The government alleged that between 2015 and 2018, Health Net failed to timely scan for known vulnerabilities and to remedy security flaws on its networks and systems, in accordance with its own System Security Plan.

No data breach was required to establish liability. The false certification itself was enough.

What Does the False Claims Act Have to Do With Cybersecurity?

Most people associate the False Claims Act with healthcare billing fraud or defense contractor overbilling. But the law applies to any knowing misrepresentation made in connection with a claim for government payment. When a contractor certifies cybersecurity compliance as a condition of receiving federal funds, and that certification is false, every payment the government makes on that contract is potentially a false claim.

The DOJ’s Civil Cyber-Fraud Initiative, launched in 2021, specifically focuses on entities that knowingly provide deficient cybersecurity products or services, knowingly misrepresent their cybersecurity practices or protocols, or violate obligations to monitor and report cybersecurity incidents and breaches.

The theory of liability is not limited to deliberate fraud. The FCA’s “knowingly” standard includes deliberate ignorance of the truth or reckless disregard of the truth or falsity of information, not just actual knowledge. Contractors who submit compliance affirmations without verifying their accuracy, or who fail to promptly correct inaccurate compliance claims when new information comes to light, can face FCA exposure.

The Contracts That Require Cybersecurity Compliance

Federal contracts that involve controlled unclassified information (CUI) require contractors to implement the security controls set out in NIST Special Publication 800-171, a framework covering access controls, incident response, vulnerability management, and over 100 other requirements. Contractors must assess their own compliance and submit scores to the Supplier Performance Risk System (SPRS). Those self-assessments become representations to the government.

When contractors inflate their SPRS scores, skip required controls, or certify a System Security Plan they have not actually implemented, they have made a false statement in connection with a federal contract. The DOJ specifically cited Raytheon’s lack of a System Security Plan as a critical compliance gap in the May 2025 settlement that resolved allegations across approximately 30 Department of Defense contracts.

Raytheon, RTX Corporation, and Nightwing Group agreed to pay $8.4 million to resolve those allegations. The whistleblower, a former Director of Engineering at Raytheon, received a share of the recovery.

No Breach Required

One of the most significant features of the DOJ’s cybersecurity enforcement theory is that an actual data breach is not necessary to trigger FCA liability. What matters is whether the contractor’s certifications were accurate at the time they were made.

In the Illumina matter, the DOJ secured a $9.8 million settlement for misrepresentations about cybersecurity compliance in medical device software. These cases confirm the trend of the DOJ using the FCA to enforce cybersecurity obligations even absent a data breach.

The same principle applied in the Health Net case. Both HNFS and Centene maintained that no vulnerabilities were exploited and no data breaches occurred, yet they agreed to pay over $11 million to resolve the allegations.

Common Whistleblowers Regarding Cybersecurity Fraud

The people with the most direct knowledge of a contractor’s actual cybersecurity posture are typically the people who work on it, such as: 

• IT security staff who know a required control was never implemented
• Engineers who raised concerns about vulnerability scanning and were told to proceed anyway
• Compliance personnel who signed off on self-assessments they knew were inflated or inaccurate
• Employees who discovered that sensitive government data was being processed on systems that did not meet federal standards

In the Georgia Tech case, the whistleblowers were the university’s associate director of cybersecurity and a former information security graduate student. They alleged that when they brought compliance problems to administrators, the administrators failed to take action. When their internal reports went nowhere, they filed a False Claims Act complaint.

That pattern, an employee raising concerns, being ignored, and then filing a qui tam lawsuit, is how many cybersecurity FCA cases begin. Several major fiscal year 2025 cybersecurity settlements originated from qui tam complaints filed by former employees with inside knowledge of cybersecurity practices. Whistleblowers in successful qui tam actions may be eligible to receive a percentage of the government’s recovery.

The Enforcement Trend Is Accelerating

Cybersecurity enforcement gained significant momentum in fiscal year 2025, with the DOJ recovering more than $52 million across nine cybersecurity-related FCA settlements, a substantial increase from prior years. The rollout of the Cybersecurity Maturity Model Certification program, which adds third-party verification requirements for defense contractors, is expected to generate more compliance data, more discrepancies between certifications and actual practices, and more potential whistleblower complaints.

If you work for a government contractor and have knowledge of cybersecurity misrepresentations made to obtain or retain federal contracts or funds, you may have the basis for a False Claims Act qui tam lawsuit. These cases are technically and legally complex, and working with an experienced whistleblower attorney before taking any steps protects both the strength of your claim and your rights.

Contact Keller Grover today to speak with a whistleblower attorney about what you have observed. Our team handles False Claims Act cases and can walk you through your options before you take any other steps.

The post False Claims Act Cybersecurity Fraud: When Contractors Lie About Their Security Compliance appeared first on Keller Grover.

On March 21, President Joe Biden issued a statement calling on the private sector to strengthen its cyber defenses immediately, citing “evolving intelligence that the Russian Government is exploring options for potential cyberattacks.” 

Biden noted that most of the country’s critical infrastructure is owned and operated by the private sector and argued that critical infrastructure owners and operators must accelerate their efforts to “lock their digital doors.” 

President Biden’s remarks also underscored the importance of the U.S. Department of Justice’s new Civil Cyber-Fraud Initiative, in which the DOJ is using the False Claims Act to enforce its cybersecurity requirements for those who contract with the government or receive federal grant money. 

Recently, Jeb White, president and CEO of the Taxpayers Against Fraud Education Fund, interviewed Sara McLean, assistant director of the DOJ’s Commercial Litigation branch on the Fraud in America podcast. (Keller Grover attorney Kathleen R. Scanlan is an executive producer on the podcast). McLean is overseeing the DOJ’s initiative.  

McLean said the initiative originated from President Biden’s May 2021 Executive Order directing government agencies to use their resources to improve the nation’s cybersecurity. 

The executive order itself followed a series of high-profile breaches, including the May 2021 ransomware attack of the Colonial Pipeline which shut down the country’s largest fuel pipeline, creating gas shortages.

Why the DOJ Reached for the False Claims Act

McLean said the DOJ’s Civil Fraud Section recognized that it has a powerful tool in the False Claims Act, and the initiative was launched in October 2021. 

When asked why the False Claims Act is the avenue the DOJ is using to address cybersecurity issues, McLean said the law is the government’s primary tool for going after fraud involving public money. 

“The False Claims Act has been tremendously successful in getting money back to the government,” she said, adding that it’s also successful in influencing the behavior of those who do business with the government. She said the law encourages compliance and ensures a level playing field for businesses. 

Part of the reason why the Act is so powerful, she said, is its whistleblower provision. The Act incentivizes whistleblowers, also known as relators, to report a fraud on the government by rewarding them with a percentage of the amount the government successfully recovers as a result of the whistleblower’s False Claims Act case.  

Three Areas the Initiative Focuses On

McLean said the Civil Cyber-Fraud Initiative is focused mainly on three areas: 

• A knowing failure of government contractors or grantees to abide by the cybersecurity requirements in their contracts or grants 
• Telling lies or misleading the government into entering some sort of financial relationship
• Failing to timely report breach incidents to the government

The Obligation Is Not Limited to IT Contractors

Importantly, McLean said that contractors or grantees do not necessarily need to be delivering IT services to be held liable under the False Claims Act — contractors and grantees who provide other services are still required to meet their cybersecurity commitments to the government. 

McLean said in cases that are especially technical, the government benefits from insiders who have a sophisticated understanding of technology. 

That’s not to say that all cases will be highly technical or hard to understand — plenty could involve instances where contractors simply lack basic security measures or good password controls or are posting individuals’ personal information on publicly available websites. 

Getting Advice Before You Report

For those who want to report wrongdoing, engaging a whistleblower attorney who can guide them through the implications of litigation is crucial. Keller Grover is committed to helping whistleblowers navigate the process of reporting fraud to the government. 

With over 30 years of combined experience litigating fraud and employment cases and billions in recoveries for its clients, Keller Grover is uniquely positioned to represent whistleblowers. 

If you want to report cybersecurity fraud in your organization, we are here to help. For advice about how to handle suspected fraud, contact Keller Grover for a free and confidential consultation.

The post DOJ Civil Cyber-Fraud Initiative: Russian Cyberattack Threat Underscores Need for Cybersecurity appeared first on Keller Grover.