Settled $11.25M — falsely certified compliance with cybersecurity requirements in providing managed federal health-care services.

Settled $14.75M — Maryland IT contractor failed to meet contractual cybersecurity requirements on federal contracts.

Settled $9.8M — genomic-sequencing maker sold systems with cybersecurity vulnerabilities while misrepresenting its security practices.

Settled $8.4M — knowingly failed to comply with NIST SP 800-171 cybersecurity controls required by DoD contracts.

Settled $4.6M — defense contractor failed to implement required cybersecurity controls and misrepresented its compliance.

Settled $1.75M — California defense contractor maintained inadequate cybersecurity controls on covered systems.

Settled $875K — failed to maintain required cybersecurity controls and to have a compliant system security plan on DoD research contracts.

Settled $421K — Illinois precision-machining contractor had cybersecurity deficiencies on covered defense information systems.

Settled $1.25M — failed to comply with DFARS 252.204-7012 / NIST 800-171 cybersecurity requirements across 15 DoD and NASA contracts.

Settled $306K (plus a waiver of at least $877K) — failed to properly protect personal information, resulting in a data breach.

Settled $11.3M — failed to perform required cybersecurity testing before launching the New York Emergency Rental Assistance Program system.

Settled $2.7M — deficient cybersecurity measures on a pandemic-related (COVID-19 contact-tracing) government contract, exposing personal information.

Settled $4.09M — failed to implement required cybersecurity controls in its Managed Trusted IP Service (MTIPS) for federal agencies.

Settled $294K — failed to secure personally identifiable information on a Florida state healthcare-enrollment website.

Settled $9M — misrepresented compliance with cybersecurity requirements in federal government contracts and subcontracts (the first major CCFI settlement).

Settled $930K — falsely represented compliance with contractual cybersecurity requirements for medical services at U.S. government facilities in Iraq and Afghanistan.