New York is set to recoup $1.3 million in a national settlement with Cisco Systems Inc. of a lawsuit filed in the Western District of New York alleging that the company had sold the states, and the federal government, software that was vulnerable to digital attacks.

New York Attorney General Letitia James announced Thursday that her office had led a coalition of 19 state attorneys general in settling a multistate lawsuit that generated an agreement to pay $6 million to state governments across the country.

Attorneys for the whistleblower, James Glenn, said it’s the first cybersecurity whistleblower case ever successfully litigated under the False Claims Act.

The $6 million settlement was part of a larger $8.6 million settlement announced by attorneys for the whistleblower Wednesday. The remainder will go to the federal government, though Glenn will receive a share of the total settlement, which the FCA prescribes.

The federal law allows a whistleblower to file a qui tam lawsuit, which is essentially litigation that reports fraud and misconduct to the government. Glenn filed his suit in the U.S. District Court for the Western District of New York in Buffalo in 2011.

He’s represented by attorneys from Constantine Cannon and Phillips & Cohen, both of which have offices in New York, Washington, D.C., and San Francisco.

He alleged in the complaint, which wasn’t unsealed until this week, that Cisco knew about flaws in security surveillance system software the company had sold to New York, several other states, and the federal government.

An investigation from several states and the federal government ensued. The New York Attorney General’s Office led the coalition of states involved in the settlement reached this week. James said the litigation showed a “failure” by Cisco.

“Security camera software must be secure — it’s that simple,” James said. “Cisco’s failure to keep their software safe could have endangered the safety of New Yorkers across our state.”

Cisco allegedly knew about the software’s security flaws in 2009, but failed to report them until 2013, after an investigation was launched in response to Glenn’s claims. The vulnerabilities would have allowed attackers to manipulate security cameras and any footage that was recorded, according to the complaint.

The software has since been discontinued, and the investigation conducted by New York and the other states found no evidence that a hack, or any other unauthorized access, ever took place.

The New York Attorney General’s Office conducted the investigation with attorneys general from California, Delaware, Florida, Hawaii, Illinois, Indiana, Massachusetts, Minnesota, Montana, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Rhode Island, Tennessee, Virginia, and the District of Columbia.

READ MORE: