Johnson Controls to Pay Up to $5,000 Each in Data Breach Settlement for 578,699 Affected

A Wisconsin-based company, Johnson Controls, has reached a settlement to address claims from a significant data breach that compromised sensitive information of approximately 578,699 individuals. The breach, which was discovered around September 24, 2023, involved unauthorized access to the company’s systems from February 1 to September 30, 2023.

The exposed data includes names, Social Security numbers, dates of birth, health and medical information, financial accounts, government IDs, and biometric data. Notifications to affected individuals began in June 2025, informing them of the potential compromise of their information.

On September 18, 2026, the U.S. District Court for the Eastern District of Wisconsin granted preliminary approval for a non-reversionary fund of $5.475 million in the case titled In re Johnson Controls, Inc. Data Incident Litigation. This fund is available to all living U.S. residents who received notice regarding the breach.

Eligible claimants can seek up to $5,000 for documented losses resulting from the incident or opt for an alternative cash payment estimated at $50, which does not require documentation. Additionally, all claimants may request two years of credit monitoring from one bureau, along with identity theft insurance coverage of up to $1 million.

Claims must be submitted by February 1, 2027, and a final approval hearing is scheduled for January 15, 2027. Notably, Johnson Controls denies all allegations and any wrongdoing, and the court has yet to rule on the merits of the case.