ILC Dover and ILC Astrospace, subsidiaries of Ingersoll Rand, agreed to pay $13 million to settle allegations that they knowingly failed to meet cybersecurity requirements in government contracts. The Justice Department announced the settlement on Tuesday, November 3.
What the Justice Department Alleges About ILC’s Contract Compliance
The government alleged that ILC knew it was not complying with cybersecurity requirements in its contracts from 2018 to 2024, yet still submitted claims for payment. The contracts involved the U.S. Army, the Missile Defense Agency and NASA.
Two examples appear in the allegations. Sensitive data was stored with a third-party cloud provider without proper safeguards, and the company did not develop or update the security plans that its contracts required for each covered system.
Whistleblower Philip Root Receives $2.35 Million
Philip Root, ILC’s former director of cybersecurity, brought the case as a whistleblower. He will receive $2.35 million from the settlement. The False Claims Act allows private individuals to file suit on behalf of the government and to share in any recovery.
Ingersoll Rand Says It Inherited the Problem
Ingersoll Rand became the parent company in June 2024. The company says it inherited the issue and fixed it by October 2024. It settled without admitting liability.
How the Timeline Divides Responsibility
The 2018 to 2024 period covers years before and shortly after Ingersoll Rand’s acquisition of ILC Dover. Under the company’s account, the compliance gaps predate its ownership and were closed within about four months of the purchase. The settlement does not include an admission, so the allegations remain claims by the government, not established findings.
A Large Settlement in DOJ’s Contractor Cybersecurity Push
The settlement is one of the larger ones since the Justice Department began using the False Claims Act against contractor cybersecurity lapses in 2022. The approach treats a contractor’s promise to meet cybersecurity requirements as a condition of payment, so billing the government while knowing the requirements are unmet can produce liability.
The two examples give a sense of what the government considers a failure. Storing sensitive data with a cloud provider without proper safeguards touches the handling of information, and failing to maintain security plans for each system is a documentation and governance requirement. Neither example involves a reported breach. The allegations rest on non-compliance itself, not on harm from an intrusion.
The case also shows how these matters begin. An insider with responsibility for cybersecurity raised the issue, and the case moved through the False Claims Act process. Employees in compliance and security roles at contractors are therefore well placed to trigger enforcement, and the whistleblower’s share of $2.35 million is an incentive written into the statute.
The contracts at issue span three government customers: the U.S. Army, the Missile Defense Agency and NASA. The allegations cover a six-year period from 2018 to 2024, which makes the settlement a look back across several contract cycles. Ingersoll Rand’s position is that it did not cause the lapses, and the settlement terms include no admission of liability by either ILC entity.
The sources do not say how the $13 million was calculated or what share each ILC entity pays. They also do not indicate whether the government found evidence that data was accessed by unauthorized parties during the period. The settlement resolves the claims without those details.
Signal to Defense Contractors About Cybersecurity Representations
The settlement signals continued enforcement against defense and space contractors that certify compliance with cybersecurity terms. For companies in the sector, the practical points are specific: security plans must exist for each covered system, they must be kept current, and sensitive data stored with outside cloud providers needs the safeguards the contract requires. Ingersoll Rand’s statement that it fixed the issue by October 2024 shows the company remediated, but the payment shows that remediation after the fact does not erase exposure for the earlier period.
