01—Abstract
Summary
Summary of the 8-K filed November 13, 2023. Cited figures are marked; the original filing is the authoritative source.
Johnson Controls International plc (JCI) has filed an 8-K detailing a cybersecurity incident that occurred around September 23, 2023.
The incident involved unauthorized access and ransomware deployment, leading to disruptions in portions of its internal IT infrastructure and business applications. While the company has largely restored impacted systems and believes the unauthorized activity is contained, the disruption has affected systems supporting financial reporting. Consequently, JCI expects a delay in reporting its fiscal 2023 fourth quarter and year-end results, now anticipated by December 14, 2023, within the available extension period.
The company has engaged cybersecurity experts and is continuing its investigation to assess the full extent of data accessed or exfiltrated. Importantly, JCI has not found evidence of any impact on its digital products and solutions, such as OpenBlue and Metasys. While the financial reporting systems have been restored and data reconciled, the ongoing evaluation of the business, financial, and related impacts is continuing.
02—Key points
Key Highlights
- Cybersecurity incident involving ransomware occurred around September 23, 2023, affecting internal IT infrastructure.
- Significant disruptions to business applications supporting operations and corporate functions were experienced.
- Company has largely restored impacted applications and systems, and believes the unauthorized activity is contained.
- No evidence of impact on digital products and solutions (e.g., OpenBlue, Metasys) has been found.
- Disruptions to financial reporting systems have caused a delay in the release of Q4 and full-year 2023 results.
- Fiscal 2023 fourth quarter and year-end results are now expected to be reported by December 14, 2023.
- Ongoing investigation to assess data accessed, exfiltrated, and ongoing business/financial impacts.
03—Questions
Frequently Asked Questions
What was the nature of the cybersecurity incident at Johnson Controls?
Johnson Controls experienced a cybersecurity incident involving unauthorized access and ransomware deployment by a third party affecting a portion of its internal IT infrastructure and business applications.
Will the cybersecurity incident affect Johnson Controls' digital products and services?
Based on the information reviewed to date, Johnson Controls has not observed any evidence of impact to its digital products, services, and solutions, including its OpenBlue and Metasys offerings.
When will Johnson Controls report its fiscal 2023 fourth quarter and year-end results?
Due to disruptions caused by the cybersecurity incident to systems supporting financial reporting, Johnson Controls expects to report its fiscal 2023 fourth quarter and year-end results by December 14, 2023. This is within the available extension period under Rule 12b-25 for its Form 10-K.
What is the company doing to address the incident and its impact?
Johnson Controls has implemented its incident management and response plans, engaged cybersecurity experts, and is working to restore affected systems. The company is also conducting an ongoing investigation to assess the full extent of data accessed and the overall business and financial impacts.
04—Continue