Johnson Controls $5.48M Settlement Claim Up To $5K

Johnson Controls, Inc. has agreed to a $5,475,000 non-reversionary class action settlement over a cybersecurity incident that ran from approximately February 1, 2023 to September 30, 2023 and potentially exposed sensitive personal information of current and former employees, job applicants and other individuals.

Quick answer: If Johnson Controls sent you a notice saying your information may have been compromised, you can file a claim for an estimated $50 cash payment with no receipts, or up to $5,000 for documented losses. You can also claim two years of one-bureau credit monitoring with up to $1 million in identity-theft insurance. The claim deadline is February 1, 2027. The opt-out and objection deadline is January 4, 2027, which comes first.

The settlement resolves In re Johnson Controls, Inc. Data Incident Litigation, Lead Case No. 2:25-cv-00955-BHL, in the U.S. District Court for the Eastern District of Wisconsin (Judge Brett H. Ludwig). Johnson Controls denies wrongdoing. The court granted preliminary approval on September 18, 2026; final approval is pending.

Official settlement website: JohnsonControlsDataSettlement.com

Official online claim form: Submit a claim

Johnson Controls Settlement: Quick Facts

Detail	Verified information
Settlement fund	$5,475,000 (non-reversionary)
Defendant	Johnson Controls, Inc.
Case	In re Johnson Controls, Inc. Data Incident Litigation
Case number	2:25-cv-00955-BHL
Court	U.S. District Court, Eastern District of Wisconsin
Judge	Brett H. Ludwig
Incident period	February 1 – September 30, 2023
Incident discovered	On or about September 24, 2023
Individuals notified	Approximately 578,699
Notifications began	June 2025
Preliminary approval	September 18, 2026
Eligibility	Living U.S. residents sent a qualifying incident notice
Cash Payment A	Up to $5,000 for documented losses
Cash Payment B	Estimated $50, subject to pro-rata adjustment
Credit monitoring	2 years, one bureau, up to $1,000,000 identity-theft insurance
Claim deadline	February 1, 2027
Opt-out / objection deadline	January 4, 2027
Final approval hearing	January 15, 2027, 10:30 a.m. Eastern (9:30 a.m. Central, court time), by telephone
Administrator	Kroll Settlement Administration LLC, (833) 453-2575
Final approval	Pending

Key Deadlines

Action	Deadline
Opt out (exclude yourself)	January 4, 2027
Object to the settlement	January 4, 2027
Final approval hearing	January 15, 2027, 10:30 a.m. Eastern (9:30 a.m. Central)
File a claim online	February 1, 2027, 11:59 p.m. Pacific (2:59 a.m. Eastern on February 2)
File a claim by mail	Postmarked by February 1, 2027

To avoid any time-zone confusion, submit your claim well before February 1, 2027, and keep your confirmation.

Who Qualifies for the Johnson Controls Data Breach Settlement?

The court-authorized notice defines the Settlement Class as:

All living individuals residing in the United States who were sent notice that their Private Information may have been compromised as a result of the Data Incident.

The deciding factor is whether you were in Johnson Controls’ breach-notification population. Potentially eligible people include former and current employees, job applicants, consultants and other individuals whose information was held on affected systems.

Do former employees qualify?

Potentially, yes. You do not need to be a current employee. If Johnson Controls sent you a notice about the covered incident, you may be a Class Member.

Can customers or applicants qualify?

Only if they meet the class definition. Applying for a job, buying equipment or using company services does not by itself make you eligible. A notice is the key.

Who is excluded?

The settlement excludes specified company directors, officers and controlled entities, governmental entities, the assigned judge and certain associated individuals, people who validly opt out, and anyone determined to bear criminal responsibility for the incident.

You do not need to prove identity theft to claim the estimated $50 payment.

How Much Money Can You Get?

There are two alternative cash options, and you can add credit monitoring to either.

Cash Payment A: Up to $5,000 for Documented Losses

Class Members may claim up to $5,000 for documented, unreimbursed out-of-pocket losses related to the incident. Covered expenses can include:

Actual identity-theft or fraud losses
Postage, photocopying, scanning and fax costs
Mileage, travel and parking
Notary fees and research charges
Certain phone, text-message and data charges
Bank fees
Professional fees, such as accountants or attorneys

For actual identity-theft losses, the notice requires that the loss occurred between February 1, 2023 and the date of claim submission, is documented, and is fairly traceable to the incident. You must submit reasonable supporting documentation (receipts, bank statements, invoices or correspondence) and attest to the losses under penalty of perjury.

The $5,000 figure is a cap, not a guaranteed payment. Only approved, qualifying losses are reimbursed, and expenses already reimbursed by a bank, insurer or other source cannot be claimed again. If a documented-loss claim is rejected and the deficiency is not cured, the administrator will convert it to the alternative cash payment under the settlement rules.

Cash Payment B: Estimated $50, No Documentation

This option requires no proof of loss. You must still submit a valid claim. The $50 is only an estimate: the final amount may be higher or lower depending on the money left in the fund after required deductions and the number of valid claims.

Can you get both?

Combination	Allowed?
$50 cash + credit monitoring	Yes
Up to $5,000 documented losses + credit monitoring	Yes
$50 cash + documented-loss reimbursement	No
Credit monitoring only	Yes, through a valid claim

What Does the Two-Year Credit Monitoring Include?

Class Members may claim two years of one-bureau credit monitoring with real-time alerts and up to $1,000,000 in identity-theft insurance, subject to the policy’s terms. Key points:

It is one bureau, not three. Do not assume three-bureau coverage.
It can be combined with either cash option.
It is available even if you previously received monitoring tied to this incident.

You must file a valid claim to receive it. Automatic enrollment applies only in limited cases.

Johnson Controls $5.475 Million Data Breach Settlement: Claim $50 or Up to $5,000 by February 1, 2027

How to File a Johnson Controls Settlement Claim

Option 1: File online

Go to JohnsonControlsDataSettlement.com and select Submit Claim.
Enter the Class Member ID from your notice.
Confirm your contact information.
Choose Cash Payment A or B.
Select credit monitoring if you want it.
Upload supporting documents if you are claiming documented losses.
Choose a payment method and submit. Save your confirmation.

The portal is interactive. If it shows an error, use the paper form rather than assuming your claim went through.

Option 2: File by mail

Download the official paper claim form, complete and sign it, attach any required documents, and mail it, postmarked by February 1, 2027, to:

In re Johnson Controls, Inc. Data Incident Litigation
c/o Kroll Settlement Administration LLC
ATTN: Claims
P.O. Box 5324
New York, NY 10150-5324

Lost your Class Member ID?

Call Kroll at (833) 453-2575 and explain that you may be a Class Member. Never guess an ID or use someone else’s credentials.

Payment methods

The claim form offers PayPal, Venmo, Zelle, a virtual Mastercard and a mailed check. Choose one you can reliably access, and keep your address current if you choose a check. Filing a claim is free. Nobody legitimate will charge you a fee to file or receive payment.

What Happened in the Johnson Controls 2023 Cyberattack?

Johnson Controls, a global provider of building technologies, HVAC, fire protection and security products, became aware on or about September 24, 2023 of a cyber incident that disrupted its IT systems. Its investigation found that unauthorized actors accessed certain systems from approximately February 1 through September 30, 2023. The company later confirmed in SEC filings that the incident involved ransomware and data exfiltration, and reported business disruption and remediation costs.

What information was potentially exposed?

The notice lists: names, Social Security numbers, dates of birth, health insurance information, medical information, financial account information, government ID numbers and biometric information. The data varied by person; not everyone had every category exposed.

Were Johnson Controls’ products affected?

The company’s SEC disclosures said it had not observed evidence of impact on digital products such as OpenBlue and Metasys. This settlement concerns personal data stored in company systems, not a defect in building-control equipment.

Why did letters arrive in 2025 for a 2023 incident?

Johnson Controls kept reviewing the affected files after the attack. A sample notice filed with the Delaware Department of Justice is dated June 30, 2025, and the settlement FAQ confirms notifications began in June 2025. A 2025 letter can therefore relate to the 2023 incident.

Why Was Johnson Controls Sued?

Plaintiffs alleged the company failed to adequately protect sensitive data. Their claims included negligence, breach of implied contract, unjust enrichment and violations of state consumer-protection laws. The cases were consolidated in the Eastern District of Wisconsin. The eight Class Representatives are Jennifer C. Gorman, Hal Bauer, Derek Hefley, Carol McKinnon, Frank Waddell, Chris Broadhead, Mohammad Asem Alkhatib and William John Pacheco.

Johnson Controls denies all allegations. The settlement avoids the cost, risk and delay of further litigation and is not an admission of liability.

The Legal Framework Behind This Settlement

This section explains the laws that shape data breach class actions and why a settlement like this one is structured the way it is. It is general information, not legal advice.

Federal class action rules (Rule 23)

Under Federal Rule of Civil Procedure 23, a class action settlement requires court approval. Rule 23(e) requires the judge to find the settlement fair, reasonable and adequate after notice to the class, considering whether the class was adequately represented, the deal was negotiated at arm’s length, the relief is adequate, and class members are treated equitably. Rule 23(c)(2)(B) governs the content of notice, and Rule 23(e)(5) governs objections. That is why a final approval hearing is held on January 15, 2027, and why payments wait until the settlement becomes final.

Class Action Fairness Act (CAFA)

Under 28 U.S.C. § 1715, settling defendants in class actions must notify appropriate federal and state officials, and a court generally cannot grant final approval until 90 days after that notice. This is a standard safeguard in settlements of this size.

Article III standing in data breach cases

Federal courts require plaintiffs to show a concrete injury. In Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Supreme Court held that a bare statutory violation is not enough and that exposure to risk of future harm does not by itself support damages. In the Seventh Circuit, which covers Wisconsin, Remijas v. Neiman Marcus Group, 794 F.3d 688 (7th Cir. 2015), and Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018), recognized that mitigation costs and a substantial risk of identity theft after a breach can support standing. These standing questions are a major litigation risk for plaintiffs, and one reason settlements offer documented-loss reimbursement alongside flat payments.

Negligence, implied contract and unjust enrichment

Negligence generally requires a duty of care, breach, causation and compensable damages. A cyberattack alone does not prove every element.
Breach of implied contract depends on whether providing information carried an implied promise of reasonable security.
Unjust enrichment is governed by state law and is not automatic merely because data was taken.

The settlement resolves these disputed claims without deciding them.

State data breach notification laws

All 50 states require notice after certain breaches of personal information. Johnson Controls operates in Wisconsin, whose statute, Wis. Stat. § 134.98, requires notice within a reasonable time, not to exceed 45 days after the entity learns of the acquisition, with limited exceptions. Delaware’s law, 6 Del. C. § 12B-102, requires notice to the Attorney General when more than 500 residents are affected, which is why a sample letter appears in Delaware’s records. Whether any state-law notice timing was met was among the issues plaintiffs could have contested; this settlement does not resolve that question.

Federal laws that apply to health and financial data

HIPAA (45 C.F.R. §§ 164.400–414) sets breach-notification duties for covered entities and business associates but has no private right of action, so individuals cannot sue directly under it. Health information in an employer’s records may fall outside HIPAA altogether, which is why data breach plaintiffs usually rely on state-law claims.
FTC Act Section 5 (15 U.S.C. § 45) lets the FTC pursue unfair or deceptive data-security practices. It does not give individuals a private lawsuit.
Identity Theft and Assumption Deterrence Act (18 U.S.C. § 1028) makes identity theft a federal crime.

Biometric information

The notice lists biometric information among the data types. Some states, notably Illinois under 740 ILCS 14 (BIPA), regulate biometric data with private rights of action. The public settlement materials do not state which statutes the biometric allegations rely on, so this is context only; check the official notice for the claims being released.

Your rights under the Fair Credit Reporting Act (FCRA)

Regardless of the settlement, federal law gives you rights:

Free security freezes at all three nationwide credit bureaus (15 U.S.C. § 1681c-1)
Initial fraud alerts (one year), and extended alerts (seven years) for identity theft victims
Free credit reports and the right to dispute inaccurate information (15 U.S.C. §§ 1681j, 1681i)
Identity theft reporting at IdentityTheft.gov

How the $5.475 Million Fund Is Distributed

Expense	Amount
Total settlement fund	$5,475,000
Attorneys’ fees requested	Up to $1,825,000, plus costs, subject to court approval
Class Representative service awards	4,000eachforeightrepresentatives(32,000 total)
Settlement administration	Actual costs under the agreement
Credit monitoring	Funded before cash distributions
Cash claims	Paid from remaining funds

Administration costs and court-approved fees and awards come out first. Valid credit-monitoring and documented-loss claims are addressed next, and what remains funds the alternative cash payments. That is why the $50 figure is only an estimate and could fall if many people claim.

Opt-Out, Objection or Do Nothing: Your Options

Choice	What it means	Deadline
File a claim	Receive benefits; you are bound by the release if the settlement is approved	February 1, 2027
Opt out	No benefits; you keep the right to sue separately	January 4, 2027
Object	Tell the court what you oppose; you can still claim	January 4, 2027
Do nothing	No benefits, and you are bound by the release if approved	—

How to opt out

Send a signed written request with your full name, current address, telephone number, email (if available) and a clear statement that you want to be excluded. Mail it to Kroll marked ATTN: Requests to Opt Out, postmarked by January 4, 2027.

How to object

File a written objection with the U.S. District Court for the Eastern District of Wisconsin by January 4, 2027, with copies sent as the notice requires. The official notice also requires disclosure of any artificial intelligence used to prepare an objection. You can object and still claim, but you cannot both opt out and object.

When Will Payments Be Sent?

Judge Ludwig will decide on final approval, fees and service awards at the hearing on January 15, 2027, at 10:30 a.m. Eastern (9:30 a.m. Central), held by telephone. If approved, benefits are distributed after the settlement becomes final and any appeals are resolved. No payment date has been announced. The hearing date is not the claim deadline; claims are due February 1, 2027.

Are Settlement Payments Taxable?

Tax treatment depends on your situation. Amounts that merely reimburse documented out-of-pocket losses are often treated differently from flat payments that are not tied to a specific loss, and the administrator generally does not provide tax advice. Consult a qualified tax professional about how a payment applies to you.

How to Protect Yourself Now

Place a free security freeze with Equifax, Experian and TransUnion.
Review bank, card and medical-insurance statements and explanations of benefits for unfamiliar activity.
If your Social Security number was exposed, consider an IRS Identity Protection PIN and check your Social Security account.
Report identity theft at IdentityTheft.gov and keep records of any losses; they support a Cash Payment A claim.
Use unique passwords and multi-factor authentication.

Beware of settlement scams

The official administrator will not ask for your full Social Security number, bank password or an upfront fee to process a claim. Only use JohnsonControlsDataSettlement.com or call (833) 453-2575. Ignore emails or texts from other sources promising to “release” your payment.

How This Settlement Compares With Other Data Breach Settlements

The structure here (flat cash, documented-loss reimbursement and monitoring) is common. Other cases differ:

These are separate cases. Eligibility for one does not make you eligible for another.

Frequently Asked Questions

Is the Johnson Controls settlement real?

Yes. A federal court granted preliminary approval, and the court-authorized administrator, Kroll, operates JohnsonControlsDataSettlement.com.

Who qualifies?

Living U.S. residents who were sent notice that their information may have been compromised in the covered incident, subject to exclusions.

Can former employees receive money?

Potentially, yes, if they received a qualifying notice.

How much can I get?

An estimated $50 without receipts, or up to $5,000 for documented qualifying losses, plus optional credit monitoring.

Is the $50 guaranteed?

No. It is an estimate subject to pro-rata adjustment.

Can I get both $50 and $5,000?

No. Choose one cash option. Credit monitoring can be added to either.

Does the monitoring cover all three bureaus?

No. It is one-bureau monitoring for two years, with up to $1 million in identity-theft insurance.

Do I need proof of identity theft?

Not for the $50 option. Documented-loss claims need supporting evidence.

Can I file without a Class Member ID?

Contact Kroll at (833) 453-2575 to confirm eligibility and recover your ID.

What is the claim deadline?

February 1, 2027.

Can I opt out and still claim?

No. Opting out means no settlement benefits.

When is the final approval hearing?

January 15, 2027, at 10:30 a.m. Eastern (9:30 a.m. Central), subject to court scheduling changes.

When will payments arrive?

After final approval, resolution of any appeals and claim processing. No date has been announced.

Bottom Line

The Johnson Controls $5.475 million settlement lets eligible people affected by the 2023 cybersecurity incident choose between an estimated $50 payment without documentation and up to $5,000 for qualifying documented losses, with two years of credit monitoring available on top. The most important step is to file a valid claim by February 1, 2027. If you are considering opting out or objecting, you must act by January 4, 2027. The settlement is not final until the court approves it, and Johnson Controls denies wrongdoing.

Official Sources and Court Documents

Verification note: The official FAQ and court-authorized notice confirm the benefits, class definition, administrator, deadlines and payment order. The online claim portal requires JavaScript and its usability could not be fully tested; the printable form is an authorized alternative. The filed settlement documents govern if any information changes. Hearing and deadline times are shown in Eastern time, with the court’s Central time noted where relevant.

Disclaimer: AllAboutLawyer.com provides general legal information, not legal, tax or financial advice. Payment amounts and eligibility are determined under the settlement agreement and remain subject to final court approval. Consult a licensed attorney about your specific situation.

By Israr Ahmad, Legal Content Researcher, AllAboutLawyer.com | Published: November 13, 2026 | Facts verified against the official settlement website and court-authorized notice on November 13, 2026

About the Author

Israr Ahmad is a legal content researcher with 4+ years of experience covering class action settlements and consumer rights cases. He has researched and published coverage of 2,500+ settlements using verified court records, settlement administrator filings, and government sources. Learn more about Israr.