"Based on our investigation, we determined that an unauthorized actor accessed certain Johnson Controls systems from February 1, 2023 to September 30, 2023 and took information from those systems," the company says in data breach notification letters filed with California's Attorney General, redacted to conceal what information was stolen in the attack. While the firm didn't attribute the incident to a specific ransomware operation, the attack was linked to the Dark Angels ransomware group based on a sample of a VMware ESXi encryptor deployed during the breach, which stated that it was used against Johnson Controls. As BleepingComputer first reported, Johnson Controls was hit by a ransomware attack in September 2023, following a breach of the company's Asian offices in February 2023 and subsequent lateral movement through its network. Building automation giant Johnson Controls is notifying individuals whose data was stolen in a massive ransomware attack that impacted the company's operations worldwide in September 2023. BleepingComputer was also told that the ransom note linked to a negotiation chat where the ransomware gang demanded $51 million for a decryptor and to delete data stolen from Johnson Controls' network. Dark Angels, the ransomware operation behind Johnson Controls' 2023 breach, surfaced in May 2022 when it began targeting organizations worldwide in double-extortion attacks. Johnson Controls confirmed in a January 2024 SEC filing that the cyberattack was orchestrated by a ransomware gang that also stole documents from compromised systems during the breach. However, cybersecurity researcher MalwareHunterTeam told BleepingComputer that the Linux encryptor used in the Johnson Controls attack was the same as others used by Ragnar Locker ransomware since 2021. The cyberattack forced Johnson Controls to shut down large portions of its IT infrastructure after the threat actors encrypted many devices, which affected its operations worldwide and customer-facing systems. The ransomware operators also encrypted the company's VMware ESXi virtual machines during the attack and claimed to have stolen over 27 TB of documents containing corporate data.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 01 Jul 2025 11:50:14 +0000