The D&O Diary has been closely following the Department of Justice’s increasing use of the False Claims Act (FCA) as an enforcement tool, including in areas involving cybersecurity compliance, DEI, tariffs, and other regulatory priorities. A recurring concern for companies, directors and officers is that FCA investigations and settlements can serve as the predicate for follow-on securities suits based on alleged disclosure failures.
The newly filed securities class action lawsuit against Honeywell Aerospace Inc. underscores that concern. The September 22, 2026, complaint alleges, in part, that Honeywell Aerospace failed to disclose an ongoing government investigation concerning purported cybersecurity compliance deficiencies under a Department of Defense (DOD) contract. According to the complaint, investors did not learn of the investigation until the company’s September 2026 disclosure of its FCA settlement with the Department of Justice relating to those alleged cybersecurity compliance failures.
As discussed below, the case highlights the D&O risk arising from alleged failures to disclose material operational and regulatory risks, as well as the exposure that can follow when FCA investigations evolve into securities litigation.
A copy of the complaint can be found here.
The Lawsuit
By way of background, Honeywell Aerospace, Inc. became a stand-alone public company following its June 29, 2026, separation from Honeywell International, Inc. Prior to the separation, Honeywell Aerospace operated as the aerospace and defense business segment of Honeywell International, the diversified industrial and technology company.
According to the complaint, in connection with the spin-off, Honeywell Aerospace highlighted investments in its supply chain and manufacturing operations and stated that it was positioned to meet strong customer demand. The plaintiffs allege that, despite these assurances, a small number of supplier bottlenecks was already having a disproportionate effect on production and revenue growth.
On August 5, 2026, the company reported second-quarter results that fell short of expectations and reduced its full-year guidance. During the accompanying earnings call, the CEO allegedly acknowledged that portions of the supplier base had not ramped production as anticipated and that a small number of constrained suppliers had an outsized impact on revenue generation. Following the announcement, the company’s share price declined more than 23%.
The securities suit further alleges that Honeywell failed to disclose that it was under investigation for potential False Claims Act violations arising from alleged cybersecurity compliance deficiencies under its DOD contract. According to the complaint, a second corrective disclosure occurred on September 1, 2026, when the DOJ announced that Honeywell had agreed to pay approximately $2.04 million to resolve FCA allegations relating to cybersecurity requirements applicable to the contract. The plaintiff alleges that the disclosure caused an additional decline in the company’s share price.
The plaintiff alleges that these undisclosed operational and regulatory issues rendered the company’s statements concerning its business, outlook, cybersecurity controls, and compliance obligations materially misleading in violation of federal securities laws.
Discussion
Since launching its Civil Cyber-Fraud Initiative in 2021, the DOJ has increasingly used the FCA to pursue government contractors whose cybersecurity practices allegedly fall short of contractual requirements. With respect to Honeywell Aerospace, the government’s allegations involved compliance with NIST SP 800-171 cybersecurity standards incorporated into a DOD contract, rather than a data breach or cyberattack.
For D&O underwriters, Honeywell’s settlement demonstrates how FCA exposure can arise from alleged cybersecurity compliance deficiencies, not just a breach, and lead to allegations of securities fraud. D&O Diary readers may recall that cyber-related events have frequently generated follow-on securities and derivative litigation. Perhaps the best-known example involved SolarWinds, the software company whose network-management platform was compromised in a far-reaching supply-chain cyberattack, where the incident spawned securities litigation, regulatory investigations, and Delaware claims alleging deficient board oversight of cybersecurity risks.
The emergence of artificial intelligence may further complicate the D&O liability-cyber risk landscape. Recent incidents involving AI platforms, including a security breach affecting Hugging Face, highlight how AI systems face risks ranging from unauthorized access and model theft to prompt-injection attacks and compromised training data. For D&O underwriters, these developments raise familiar questions about whether companies accurately describe their AI controls, cybersecurity safeguards, and risk-management practices, and whether an AI-related security event could give rise to securities, derivative, or regulatory claims.
It is important to recognize that the Honeywell action differs from many earlier cyber-related securities suits because it does not arise out of a major breach or cyberattack. Instead, it stems from alleged contractual noncompliance with cybersecurity requirements and the resulting FCA investigation. Thus, the complaint also illustrates a recurring issue in securities litigation involving government investigations. Plaintiffs often argue that risk disclosures warning that a company could face regulatory scrutiny are misleading when the company is already the subject of an undisclosed investigation.
More broadly, the Honeywell lawsuit may reflect a developing pattern in which FCA investigations and settlements lead to follow-on shareholder litigation. As this site previously noted in connection with the securities lawsuit against SelectQuote, FCA allegations can become securities claims when plaintiffs contend that a company failed to disclose the conduct, risks, or investigations that ultimately gave rise to government scrutiny. While Honeywell involves alleged cybersecurity compliance deficiencies, the same dynamic can arise across a range of FCA enforcement areas.
That possibility may become increasingly significant as the current administration continues to deploy the FCA as a key enforcement tool. The government has invoked the FCA in areas ranging from tariffs and cybersecurity to DEI-related compliance certifications, with recent DOJ settlements involving IBM and Deloitte illustrating the breadth of the statute’s application. As FCA enforcement expands into new areas, companies may face not only regulatory exposure but also the risk of follow-on securities litigation alleging inadequate disclosure of the practices, risks, or investigations that led to government action. FCA-related securities suits could become an increasingly familiar feature of the D&O landscape in the months ahead.
Honeywell Aerospace’s registration materials included extensive discussions of cybersecurity risks, government contracting requirements, and potential FCA exposure. The plaintiffs contend that those disclosures were misleading because the company allegedly already faced scrutiny relating to cybersecurity compliance. Whether plaintiffs can establish that defendants had a disclosure duty regarding the underlying investigation may become a central issue as the litigation progresses.
For D&O underwriters, the lawsuit illustrates how cybersecurity-related exposures can originate in areas far removed from a traditional cyber breach. What began as alleged noncompliance with cybersecurity requirements in a government contract ultimately led to an FCA settlement and follow-on securities litigation. A key underwriting takeaway may be that cyber-related exposures can stem not only from a company’s cybersecurity controls, but also from its government contracting activities, regulatory compliance framework, and history of investigations, audits, or whistleblower allegations.
Finally, the Honeywell lawsuit reinforces the importance of evaluating how companies describe cybersecurity, compliance, and risk-management practices in their public disclosures. Whether the plaintiff in Honeywell ultimately prevails remains to be seen, but as regulators continue to focus on cybersecurity representations and contractual compliance obligations, the distinction between cyber risk, regulatory risk, and disclosure risk is likely to become increasingly blurred.