Johnson Controls Lawsuit: Commissions, PFAS, and Data Breach

Johnson Controls International and its subsidiaries are defending, or have recently resolved, several major lawsuits: a $17.5 million class action settlement with roughly 1,800 salespeople over canceled commissions, hundreds of millions in payouts by subsidiary Tyco Fire Products to settle PFAS drinking-water contamination claims, a wave of proposed data-breach class actions tied to a 2023 ransomware attack, and a $900,000 Missouri retaliation judgment that the state supreme court refused to disturb. Each Johnson Controls lawsuit below is grouped by the underlying dispute, with the current status and dollar figures where the record shows them.

The Sales Commissions Class Action

For decades, Johnson Controls paid its sales representatives a fraction of their commission when a contract was booked and the rest over the life of the project as milestones were reached. That deferred portion, called the “backlog,” typically represented 75 to 80 percent of a salesperson’s total commission on a deal.¹

In November 2023, the company rolled out a new incentive plan retroactive to October 1, 2023. It scrapped the backlog model, tied pay to a percentage of annual quota, and told employees it would not pay out existing backlog balances on pre-October projects that had not yet reached warranty.¹ Anonymous employees told reporters the change was expected to cut their income by 25 to 35 percent.² As a partial concession, the company offered a one-time bridge payment equal to 22 percent of accrued backlog, later adding two 14 percent payments contingent on staying through June 2025 and June 2026.

On January 12, 2024, account executives and field sales employees filed a class action in the U.S. District Court for the Eastern District of Wisconsin, Novin et al. v. Johnson Controls Inc., amended on February 8 to add 16 more plaintiffs. The complaint alleged the company breached its contracts by wiping out already-earned commissions and erased internal dashboards salespeople had used to track backlog balances, making it harder to quantify what they were owed.¹

Terms of the $17.5 Million Settlement

Chief Judge Pamela Pepper granted preliminary approval of a $17.5 million settlement on October 7, 2025, covering 1,784 class members. The fund allocates about $12 million to direct payments, $5.25 million to attorneys’ fees and costs, $147,000 in service payments to 21 named class representatives, and $50,000 for contingencies.³ Each participating salesperson was guaranteed a minimum payment of $300, and the total represents roughly 55 percent of estimated damages after crediting bridge payments the company had already made.⁴

A fairness hearing was held on December 4, 2025, and the case terminated on January 8, 2026.⁵

Individual Commissions Suits Outside the Class

By early 2024, at least 28 representatives had filed their own suits around the country. In New York, a salesperson named Pagano sought more than $229,000; another named Halfter sought more than $140,000.¹ In Michigan, Michael Konczak alleged he was owed $150,000 in final commissions plus more than $380,000 on incomplete projects.² In Pennsylvania, four account executives sued in Greenberg v. Johnson Controls, claiming unpaid balances from roughly $138,000 to $206,000 each based on the company’s own spreadsheets.⁶

The results diverged. Judge Shalina Kumar in the Eastern District of Michigan granted Johnson Controls’ motion to dismiss the Konczak case in March 2025, and Konczak appealed to the Sixth Circuit, where an order or opinion was recorded in December 2025.⁷ Pagano’s New York case was transferred to the Eastern District of Wisconsin in March 2025.⁸

Tyco Firefighting Foam and PFAS Contamination

Johnson Controls’ subsidiary Tyco Fire Products LP, along with its predecessor the Ansul Company, manufactured aqueous film-forming foam (AFFF) containing PFAS compounds for decades. The foam was used at airports, military bases, and fire training facilities. PFAS, sometimes called “forever chemicals,” do not break down easily in the environment.

The $750 Million Water Systems Settlement

In a multi-district litigation before Judge Richard Gergel in the U.S. District Court for the District of South Carolina, Tyco agreed to pay $750 million to settle claims by a nationwide class of public water systems that had detected PFAS in their drinking water.⁹ The court granted preliminary approval on June 13, 2024.¹⁰ Tyco paid an initial $250 million in June 2024, with the remainder due in fiscal 2025.¹¹

The settlement is not an admission of liability, and Tyco denies the allegations. It does not cover personal-injury claims, property-damage claims unrelated to drinking water, or claims from water systems that first detected PFAS after May 2024.¹¹

The Marinette, Wisconsin Cleanup and State Settlement

The most localized problem traces to Tyco’s 380-acre Fire Technology Center in Marinette, Wisconsin, where the company and its predecessors used PFAS-containing foam from the 1960s until 2017. Groundwater sampling found PFOA concentrations as high as 254,000 parts per trillion, and 236 of 776 tested residential wells in the surrounding area exceeded state health advisory levels.¹²

The Wisconsin Department of Justice sued Tyco and Johnson Controls in March 2022, alleging the company discovered the contamination in 2013 but did not report it to state regulators until 2017, in violation of the state’s spills law.¹² In June 2026, the parties settled. Tyco will pay $10 million into Wisconsin’s PFAS trust fund, on top of roughly $100 million the company has already spent on cleanup in the area.¹³ The agreement also requires Tyco to provide deep drinking water wells to nearby affected residents and maintain them for 20 years, submit cleanup goals for soil and groundwater to the state Department of Natural Resources, and continue operating its groundwater extraction and treatment system, which has processed more than 450 million gallons of water since 2022. Tyco has said $180 million remains available for long-term remediation in the Marinette and Peshtigo area.

An earlier class action by Peshtigo-area residents settled for $17.5 million in 2021.¹² A broader 2022 state lawsuit brought by Governor Tony Evers and Attorney General Josh Kaul against manufacturers of PFAS-containing products remains pending.¹³

The 2023 Ransomware Attack and Data Breach Class Actions

On September 23, 2023, Johnson Controls discovered that attackers had breached its internal IT systems. The intrusion has been attributed to a ransomware group known as Dark Angels, which first gained access through the company’s Asian offices as early as February 1, 2023, and stayed in the network for roughly eight months before being detected.¹⁴ The attackers encrypted servers, including VMware ESXi virtual machines, claimed to have stolen more than 27 terabytes of corporate data, and demanded a $51 million ransom.¹⁵

Johnson Controls did not pay the ransom.¹⁶ By January 2024, the company reported spending $27 million on response and remediation, net of insurance recoveries.¹⁷

In late June 2025, the company began sending notification letters to approximately 53,209 current and former employees and clients whose personal information had been exposed. That delay triggered litigation. At least four proposed class actions were filed in the Eastern District of Wisconsin in early July 2025, including Alkhatib v. Johnson Controls Inc., a former employee’s suit alleging negligence, breach of implied contract, and unjust enrichment. The complaints say the company failed to encrypt sensitive data and waited too long to notify affected people. Johnson Controls has countered that the breach was publicly disclosed in 2023 and that it offered identity and credit monitoring to those affected.¹⁸

Steele Retaliation Judgment in Missouri

Former worker David Steele sued Johnson Controls in Missouri, alleging the company retaliated against him after he filed a workers’ compensation claim for a back compression fracture, a pelvic fracture, and a wrist injury sustained on the job. He said the company disciplined him for absences, accused him of exaggerating his injuries, forced him to work beyond his medical restrictions, and threatened suspension.¹⁹

Johnson Controls was served on December 2, 2021, but never filed a response. The circuit court held a damages hearing and entered a default judgment of $300,000 in compensatory damages and $600,000 in punitive damages.¹⁹ When the company later moved to set the judgment aside, blaming an internal mix-up between its legal departments, the court found its own employees’ affidavits contradicted each other. The Missouri Court of Appeals affirmed the default in June 2023,²⁰ and the Supreme Court of Missouri upheld the result on April 30, 2024, ruling the company had not shown good cause for its failure to appear or a meritorious defense.

Other Matters Worth Knowing

In 2016, Johnson Controls paid more than $14 million to settle SEC charges under the Foreign Corrupt Practices Act. The SEC found that a Chinese subsidiary funneled roughly $4.9 million in improper payments through sham vendors to employees of government-owned shipyards between 2007 and 2013. The company self-reported the misconduct, cooperated, and settled without admitting or denying the findings.²¹

A prevailing-wage class action, Brian Martin v. Johnson Controls Fire Protection LP, was litigated in the Western District of Washington on behalf of fire alarm and sprinkler inspection workers in Washington state. It settled for $1.59 million, with each class member receiving a minimum of $250, and a final approval hearing was scheduled for July 2022.²²

In July 2025, Johnson Controls turned plaintiff, suing former employees Heather Clark and Michelle St. Hilaire and their company Encore Holdings LLC in federal court in Vermont for misappropriation of trade secrets under the Defend Trade Secrets Act. The company sought a temporary restraining order at the outset. The parties filed a stipulated dismissal in January 2026.²³

1
Facilities Dive. Johnson Controls Lawsuits Unpaid Commission Backlog
2
BizTimes Milwaukee. Second Lawsuit Filed Against Johnson Controls Following Rollout of New Incentive Plan
3
Justia. Novin et al v. Johnson Controls Inc, Preliminary Settlement Approval Order
4
Bloomberg Law. Johnson Controls Workers Land $17.5 Million Deal on Commissions
5
CourtListener. Novin v. Johnson Controls Inc. Docket
6
CaseMine. Greenberg v. Johnson Controls, Inc.
7
CourtListener. Konczak v. Johnson Controls Inc. Docket
8
PACER Monitor. Pagano v. Johnson Controls, Inc.
9
PFAS Water Settlement. Public Water System Settlement Program – Tyco
10
MWRA Advisory Board. Tyco BASF PFAS Settlements Enter Preliminary Approval
11
SEC. Johnson Controls International 10-K, Note on Commitments and Contingencies
12
Wisconsin Public Radio. Wisconsin Settlement Tyco Johnson Controls PFAS Contamination
13
Wisconsin DOJ. Press Release – Tyco PFAS Settlement
14
BleepingComputer. Johnson Controls Starts Notifying People Affected by 2023 Breach
15
SecurityWeek. Johnson Controls Ransomware Attack, Data Theft Confirmed; Cost Exceeds $27 Million
16
WatchGuard. Dark Angels Ransomware Tracker
17
Dark Reading. Johnson Controls Ransomware Cleanup Costs $27M
18
Bloomberg Law. Johnson Controls Hit With Proposed Class Action Over Data Breach
19
FindLaw. Steele v. Johnson Controls, Inc., SC 100193
20
Bloomberg Law. Johnson Controls Stuck With $900,000 Default Loss in Job Suit
21
SEC. SEC Administrative Proceeding, File No. 3-17337
22
SGB Law. Brian Martin v. Johnson Controls Fire Protection, LP Class Notice
23
CourtListener. Johnson Controls Inc. v. Clark et al. Docket