Another Contractor Pays $13 Million for Cybersecurity False Claims

Published 2026 | TIKC NewsWire

Here is a pattern you cannot ignore anymore. Two defense and aerospace contractors recently agreed to pay $13 million to settle claims that they told the government their cybersecurity met the required standards when it did not. That case is not a one-off. It is the newest entry in a wave of cyber False Claims Act cases, and reports say this kind of enforcement has roughly tripled. The message to every contractor, especially small ones, is blunt: the box you check that says your systems are secure is now a legal promise the government will test.

What these cases are really about

These are not hacking stories. The contractors did not necessarily get breached. They got in trouble for saying their security was compliant when it was not. On defense work, you often have to meet a cybersecurity standard like NIST 800-171 and report a score that reflects how well you meet it. When you certify a level of protection you have not actually built, that certification is the false claim. The government does not have to prove a hacker got in. It only has to prove you said something that was not true.

Why this wave is growing

Cyber cases are attractive to enforcers for a simple reason: the proof is in your own records. Your security plan, your score, and your certifications are documents you created and signed. When they do not match reality, the gap is easy to show. This is the same logic behind other cyber settlements this year, and it is why whistleblowers, often former IT staff, bring these cases. They know exactly where the paperwork and the practice do not line up.

The small-business trap

Small contractors get caught here in an honest way. Someone fills out the cybersecurity score during a busy bid, estimates a few items as done, and plans to finish them later. Later never comes, but the certification is already on file. That is not evil, but under the False Claims Act, estimating a score you cannot back up can count as reckless disregard for the truth. The fix is not to become a cybersecurity expert overnight. It is to only certify what you have actually done.

What to do now

• Score yourself honestly. Report a cybersecurity score that reflects what you have truly implemented, not what you hope to finish.
• Write the plan down. Keep a current security plan and a list of the gaps you are still closing.
• Close gaps on a real schedule. Treat your plan of action with deadlines you actually meet.
• Do not certify blind. Never sign a cybersecurity representation you have not personally confirmed.
• Keep the proof. Save the evidence behind your score so you can show how you got there.

Cybersecurity compliance feels technical and far away until it shows up as a seven or eight figure settlement. The good news is that this risk rewards plain honesty. Report the score you actually earned, keep closing your gaps, and save your proof, and the certification that is sinking other firms becomes one more thing you can stand behind. Brick by brick.

FAQ

Do I have to be hacked to face a cyber False Claims Act case?

No. These cases are about certifying that your cybersecurity met the required standard when it did not. The false certification is the violation, whether or not a breach ever happened.

What standard are contractors certifying to?

On much defense work, contractors must meet NIST 800-171 and report a score reflecting how fully they implement its controls. Overstating that score is the core risk.

Why is this enforcement growing so fast?

The proof lives in the contractor’s own security plans, scores, and certifications. When those documents do not match actual practice, the gap is easy to show, and insiders often report it.

How do small firms stay safe?

Report only the score you have truly earned, keep a current security plan with a real gap-closing schedule, never certify what you have not confirmed, and save the evidence behind your score.

Sources

U.S. Department of Justice. (2026). Defense and aerospace contractors agree to pay $13M to resolve cybersecurity False Claims Act allegations.

National Institute of Standards and Technology. (2026). Special Publication 800-171, Protecting Controlled Unclassified Information.

This article is general information, not legal advice.