Aerospace and defense giant Aerojet Rocketdyne has agreed to pay $9 million to settle accusations brought by a former employee regarding the company’s compliance with government cybersecurity requirements.
A lawsuit alleging violations of the False Claims Act was filed against Aerojet Rocketdyne in 2015 by former employee Brian Markus, who was hired by the company in 2014 as senior director of cybersecurity, compliance and controls.
According to the complaint, Markus had been promised a budget of $10-15 million and up to 35 employees to improve the company’s cyber defenses. Instead, he was only given a $3.8 million budget and less than ten employees.
Aerojet Rocketdyne makes various products for the aerospace and defense industries, including propulsion and weapons systems. Since the company is a major supplier for the United States government, including NASA and the Defense Department, it needs to comply with federal requirements and meet minimum cybersecurity standards to prevent unauthorized access to sensitive information.
Markus claimed in his complaint that the company not only failed to meet the minimum standards, but also misled the government.
Despite having its systems breached by state-sponsored threat actors in 2013 and 2014, Aerojet Rocketdyne failed to take proper action and attempted to conceal its non-compliance from both the government and its board of directors, the whistleblower alleged.
A cybersecurity audit conducted in 2014 showed that the company was less than 25% compliant. Markus later prepared a presentation to inform the board of Aerojet’s non-compliance, but then-president Warren Boley changed the presentation to hide the information from the board, the complaint alleged.
In April 2015, a cybersecurity assessment conducted by EY found — within four hours — that the company’s systems had been plagued by critical vulnerabilities that could be exploited to compromise systems and gain access to highly sensitive corporate and technical information.
Markus’ employment was terminated in September 2015, just a few months after he allegedly refused to sign documents falsely claiming that the space propulsion company had been in compliance with government cybersecurity requirements.
The Justice Department announced on Friday that Aerojet Rocketdyne has agreed to pay $9 million to resolve the False Claims Act allegations. Markus filed the lawsuit under the whistleblower provisions of the False Claims Act on behalf of the US government and he is entitled to part of the settlement. Specifically, he will receive $2.61 million.
Related: CEO Accused of Making Millions via Sale of Fake Cisco Devices
Related: Former Execs of Cybersecurity Firm GigaTrust Charged With Financial Fraud
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- Watch on Demand: Supply Chain & Third-Party Risk Summit Sessions
- TikTok CEO Grilled by Skeptical Lawmakers on Safety, Content
- CISA, NSA Issue Guidance for IAM Administrators
