Johnson Controls
Disclosed Sep 27, 20232 years ago16,729 affectedConfirmed
Ransomware attack on Johnson Controls disrupts IT and exposes personal data
Building technology firm Johnson Controls disclosed a cybersecurity incident that disrupted parts of its IT infrastructure in September 2023. Its later breach notices said an unauthorized actor had access to its systems from February 1 to September 30, 2023 and took information including personal data.
What is known
| People affected | 16,729 (as reported by the organization) |
|---|---|
| Disclosed | Sep 27, 2023 |
| Discovered | Sep 24, 2023 |
| Happened | Feb 1, 2023 |
| Attack | Ransomware |
| Data exposed | Names, Other |
| Sector | Manufacturing · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Johnson Controlsoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Johnson Controlsatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Johnson Controlsjustice.oregon.gov · Official notice | Official notice |
| California AG data breach notice: Johnson Controlsoag.ca.gov · Regulator | Regulator |
| Johnson Controls International plc Form 8-K, September 27, 2023sec.gov · SEC filing | SEC filing |
| Indiana Attorney General 2025 data breach report: Johnson Controlsin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Sep 27, 2023 | |
| California AGresidents of CA | Jun 30, 2025 | |
| Washington AGresidents of WA | Jun 30, 2025 | 4,903 |
| Indiana AGresidents of IN | Jun 30, 2025 | 16,729 |
| Oregon DOJresidents of OR | Jul 1, 2025 | 3,829 |
Other breaches at Johnson Controls
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jun 30, 2025Jun 30, 20251 year ago | Jun 30, 20251 year ago | Not stated | Manufacturing | Confirmed | Unknown |
History of this record
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 16729 · backfill source
- 2026-09-25 · sector: other to manufacturing · seed source
- 2026-09-25 · attack: hacking to ransomware · seed source
- 2026-09-25 · data_types: [] to ["names","other"] · seed source
- 2026-09-25 · disclosed: 2025-06-30 to 2023-09-27 · seed source
- 2026-09-25 · summary: empty to Building technology firm Johnson Controls disclosed a cybersecurity incident that disrupted parts of its IT infrastructure in September 2023. Its later breach notices said an unauthorized actor had access to its systems from February 1 to S · seed source
- 2026-09-25 · title: empty to Ransomware attack on Johnson Controls disrupts IT and exposes personal data · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2023-09-24 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.