HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICCREDENTIALSLowContained
JOHNSON CONTROLS, INC.
bd_5284e02cf7bdc3ab · schema v1 · pii pii-v1
Full breach record for JOHNSON CONTROLS, INC. →Johnson Controls disclosed a cyber incident where an unauthorized actor accessed its network from February 1, 2023, to September 30, 2023. The company became aware of the incident on September 24, 2023. The actor exfiltrated personal information, including names and potentially credentials. Johnson Controls engaged third-party experts, terminated access, notified law enforcement, and is offering two years of credit monitoring to affected individuals.
California clockDiscovered Sep 24, 2023 → Notified Jun 30, 2025645d ✗ CA 60-day late22 months discovery → filing
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_26c3ced2ff25f41eIowa State AGfiled 2025-06-30Verified
- bd_5dff2cf2bc9347e1Delaware State AGfiled 2025-06-30Verified
- bd_b3d1bc45d4933741Montana State AGfiled 2025-06-30Candidate
- bd_ef10c9b1f9661892Indiana State AGfiled 2025-06-30Verified
Show 1 more filing ↓Show fewer ↑
- bd_fa9193fcd908cd4fVermont State AGfiled 2025-06-30Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-604737
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 30, 2025
- Raw hash
- d08347697f85c74d4c30e711e59e2a6f2d18412869629974db4521de1b8a3d97
Reporting entity
- Name
- JOHNSON CONTROLS, INC.norm: johnson controls
Victim entity
- Name
- JOHNSON CONTROLS, INC.norm: johnson controls
Incident
- Discovered
- Sep 24, 2023
- Materiality determined
- —
- Notification sent
- Jun 30, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified law enforcement
Compliance
- Time to disclose
- 22 months(645 days from discovery to filing)
- Compliance flags
- CA 60-day late · 645d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 24, 2023→ Notified: Jun 30, 2025645d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.