DOJ Expands False Claims Act Enforcement to Target Cybersecurity Violations

In a significant enforcement trend, the U.S. Department of Justice recovered $52 million through False Claims Act settlements related to cybersecurity violations during the fiscal year ending September 2025. These recoveries were part of a record-setting $6.8 billion in total False Claims Act recoveries for the year, signaling intensified scrutiny of government contractors’ cybersecurity practices.

The Justice Department reported that cybersecurity fraud resolutions have more than tripled in each of the past two years, reflecting what Deputy Assistant Attorney General Brenna Jenny described as a “significant upward trajectory” in enforcement actions against contractors who misrepresent their security capabilities.

This enforcement push stems from the Civil Cyber-Fraud Initiative launched in October 2021, which has now matured into an established institutional priority. Initially viewed by some as an experimental approach, the initiative has resulted in fifteen civil cyber-fraud settlements under the False Claims Act since its inception, with more than half announced during the current administration.

The DOJ has clarified that its enforcement focus isn’t on data breaches themselves but rather on misrepresentations about cybersecurity compliance. “FCA cybersecurity cases are not about data breaches,” Jenny emphasized in January 2026 remarks at the American Conference Institute’s Advanced Forum on False Claims and Qui Tam Enforcement. Instead, cases target situations where contractors falsely claim compliance with security requirements.

This distinction is crucial for government contractors to understand. Under the False Claims Act, liability arises when an entity knowingly submits false or misleading claims for payment. In cybersecurity contexts, this can include explicit certifications of compliance or even implied representations embedded in contract submissions and invoices.

The consequences are severe, with the FCA’s treble damages framework providing substantial financial penalties for violations. The law’s qui tam provisions, which allow whistleblowers to bring claims on the government’s behalf and potentially receive up to 30 percent of recoveries, add another layer of risk for non-compliant contractors.

Nine of the fifteen cybersecurity-related settlements have involved Department of Defense requirements. The DoD recently finalized its Cybersecurity Maturity Model Certification (CMMC), which introduces structured verification requirements that create more objective compliance benchmarks.

Civilian agencies are following suit. In January 2026, the General Services Administration issued guidelines governing the protection of Controlled Unclassified Information on contractor systems, incorporating extensive third-party assessment requirements. This trend toward more rigorous verification is spreading across the federal contracting landscape.

The enforcement expansion affects a broad range of entities, from defense contractors and IT service providers to healthcare benefit administrators and research universities. Even organizations adjacent to prime contractors face increased scrutiny if federal dollars flow with cybersecurity conditions attached.

Whistleblowers continue to play a central role in identifying violations. Cybersecurity compliance failures often surface internally before becoming public, and when employee concerns go unaddressed, the FCA provides a direct channel to the DOJ. Organizations that dismiss internal cybersecurity complaints as routine HR matters significantly underestimate their risk exposure.

This enforcement reality demands that companies adopt a cross-functional approach to cybersecurity governance. Technical compliance is no longer sufficient; it has become a representation issue, a contract performance issue, and ultimately a legal risk management issue.

For government contractors and grant recipients, the message is clear: accuracy in cybersecurity representations is paramount. Any gap between certification and actual practice can quickly escalate into costly investigations. Organizations must ensure clearly defined accountability for compliance, comprehensive understanding of obligations, coordinated reporting channels for concerns, and ongoing security posture assessments.

As cybersecurity becomes central to the Justice Department’s FCA enforcement strategy, contractors must recognize that what they tell the government about their security capabilities must align with operational reality. The days of treating cybersecurity compliance as merely a technical checklist managed solely by IT departments have definitively ended.