Summary
Johnson Controls International plc (JCI) has filed an 8-K detailing a cybersecurity incident that occurred around September 23, 2023. The incident involved unauthorized access and ransomware deployment, leading to disruptions in portions of its internal IT infrastructure and business applications. While the company has largely restored impacted systems and believes the unauthorized activity is contained, the disruption has affected systems supporting financial reporting. Consequently, JCI expects a delay in reporting its fiscal 2023 fourth quarter and year-end results, now anticipated by December 14, 2023, within the available extension period. The company has engaged cybersecurity experts and is continuing its investigation to assess the full extent of data accessed or exfiltrated. Importantly, JCI has not found evidence of any impact on its digital products and solutions, such as OpenBlue and Metasys. While the financial reporting systems have been restored and data reconciled, the ongoing evaluation of the business, financial, and related impacts is continuing.
Key Highlights
- 1Cybersecurity incident involving ransomware occurred around September 23, 2023, affecting internal IT infrastructure.
- 2Significant disruptions to business applications supporting operations and corporate functions were experienced.
- 3Company has largely restored impacted applications and systems, and believes the unauthorized activity is contained.
- 4No evidence of impact on digital products and solutions (e.g., OpenBlue, Metasys) has been found.
- 5Disruptions to financial reporting systems have caused a delay in the release of Q4 and full-year 2023 results.
- 6Fiscal 2023 fourth quarter and year-end results are now expected to be reported by December 14, 2023.
- 7Ongoing investigation to assess data accessed, exfiltrated, and ongoing business/financial impacts.