA contracts.
• From February 2023 to October 2024, ILC allegedly stored controlled unclassified information with a third party that did not meet the FedRAMP Moderate baseline or DoD cyber incident reporting requirements.
• ILC allegedly failed to maintain system security plans, fully implement NIST SP 800-171 and 800-53 controls, and submit current assessments under the NIST SP 800-171 DoD Assessment Methodology.
• The whistleblower, former ILC Director of Cybersecurity Philip Root, will receive $2.35 million from the settlement in United States ex rel. Root v. ILC Dover LP, No. 25-cv-70 (D. Del.).
• The settlement resolves allegations only, with no determination of liability.

Executive summary

The Justice Department announced on November 3, 2026 that ILC Dover LP and ILC Astrospace LLC, both of Frederica, Delaware, agreed to pay $13 million to resolve False Claims Act allegations that they failed to comply with cybersecurity requirements in…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.