If there was any room for doubts earlier this year about the Department of Justice’s ability to use the False Claims Act (FCA) to levy charges against companies who aren’t complying with federal cybersecurity requirements, that question mark seems to be gone.

Recent significant settlements filed under the Civil War-era law show that not only has the FCA been used successfully by the federal agency to enforce cybersecurity compliance—or rather punish non-compliance—but also that more cases are likely coming.