The Justice Department has announced a $5 million settlement with Johnson Controls Inc. and subsidiaries Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements tied to federal contracts and subcontracts.

While the dollar amount is modest by major FCA standards, the settlement is significant because it reinforces a clear enforcement trend: the government is willing to use False Claims Act theories to police cybersecurity representations, contractual compliance, and performance in the federal procurement space.

At its core, the matter reflects a straightforward but increasingly consequential theory of liability.

The Federal Trade Commission has rescinded a Biden-era policy statement that had expanded expectations around breach notifications for certain health apps and connected-device providers. The move is part of a broader agency push toward regulatory streamlining, but it also sends a clear signal to the digital-health market: the FTC may be narrowing how aggressively it interprets and enforces health-data breach obligations outside traditional healthcare settings.

At issue is the FTC’s approach to the Health Breach Notification Rule, which applies to certain vendors of personal health records and related entities not covered by HIPAA.

The Federal Trade Commission has given final approval to its order against Illuminate Education, closing out a closely watched enforcement action arising from a data breach that exposed information tied to roughly 10.1 million students. For education companies and the schools that rely on them, the case is a sharp reminder that student-data security is now firmly in regulators’ crosshairs.

According to the FTC, Illuminate failed to reasonably secure sensitive student information, resulting in a breach with sweeping impact.