HackingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICCREDENTIALSMediumContained
JOHNSON CONTROLS, INC.
bd_3286138d47247688 · schema v1 · pii pii-v1
Full breach record for JOHNSON CONTROLS, INC. →Johnson Controls filed a supplemental breach notification with the New Hampshire Attorney General on July 7, 2025, regarding an incident discovered on September 24, 2023. An unauthorized actor accessed systems between February 1, 2023, and September 30, 2023, exfiltrating personal information primarily of employees and contractors. The notification covers 1,611 New Hampshire residents. Remediation included password resets, MFA expansion, and enhanced monitoring.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_06db4aad93918284Texas State AGfiled 2025-07-01(6d gap)Verified
- bd_f42e2ab3511b7972Oregon State AGfiled 2025-07-01(6d gap)Verified
- bd_6d51e51d4fab12b0Washington State AGfiled 2025-06-30(7d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/johnson-controls-20250707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 7, 2025
- Raw hash
- ff770e4b0d33ae13819982bbcc1a706bf65db8ad0dd7203263a96f2094f21bf8
Reporting entity
- Name
- JOHNSON CONTROLS, INC.norm: johnson controls
Victim entity
- Name
- JOHNSON CONTROLS, INC.norm: johnson controls
Incident
- Discovered
- Sep 24, 2023
- Materiality determined
- —
- Notification sent
- Jun 30, 2025
- Affected individuals
- 1,611
- Data types
- PIIIDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified law enforcementpublicly disclosed the incident in filings to the U.S. Securities and Exchange Commission
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 22 months(652 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.