JOHNSON CONTROLS INTERNATIONAL PUBLIC LIMITED COMPANY

Johnson Controls filed a supplemental breach notification with the New Hampshire Attorney General on July 7, 2025, regarding an incident discovered on September 24, 2023. An unauthorized actor accessed systems between February 1, 2023, and September 30, 2023, exfiltrating personal information primarily of employees and contractors. The notification covers 1,611 New Hampshire residents. Remediation included password resets, MFA expansion, and enhanced monitoring.

Johnson Controls based in Milwaukee, Wisconsin, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2023-09-24 and reported on 2025-07-01. 38,037 Texas residents were affected. Types of information involved: Other. Consumers were notified via Posted at company website or special website;U.S. Mail.

JOHNSON CONTROLS filed a data-breach notice with the Illinois Attorney General in July 2025 (case 25-07-287). The register records the breach as discovered on September 24, 2023. Personal information types reported: drivers license, financial account number, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Johnson Controls reported a data breach to the Oregon Attorney General. The breach was reported on 2025-07-01. The breach occurred during 2/1/2023 - 9/30/2023. The breach was discovered on 9/24/2023. 3,829 individuals were affected. Notice was sent on 10/17/20236/30/2025.

Johnson Controls filed a supplemental security breach notification with the Iowa Attorney General on June 30, 2025, regarding 2,259 Iowa residents. The incident occurred between February 1, 2023, and September 30, 2023, when an unauthorized actor accessed systems and exfiltrated employee/contractor personal information. Johnson Controls discovered the breach on September 24, 2023, and has since enhanced security controls, reset passwords, and offered credit monitoring.

Johnson Controls disclosed a cyber incident where an unauthorized actor accessed its network from February 1, 2023, to September 30, 2023. The company became aware of the incident on September 24, 2023. The actor exfiltrated personal information, including names and potentially credentials. Johnson Controls engaged third-party experts, terminated access, notified law enforcement, and is offering two years of credit monitoring to affected individuals.

Johnson Controls notified Delaware AG of a cyber incident discovered Sept 24, 2023. Unauthorized access occurred Feb 1–Sept 30, 2023, resulting in data exfiltration. Affected data includes names and other personal information. The company engaged forensic experts, terminated access, notified law enforcement, and offers two years of credit monitoring via Equifax.

Johnson Controls filed a supplemental breach notification with the Washington AG on June 30, 2025, covering 4,903 residents. Unauthorized access occurred Feb 1–Sep 30, 2023. Johnson Controls discovered the incident on Sep 24, 2023. Data involved employee/contractor PII, including names and potentially credentials. Remediation included password resets, MFA expansion, and enhanced monitoring. 2-year credit monitoring offered.

Johnson Controls notified Montana and other states of a cyber incident discovered September 24, 2023. Unauthorized actors accessed systems between Feb 1 and Sep 30, 2023, exfiltrating names and personal info. JCI engaged forensic experts, terminated access, notified law enforcement, and offered 2 years of credit monitoring via Equifax.

Johnson Controls reported a data breach to the Indiana Attorney General. The breach occurred on 2023-02-01 and was reported on 2025-06-30. 16,729 Indiana residents were affected.