BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 048
Global

Johnson Controls Ransomware Incident (2023)

Volume 2Manufacturing edition2023Last verified 12 sources, 9 primaryClaimed, per reporting

In September 2023 ransomware hit the internal IT of a company whose controls run inside other people’s buildings. It says it saw no evidence its digital products, Metasys included, were affected. Nothing on the record says otherwise.

Johnson Controls makes the equipment that runs other people’s buildings: air handlers, controllers, fire panels, badge readers. That is why it is in the book. The filings describe ransomware deployed by a third party to part of the company’s internal IT, disruption to parts of the business and a delayed annual report. They describe nothing inside a customer’s building. The best known claim, stolen federal floor plans, rests on a DHS memo reported by CNN and confirmed by nobody.

It is an IT compromise with no physical operation halted on the record, and that lower rung is the finding. The question the filings cannot answer is what a vendor’s network can reach inside customers’ buildings. If the vendor’s office is burgled, what matters is whether a standing path or credential leads from that office to the panel. That is BlastWave’s analysis, not a disclosed fact.

What is not known: No Johnson Controls filing names an attacker, an initial access vector or the ransomware family, and none says whether a ransom was paid. The Dark Angels claim and the $51M demand come from reporting on the crew’s own note. What data left the network, and how long any system was down, is undisclosed. Whether any customer building system was touched is not stated either way: the company says only that it has seen no evidence of impact to its products. The DHS concern about facility data is an internal memo CNN reviewed, confirmed by neither DHS nor the company.

Recommendation

  1. Take away the vendor’s path in Building automation and access control have no standing route from any vendor’s corporate network. Remote service comes via an owner-controlled gateway, opened per job.
  2. Remove the standing credential No shared service passwords or always-on vendor accounts. A breach at the vendor should hand an intruder nothing that opens your lobby, air handlers or fire panel.
  3. Read one way; keep a door with no badge Dashboards and cloud monitoring receive building data over a one-way path. Every badge door has a tested manual fallback that does not sit behind that door.
The Locksmith's Shop
Podcast · Joe and Cam · 9:18
Johnson Controls Short
Video · 60 to 90 seconds

Sources: Form 8-K, 27 Sep 2023 (Item 8.01); Form 8-K, 13 Nov 2023 (Item 8.01); Form 12b-25, 29 Nov 2023; FY2023 Form 10-K, 14 Dec 2023; Form 10-Q, 30 Jan 2024; CNN, 28 Sep 2023 (DHS memo); EDGAR full-text search. Full list with links.

Soft Spots: The DHS memo was read only as CNN quotes it; the floor plans claim is unconfirmed. Dark Angels and $51M are press-reported claims. The vendor-reach question is BlastWave’s analysis, not a disclosed fact about this incident.

The full record

Every claim numbered to its source. Last updated .

Ransomware on the internal IT of a company whose controls run inside other people's buildings, and a story that grew past the record. What is verified, what is only reported, and what is still unknown.

Summary

In September 2023 a third party deployed ransomware to part of the internal IT of Johnson Controls, a building technology company, and data was taken. Based on the information reviewed to date, it said it saw no evidence of impact to its digital products, including Metasys. Nothing on the record says a customer building was touched, or that none was.1,7

Timeline of the Johnson Controls incident

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. The incident is initially detected, following outages to certain of the company's systems.1
  2. Johnson Controls files an 8-K under Item 8.01 reporting disruptions in portions of its internal IT infrastructure and applications, workarounds to keep servicing customers, and disruption to parts of its business operations. The same day, BleepingComputer reports a Dark Angels ransom note naming the company, a claim of more than 27 TB of data and a $51 million demand.2,5
  3. CNN reports internal DHS correspondence: officials working to determine if the attack compromised physical security information such as DHS floor plans.10
  4. A second 8-K, also Item 8.01, describes unauthorized access and deployment of ransomware by a third party to a portion of internal IT, says the activity is believed contained, and states it has not observed evidence of impact to its digital products, including OpenBlue and Metasys.1
  5. Form 12b-25: the incident disrupted systems supporting financial reporting, and the company will file its annual report within the fifteen-day extension.4
  6. The FY2023 10-K is filed within the extension. It adds data exfiltration to the description and discloses a material weakness identified in connection with the incident.7,11
  7. Compliance with the SEC's new Form 8-K Item 1.05 for cybersecurity incidents begins. Both earlier Johnson Controls 8-Ks predate it.12
  8. The 10-Q for the quarter ended 31 December 2023 states an approximately $27 million net income impact, net of insurance recoveries.8
  9. The latest filing to carry the unchanged product statement, the ninth since November 2023.3,6

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
What did the intruder reach?"A portion of the Company's internal IT infrastructure"1Verified
Was it ransomware?Yes, deployed by a third party, per the company1Verified
Was data taken?Yes: "data exfiltration" in the FY2023 10-K. What data: undisclosed6,7Verified
Were Metasys or OpenBlue affected?No evidence of impact observed, "based on the information reviewed to date"; repeated in nine filings to August 20251,6Verified (hedged company statement)
Was any customer building touched?Not stated either wayUndisclosed
Who was behind it?Claimed by Dark Angels, per reporting on the ransom note. No filing or government names a group5,6Claimed only
Ransom demand and payment$51 million demand reported, not confirmed. Payment undisclosed5Reported only
Were DHS floor plans taken?A concern in an internal DHS memo reported by CNN; confirmed by neither DHS nor the company10Reported concern, unconfirmed
How did the intruder get in?Not stated in any filingUndisclosed
Financial impactAbout $27 million net income impact, one quarter, net of insurance recoveries; not a cost8,9Verified (one quarter)
When was it disclosed?27 September 2023, days after detection1,2Verified

What happened at Johnson Controls in September 2023?

A third party deployed ransomware to a portion of the company's own internal IT, and data left the network. The incident was initially detected during the weekend of 23 September 2023, following outages to certain systems, and first disclosed on Wednesday 27 September in a Form 8-K describing disruptions in portions of the company's internal IT infrastructure and applications and "disruption to parts of the Company's business operations." Workarounds under business continuity plans kept the company servicing customers.1,2 On 13 November 2023 a second 8-K said the incident:

"consisted of unauthorized access and deployment of ransomware by a third party to a portion of the Company's internal IT infrastructure."
Johnson Controls International plc, Form 8-K, Item 8.01, 13 November 20231

The same filing said the company believed the unauthorized activity had been contained.1 Both 8-Ks were filed under Item 8.01 (Other Events). They are not Item 1.05 cybersecurity incident disclosures: that item was adopted in July 2023, and compliance began on 18 December 2023.12

The incident also reached systems that support financial reporting. On 29 November 2023 the company filed a Form 12b-25 for a fifteen-day extension on its annual report, and filed the FY2023 10-K on 14 December 2023, inside that extension. Under the rule, a report filed within the extension is deemed filed on time.4,7,11 The 10-K was the first filing to describe "data exfiltration," and it disclosed a material weakness in internal control over financial reporting identified in connection with the incident.6,7 What data was taken has not been disclosed.

The filings say "disruption to parts of the Company's business operations," not that factories or manufacturing stopped. A customer quoted secondhand by BleepingComputer said "Manufacturing and everything is down"; that is one unnamed customer's account of what a representative told them, not the company's statement.2,5

Were buildings that run Johnson Controls systems affected?

Nothing on the record says any customer building was touched, and nothing says none was. The company's statement is about its own products and what it observed, and it carries its own hedge:

"Based on the information reviewed to date, the Company has not observed evidence of any impact to its digital products, services and solutions, including OpenBlue and Metasys."
Johnson Controls International plc, Form 8-K, Item 8.01, 13 November 20231

Metasys is the company's building automation platform. The same sentence appears in nine filings, from the 8-K of 13 November 2023 to the 10-Q of 6 August 2025, and is not walked back in any filing we read.3,6 It is neither a finding that a customer was hit nor a certificate that none was. No filing describes customer systems or products being reached.1

On BlastWave's reading of the consequence ladder, this is an IT compromise with no physical operation halted on the record: a building automation vendor's own IT, with business disruption and no customer OT impact on the record. It sits below the entries where production stopped, because no filing says it did here. That placement is BlastWave's analysis.

Did attackers steal DHS floor plans from Johnson Controls?

No one has confirmed it. The claim traces to CNN's report of 28 September 2023 on internal Department of Homeland Security correspondence that CNN reviewed. As CNN reported it, DHS officials were "working to determine if" the attack compromised physical security information "such as DHS floor plans." CNN's own headline asks whether such information was exposed.10 The memo, as CNN quoted it, said:

"We do not currently know the full extent of the impact on DHS systems or facilities."
Internal DHS memo, as quoted by CNN, 28 September 202310

That is a concern, in an internal document, about what might have been taken. Neither DHS nor Johnson Controls has confirmed that any DHS facility information was taken. A full-text search of Johnson Controls filings for "Homeland Security" alongside "cybersecurity incident" returns no results.6 We have not seen the memo itself; this account rests on CNN's quotation of it.

Who was behind the Johnson Controls ransomware attack?

No government and no Johnson Controls filing has named an attacker; a crew called Dark Angels claimed it. On 27 September 2023 BleepingComputer reported a Dark Angels ransom note naming the company, from a sample a researcher had shared. The crew claimed more than 27 terabytes of data and encryption of VMware ESXi virtual machines, and the reported demand was $51 million.5

Those are the crew's claims, read through the press. A full-text search of every Johnson Controls filing on EDGAR for "Dark Angels" returns zero results, and no filing mentions a demand.6 No government attribution was found as of our September 2026 check. Whether any ransom was paid is undisclosed.

How much did the Johnson Controls cyberattack cost?

The widely quoted $27 million is a one-quarter net income impact, stated net of insurance recoveries, not a cost. The 10-Q filed on 30 January 2024 put the impact on net income for the quarter ended 31 December 2023 at approximately $27 million. It blends lost and deferred revenues (net of revenues deferred at the end of fiscal 2023 and recognized in the quarter) with expenses, which were "primarily attributable to expenses associated with the response to, and remediation of, the incident," and it is stated "net of insurance recoveries."8,9

The company reported other figures, on other bases, for other periods. They measure different things and should not be added to the $27 million or to each other. The $27 million is a real number; it is not a cost and not a total for the incident.

What is still not known about Johnson Controls

  • Who carried out the intrusion. No filing and no government names an attacker; Dark Angels' claim is the crew's own.5,6
  • The initial access vector and the root cause.
  • The ransomware family. The company has not named it.
  • Whether a ransom was paid.
  • What data left the network, and whether any individuals were notified.
  • How long any system was down, and how many systems or sites were affected.
  • Whether any customer building system was touched. The company says only that it has seen no evidence of impact to its products.1
  • Whether any DHS facility information was taken. The concern is in an internal memo reported by CNN and confirmed by neither DHS nor the company.10
  • Whether any government advisory addresses the incident. None found as of September 2026.

Claims about Johnson Controls the record does not support

Widely repeated claimWhat the record says
"Johnson Controls' manufacturing shut down."The filings say "disruption to parts of the Company's business operations." "Manufacturing and everything is down" is one unnamed customer's secondhand account in press.2,5

BlastWave analysis: the burglary was at the office

Analysis, not a disclosed fact

Johnson Controls makes the equipment that runs other people's buildings: air handlers, controllers, fire panels, badge readers. What the filings describe is ransomware on the company's own internal IT, business disruption, data exfiltration and a material weakness in financial reporting controls. What they do not describe is anything happening inside a customer's building. That lower rung is the finding, not a disappointment.1,7

The question the incident raises is one the filings cannot answer: what a vendor's corporate network can reach inside its customers' buildings. A building automation system is operational technology that people walk through every morning, and much of it is serviced remotely. If the vendor's office is burgled, the only thing that matters to the building is whether a standing path or a standing credential leads from that office to the panel. That dependency is BlastWave's analysis, not a disclosed fact about this incident; no record says Johnson Controls held standing access to any customer site.

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Locksmith's Shop” (9:18). Joe Baxter and Cam Cullen on why a break-in at the vendor's office matters to a building only if something in that office can open its door.

Video: Johnson Controls Short (60 to 90 seconds).

Frequently asked questions

What happened in the Johnson Controls cyberattack?

Johnson Controls detected the incident during the weekend of 23 September 2023 and disclosed it on 27 September. In a November 2023 filing it said a third party gained unauthorized access and deployed ransomware to a portion of its internal IT infrastructure, and its annual report later added data exfiltration. Parts of its business operations were disrupted and its annual report was filed within a fifteen-day extension.

Were Metasys or customer buildings affected by the Johnson Controls ransomware attack?

Johnson Controls said in November 2023 that, based on the information reviewed to date, it had not observed evidence of any impact to its digital products, services and solutions, including OpenBlue and Metasys. The same sentence appears in nine filings through August 2025. It is a hedged statement about its products, not a finding about every customer site; nothing on the record says a customer building was touched, or that none was.

Did hackers steal DHS floor plans in the Johnson Controls attack?

Not on any confirmed record. CNN reported on 28 September 2023 that internal DHS correspondence it reviewed showed officials working to determine if the attack compromised physical security information such as DHS floor plans. That was a concern about what might have been taken. Neither DHS nor Johnson Controls has confirmed that any DHS facility information was taken.

Who was behind the Johnson Controls ransomware attack?

No government and no Johnson Controls filing has named an attacker. BleepingComputer reported on 27 September 2023 that a ransomware crew called Dark Angels claimed the attack in a ransom note, claimed more than 27 terabytes of data, and demanded $51 million. These are the crew's claims as reported by the press. Whether any ransom was paid is undisclosed.

How much did the Johnson Controls ransomware attack cost?

The widely quoted $27 million is not a cost. Johnson Controls' 10-Q filed on 30 January 2024 reported an approximately $27 million impact on net income for the quarter ended 31 December 2023, blending lost and deferred revenues with expenses, mostly response and remediation, and stated net of insurance recoveries. That is a one-quarter net figure, not a cost, and should not be added to the company's other reported figures.

Was the Johnson Controls disclosure an SEC Item 1.05 filing?

No. Johnson Controls disclosed the incident in two Form 8-K filings on 27 September and 13 November 2023, both under Item 8.01, Other Events. The SEC's Item 1.05 cybersecurity incident requirement was adopted in July 2023, but compliance only began on 18 December 2023, after both filings.

Did the Johnson Controls attack stop its factories?

The company's filings say the incident caused disruption to parts of its business operations, with workarounds to keep servicing customers. They do not say manufacturing stopped. A line that manufacturing was down came from one unnamed customer, quoted secondhand by BleepingComputer on 27 September 2023, describing what a company representative had told them.

TargetA building-services vendor a decade earlier, where the vendor's access was the way in to someone else's network: the reverse direction of this record.CloroxThe same quarter and the sibling figure correction: there a sales decline read as a cost, here a net income figure read as a cost.Kaseya VSAThe contrast: a vendor whose compromise did reach its customers' systems, which is exactly what this record says did not happen here.

Sources

Primary sources are Johnson Controls' own SEC filings, checked by exact-phrase full-text search on EDGAR, and the federal rules they were filed under. Press is cited only as evidence of what was said or claimed.

  1. Company filingJohnson Controls International plc, Form 8-K, Item 8.01 (Other Events), 13 November 2023 (accession 0000833444-23-000038): detection, the ransomware description, containment and the OpenBlue and Metasys statement. sec.gov
  2. Company filingJohnson Controls International plc, Form 8-K, Item 8.01 (Other Events), 27 September 2023 (accession 0000833444-23-000036). sec.gov
  3. Company filingJohnson Controls International plc, Form 10-K for the fiscal year ended 30 September 2024, filed 19 November 2024 (accession 0000833444-24-000064), and Form 10-Q filed 6 August 2025 (accession 0000833444-25-000063), the latest filing carrying the product statement. sec.gov · 10-Q, 6 August 2025
  4. Company filingJohnson Controls International plc, Form 12b-25 (Notification of Late Filing, NT 10-K), 29 November 2023 (accession 0000833444-23-000040). sec.gov
  5. PressLawrence Abrams, "Building automation giant Johnson Controls hit by ransomware attack," BleepingComputer, 27 September 2023. Cited as evidence of what was claimed: the Dark Angels ransom note, the 27 TB and ESXi claims, the $51 million demand and a customer's secondhand account. bleepingcomputer.com
  6. RegulatorUS Securities and Exchange Commission, EDGAR full-text search of Johnson Controls filings (CIK 0000833444), run 24 and 28 September 2026: the product statement in nine filings from 13 November 2023 to 6 August 2025 (plus two annual report copies); "data exfiltration" first in the FY2023 10-K; "Dark Angels": zero; "Homeland Security" with "cybersecurity incident": zero. efts.sec.gov · "Dark Angels" query
  7. Company filingJohnson Controls International plc, Form 10-K for the fiscal year ended 30 September 2023, filed 14 December 2023 (accession 0000833444-23-000048): Item 1A and the material weakness identified in connection with the incident. sec.gov · Filing index
  8. Company filingJohnson Controls International plc, Form 10-Q for the quarter ended 31 December 2023, filed 30 January 2024 (accession 0000833444-24-000011): the approximately $27 million net income impact, net of insurance recoveries. sec.gov
  9. PressBill Toulas, BleepingComputer, 31 January 2024, quoting the 10-Q's $27 million sentence in full (key phrases independently confirmed on EDGAR). bleepingcomputer.com
  10. PressCNN, "Exclusive: DHS investigating whether floor plans and other security information were exposed in ransomware attack on contractor," 28 September 2023. Cited as evidence of what internal DHS correspondence said, as CNN reported it. cnn.com
  11. Government17 CFR 240.12b-25, "Notification of inability to timely file all or any required portion of a Form 10-K, 20-F, 11-K, N-CEN, N-CSR, 10-Q, or 10-D": a report filed within the extension period is deemed filed on the prescribed due date. law.cornell.edu
  12. FederalUS Securities and Exchange Commission, "Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure," final rule, Federal Register document 2023-16194, 4 August 2023 (adopted July 2023; Form 8-K Item 1.05 compliance from 18 December 2023). federalregister.gov

Cite this page

BlastWave. “Johnson Controls Ransomware Incident (2023): What Is Verified.” Hackopedia, Volume 2, FILE 048. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/johnson-controls-2023/

Revision history

DateChange
6 Oct 2026Numbered FILE 048 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026Hand-check against EDGAR full-text search of the company's filings: confirmed that "data exfiltration" first appears in the FY2023 annual report, that no filing names Dark Angels, and that the product statement appears unchanged in nine filings from November 2023 to August 2025.
26 Sep 2026Full validation against the filings, the SEC rules and CNN's report. Wording aligned to the filings: the product statement is about the company's digital products, the annual report was filed within its permitted extension, Item 1.05 existed but was not yet required, and the $27 million figure always carries "net of insurance recoveries."
24 Sep 2026Volume 2 entry built from primary sources: the company's 8-Ks, Form 12b-25, 10-Ks and 10-Qs.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry