The Broadside
Watch hubsRSS →

Watch hub·enforcement · qui-tam · civil-cyber-fraud · fca

Enforcement

Civil Cyber-Fraud Initiative settlements, qui tam unsealings, and the turn from voluntary to mandatory.

Updated ·RSS ↗

Cyber-compliance enforcement has accelerated through the Department of Justice's Civil Cyber-Fraud Initiative. This hub tracks settled and pending False Claims Act actions, GAO bid-protest decisions touching cyber clauses, and DCMA/DIBCAC findings as they become public — cross-cutting CMMC, FedRAMP, and state programs.

What changed in the last 30 days

  • enforcement/trade-press

    DOJ, Europol arrest teenage-led KillSec ransomware group

    Operation KillSwitch arrested three alleged KillSec members Sept. 30, including a 16-year-old believed to have led the group, and seized its leak site, five central servers and at least 110 terabytes of stolen data. KillSec compromised roughly 500 organizations since 2024 by exploiting defects in on-prem and cloud infrastructure. Confirmed victims in the Puerto Rico indictment against negotiator Fouad Eltibrizi include US BioTek Laboratories, a Washington-state contractor listed as "U.S.B.L." Eltibrizi awaits extradition to the US and faces up to 10 years on unauthorized computer access conspiracy charges.

  • enforcement/judicial

    Enterprise Technology Solutions pays $2.25M over SBA set-aside fraud claims

    Enterprise Technology Solutions and Zahid and Shamela Sheikh agreed to pay $2.25 million to resolve False Claims Act allegations that the company falsely claimed eligibility for two SBA programs and used the misrepresentation to win set-aside contracts. U.S. Attorney Jeanine Ferris Pirro announced the civil settlement. Contractors certifying size and status on bids should read it as another sign that set-aside eligibility is an active enforcement front; the release doesn't say whether ETS faces debarment.

  • cmmc/trade-press

    CMMC self-attestation during Phase Two freeze carries FCA risk

    DoD's July 13 suspension of Phase Two CMMC mandatory third-party assessments has extended the period in which contractors rely on self-attestation. While the department conducts its 60-day review, Phase One self-assessment requirements remain in force. For contractors handling CUI at Level 2, that means senior officials continue signing annual compliance affirmations under DFARS 252.204-7021. The less-visible risk: if a cyber incident later triggers an investigation and documented evidence of continuous control monitoring isn't there, those affirmations can face FCA scrutiny. The Civil Cyber-Fraud Initiative has already yielded settlements where contractors allegedly misrepresented their implementation of NIST SP 800-171 controls.

Open questions

  • 01How many CCFI cases reference NIST 800-171 compliance representations as the predicate?
  • 02Are settlements moving toward higher dollar figures over time?
  • 03When does the first criminal referral connected to CMMC or FedRAMP misrepresentation appear?

Sources we watch

Earlier coverage