Johnson Controls Hit With Proposed Class Action Over Data Breach

Multinational building automation company Johnson Controls Inc. was hit with a proposed class action alleging it failed to protect and secure customer’s private information during a 2023 data breach.

Mohammad Alkhatib, the plaintiff and a former employee of Johnson Controls, filed the suit in the US District Court for the Eastern District of Wisconsin Monday alleging negligence, breach of implied contract, breach of confidence, breach of fiduciary duty, and unjust enrichment.

The suit is one of four that have been filed in the Eastern District of Wisconsin against Johnson Controls over the data breach since July 3.

Alkhatib alleged the company didn’t use “reasonable security procedures and practices” that were necessary for the nature of the personally identifiable information they maintained. The suit alleged the company didn’t encrypt or delete the PII when it was no longer needed.

Sensitive data from approximately 53,209 current and former employees and clients was exposed in the breach, according to the suit. Following the discovery, Johnson Controls found that an unauthorized actor accessed information from February to September 2023, the suit said.

The suit alleges that public disclosure of the breach wasn’t sent out to those affected until June 30, 2025.

Alkhatib seeks injunctive relief and damages for the invasion of privacy, lost time and opportunity costs, diminished value of PII, and increased risk of identity theft for those impacted by the breach.

A spokesperson for Johnson Controls said “this is not a new incident.” The spokesperson said they disclosed the breach Sept. 27, Nov. 13, and Dec. 14, 2023.

“We have sent notification letters to certain individuals and offered complimentary credit and identity monitoring services and certain fraud support services or dark web internet scanning services, where available,” the spokesperson said. “We have also posted information regarding the incident on our website.”

Alkhatib is represented by Milberg, Coleman, Bryson, Phillips, Grossman PLLC.

The case is Alkhatib v. Johnson Controls Inc., E.D. Wis., No. 2:25-cv-00968, complaint filed 7/7/25.