JOHNSON CONTROLS, INC.

Johnson Controls notified South Carolina and other jurisdictions of a cyber incident discovered September 24, 2023, involving unauthorized access to its network between February 1, 2023, and September 30, 2023. The actor accessed and exfiltrated personal information, including names and credentials. Johnson Controls engaged third-party experts, terminated access, notified law enforcement, and offered two years of complimentary credit monitoring via Equifax.

Johnson Controls International plc reported a cybersecurity incident disrupting internal IT infrastructure on September 27, 2023. The company engaged external cybersecurity experts and insurers, executing an incident management plan. The investigation is ongoing to determine the scope of impacted information and potential data compromise.

Johnson Controls International PLC disclosed a cybersecurity incident detected on September 23, 2023, involving unauthorized access and ransomware deployment. The Company engaged cybersecurity experts, restored impacted systems, and contained the activity. The incident caused disruptions to financial reporting systems, delaying the fiscal 2023 10-K filing. Investigation into data exfiltration and impact is ongoing.