U.S. defense contractors Raytheon and Nightwing Group agreed to pay the government $8.4 million to settle allegations that Raytheon violated the terms of a contract with the Defense Department by not having ample cybersecurity protections.

According to the settlement agreement, from August 2015 through June 2021 the company’s CODEX division — short for Cyber Offense & Defense Experts — used a network that did not adhere to the government’s cybersecurity standards and which held non-classified defense information.

Raytheon, which according to the Thursday agreement does not admit to being at fault, allegedly failed to develop a “system security plan” describing security measures.

In May 2020, Raytheon allegedly informed government clients that the network was not in compliance with National Institute of Standards and Technology standards and that the company “was in the process of developing a robust system environment” that would replace it. 

The settlement falls under the False Claims Act, a Civil War-era law that allows for civil damages against government contractors who violate the terms of their agreement. The law has been increasingly used as an enforcement mechanism to require contractors to live up to their cybersecurity obligations. 

In March, the defense contractor MORSE Corp agreed to pay $4.6 million to settle allegations it used a third-party provider to host emails without ensuring that it met security requirements. The contractor Health Net Federal Services (HNFS) and its parent company Centene Corporation in February reached a $11.2 million settlement over alleged lies about meeting security standards. 

The Raytheon case was brought by the former director of engineering at the company, who as a whistleblower will receive more than $1.5 million of the settlement. Virginia-based Nightwing, which was previously part of Raytheon Technologies and spun out as an independent company in 2024, was named as a defendant.

Nightwing and Raytheon did not immediately respond to requests for comment.