Johnson Controls Cybersecurity Lawsuit and Class Action

The Johnson Controls class action lawsuit is a consolidated federal case in the U.S. District Court for the Eastern District of Wisconsin brought on behalf of roughly 53,209 people whose personal information was exposed in a 2023 ransomware attack on the building technology company. Thirteen separate suits filed in the summer and fall of 2025 were combined on November 3, 2025, into a single proceeding led by Hoon v. Johnson Controls, Inc. (Case No. 25-cv-0955).¹

Who Is Covered

The proposed class consists of individuals who received data breach notification letters from Johnson Controls beginning June 30, 2025. Most were current or former employees or contractors of the company, and the stolen data was information Johnson Controls held through those relationships. Everyone in the group had at least their name exposed. For a subset of people, the company acknowledged that “more sensitive personal data was involved,” though the notification letters used placeholder language rather than itemizing every category for every recipient.²

Approximately 53,209 people were identified as affected across the country. Johnson Controls reported 1,611 New Hampshire residents to that state’s attorney general as part of its breach notification filings.² If you received a letter from Johnson Controls in the summer of 2025 about the 2023 cybersecurity incident, you fall within the group the consolidated complaint seeks to represent. No claims process has opened, because the case is still at the pleading stage.

What the Lawsuits Allege

The complaints accuse Johnson Controls of failing to protect personal information it required employees and contractors to hand over. Alkhatib v. Johnson Controls Inc. (Case No. 2:25-cv-00968), filed July 7, 2025, by former employee Mohammad Alkhatib, brought claims for negligence, breach of implied contract, breach of confidence, breach of fiduciary duty, and unjust enrichment. The complaint alleged that the company failed to use reasonable security procedures, failed to encrypt data, and failed to delete personally identifiable information when it was no longer needed.³ A parallel complaint, Scott-LaRosa v. Johnson Controls Inc. (Case No. 2:25-cv-00969), was filed the same day.⁴

Across the various suits, plaintiffs asked for damages tied to invasion of privacy, lost time and opportunity costs, diminished value of their personal information, and increased risk of identity theft. They also sought injunctive relief requiring Johnson Controls to overhaul its cybersecurity practices.³

The 22-Month Notification Delay

A central grievance in every complaint is timing. Johnson Controls discovered the attack over the weekend of September 23, 2023, and disclosed it in a Form 8-K filed with the Securities and Exchange Commission on September 27, 2023.⁵ Individual notification letters did not go out until June 30, 2025, nearly 22 months later. The company said the delay reflected the time required for a thorough assessment of the compromised data.⁶ Plaintiffs argue the gap violated state data breach notification laws that require disclosure “without unreasonable delay,” leaving affected people unable to take protective steps for nearly two years while their information was potentially circulating.

A Johnson Controls spokesperson noted that the incident itself had been disclosed publicly through SEC filings in September, November, and December 2023.³

What the Breach Involved

The attack was carried out by the Dark Angels ransomware group, which used a custom encryptor against Johnson Controls’ VMware ESXi servers.⁷ Investigators later determined the attackers had been inside the network far longer than initially recognized: unauthorized access began on February 1, 2023, and continued through September 30, 2023, giving them roughly eight months to move through company systems before detection.⁶

Dark Angels demanded $51 million and claimed to have exfiltrated more than 27 terabytes of corporate data, threatening to publish it on a leak site called Dunghill Leak.⁸ Johnson Controls refused to pay the ransom, and the group eventually published a sample of the stolen material.⁹ The company reported a $27 million hit to net income in its first quarter fiscal 2024 results, broken out as $23 million in response and remediation costs and $4 million in lost and deferred revenues, and said it expected a substantial portion of direct costs to be reimbursed through cyber insurance.¹⁰

Consolidation and Current Status

By early July 2025, at least four suits had been filed in the Eastern District of Wisconsin, where Johnson Controls is headquartered. The count reached thirteen by the fall.³ On November 3, 2025, Judge Brett H. Ludwig granted a motion to consolidate. The court designated Hoon v. Johnson Controls, Inc. as the lead case and administratively closed the others.¹

The thirteen consolidated cases are:

Hoon v. Johnson Controls (25-cv-0955)
Zaplotinsky-Cameron v. Johnson Controls (25-cv-00958)
Alkhatib v. Johnson Controls (25-cv-00968)
Scott-LaRosa v. Johnson Controls (25-cv-00969)
Bunn v. Johnson Controls (25-cv-01028)
Hefley v. Johnson Controls (25-cv-01036)
Gorman v. Johnson Controls (25-cv-01049)
M. v. Johnson Controls (25-cv-01057)
Brown v. Johnson Controls (25-cv-01061)
Bauer v. Johnson Controls (25-cv-01071)
Flower v. Johnson Controls (25-cv-01075)
Burnell et al. v. Johnson Controls (25-cv-01085)
Kaprelian et al. v. Johnson Controls (25-cv-01091)

Judge Ludwig appointed a leadership group of interim class counsel and an executive committee to manage the litigation. The order gave plaintiffs 30 days to file a consolidated class action complaint, with Johnson Controls’ response due 30 days after that.¹ Johnson Controls is represented by Ogletree Deakins.¹¹ As of early 2026, no settlement or ruling on the merits has been reported, and no state attorney general or federal regulator has announced a formal enforcement action.

What Affected Individuals Can Do Now

Johnson Controls offered notification recipients a complimentary two-year subscription to Equifax Credit Watch Gold, which includes credit monitoring, daily access to Equifax credit reports, identity restoration services, and up to $1 million in identity theft insurance. The activation deadline was October 31, 2025.³

Because the consolidated case is still at the pleading stage, there is no claim form to fill out and no settlement fund to register for. People who received notification letters are, by default, part of the proposed class the lead plaintiffs are asking the court to certify. If certification is granted and a settlement or judgment follows, notice will go out to class members with instructions on submitting claims or opting out. Keep your notification letter, along with any records of time spent or expenses incurred responding to the breach, since those categories of harm appear in the complaints.

1
Justia. Hoon v. Johnson Controls Inc., Consolidation Order
2
New Hampshire Department of Justice. Johnson Controls Data Breach Notification
3
Bloomberg Law. Johnson Controls Hit With Proposed Class Action Over Data Breach
4
CourtListener. Scott-LaRosa v. Johnson Controls Inc.
5
SEC. Johnson Controls International plc Form 8-K, September 27, 2023
6
SC World. Johnson Controls Notifies Victims of Breach in 2023 Ransomware Attack
7
Dark Reading. Johnson Controls Ransomware Cleanup Costs Top $27M and Counting
8
Industrial Cyber. Johnson Controls Struck by Dark Angels Ransomware Hackers, Experiences Disruption
9
Twingate. JCI Data Breach
10
Cybersecurity Dive. Johnson Controls Ransomware Costs
11
Law360. Scott-LaRosa v. Johnson Controls Inc.