HackingStolen CredentialsCapture Stored DataData ExfiltratedDelayed DiscoveryPIIIDENTITY_BASICCREDENTIALSLowContained
JOHNSON CONTROLS, INC.
bd_5dff2cf2bc9347e1 · schema v1 · pii pii-v1
Full breach record for JOHNSON CONTROLS, INC. →Johnson Controls notified Delaware AG of a cyber incident discovered Sept 24, 2023. Unauthorized access occurred Feb 1–Sept 30, 2023, resulting in data exfiltration. Affected data includes names and other personal information. The company engaged forensic experts, terminated access, notified law enforcement, and offers two years of credit monitoring via Equifax.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_26c3ced2ff25f41eIowa State AGfiled 2025-06-30Verified
- bd_5284e02cf7bdc3abCalifornia State AGfiled 2025-06-30Verified
- bd_b3d1bc45d4933741Montana State AGfiled 2025-06-30Candidate
- bd_ef10c9b1f9661892Indiana State AGfiled 2025-06-30Verified
Show 1 more filing ↓Show fewer ↑
- bd_fa9193fcd908cd4fVermont State AGfiled 2025-06-30Verified
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2025/07/Johnson-Controls-U.S.-Reg.-Notice-Letter-Delaware-final.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 30, 2025
- Raw hash
- 97072160caece9a980eabd7b344a99eb0fe6b1a0fba56b2edb013263533d0192
Reporting entity
- Name
- JOHNSON CONTROLS, INC.norm: johnson controls
Victim entity
- Name
- JOHNSON CONTROLS, INC.norm: johnson controls
Incident
- Discovered
- Sep 24, 2023
- Materiality determined
- Sep 27, 2023
- Notification sent
- Jun 30, 2025
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- notified law enforcement
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 22 months(645 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.