People Johnson Controls notified that their information may have been exposed in its February to September 2023 data incident may qualify to claim an estimated $50 cash payment or up to $5,000 in documented losses, plus two years of credit monitoring, from the $5.475 million Johnson Controls data breach class action settlement. Claims are open through February 1, 2027, and the final approval hearing is set for January 15, 2027.
Current Status
Claims are open through February 1, 2027: claims filed online are due by 11:59 p.m. Pacific time that day, and paper claims must be postmarked by that date. As of November 9, 2026, the official settlement website said it was temporarily unable to process claim forms submitted online and was accepting claims by mail in the meantime. The U.S. District Court for the Eastern District of Wisconsin granted preliminary approval on September 18, 2026, and the final approval hearing is set for January 15, 2027. No payments have been made, and none will be until the Court grants final approval and any appeals are resolved.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The settlement is newly open to claims. Johnson Controls, Inc. agreed to pay $5.475 million into a non-reversionary fund to settle In re Johnson Controls, Inc. Data Incident Litigation, Lead Case No. 2:25-cv-00955-BHL, in the U.S. District Court for the Eastern District of Wisconsin. The Court preliminarily approved the settlement on September 18, 2026 and appointed Kroll Settlement Administration as the settlement administrator, which has mailed notices and opened the official settlement website.According to the settlement agreement, Johnson Controls, a publicly traded, Wisconsin-based building technology company, became aware on or about September 24, 2023 of a cyber incident that disrupted its information technology systems. The company determined that an unauthorized actor accessed certain systems from about February 1, 2023 to September 30, 2023 and potentially accessed or took data, and it began notifying potentially affected people in June 2025. About 578,699 people were notified. The notice lists names, Social Security numbers, dates of birth, health insurance and medical information, financial account information, government ID numbers and biometric data among the information potentially involved.
The plaintiffs’ consolidated complaint, filed December 3, 2025, alleged negligence, breach of implied contract, breach of fiduciary duty, breach of confidence, unjust enrichment and violations of California’s Unfair Competition Law and Consumer Privacy Act. The parties reached the settlement after a mediation on April 28, 2026. Johnson Controls denies all of the claims and any wrongdoing, and the Court has not decided who is right.
Who Qualifies?
The settlement class is all living individuals residing in the United States who were sent notice that their private information may have been compromised in the Johnson Controls data incident.Directors and officers of Johnson Controls and entities it controls, government entities, the judge assigned to the case, the judge’s immediate family and court staff, people who opt out, and anyone found guilty of, or pleading no contest to, initiating or aiding the criminal activity behind the incident are excluded.
How Much Can You Get?
Each class member who files a valid claim can choose one cash option and can add credit monitoring to it:- Documented losses, up to $5,000. Reimbursement of documented, unreimbursed losses related to the incident. The settlement agreement lists losses from actual identity theft that occurred between February 1, 2023 and the date of the claim, plus postage, copying and faxing, mileage and travel, parking, notary and research charges, per-minute phone, per-use data and per-message text charges, long-distance calls, bank fees and professional fees such as accountants and attorneys.
- Alternate cash payment, estimated at $50. No documentation or attestation is required. This is a pro rata share of what is left in the fund, so the $50 figure is an estimate that will rise if fewer people claim and fall if more do.
- Two years of one-bureau credit monitoring, with real-time alerts and up to $1,000,000 in identity theft insurance, available even to people who already took the monitoring Johnson Controls offered in its notice letter.
The fund pays administration costs and any court-awarded fees and service awards first. Class counsel will ask for attorneys’ fees of up to one-third of the fund, $1,825,000, plus reasonable costs, and $4,000 for each of the eight class representatives. From what remains, the administrator pays credit monitoring, then documented-loss claims, and divides the rest among the alternate cash claims. If valid claims would exceed the fund, cash payments are reduced pro rata by an equal percentage. None of the money returns to Johnson Controls once the settlement takes effect.
What Proof or Notice ID Is Required?
The paper claim form asks for the Class Member ID printed on the notice, “if known.” Because the form asks for a notice-issued ID, and the online claim form was temporarily unavailable to confirm whether a claim can be completed without one, OCA lists this settlement as Proof Required. The $50 alternate cash payment requires no receipts and no attestation.The documented-loss option requires reasonable documentation of each expense and an attestation under penalty of perjury. Losses already reimbursed from another source, including the identity protection and credit monitoring services Johnson Controls offered in its notice letter, are not covered. A documented-loss claim that is rejected and not cured after a deficiency notice is converted to the alternate cash payment.
What Is the Deadline?
Claims are due February 1, 2027. Under the settlement agreement and notice, a claim filed online must be submitted by 11:59 p.m. Pacific time on that date, and a paper claim must be postmarked by that date.Requests to opt out and objections are due January 4, 2027. Class members who do not opt out give up the right to sue Johnson Controls and the other released parties over the data incident, whether or not they file a claim.
How Do You Take Action?
Claims can be filed through the official Johnson Controls data settlement website once its online claim form is working again, or by printing the claim form from the website and mailing it to the settlement administrator by the deadline. The claim form asks claimants to choose one cash option, check the box for credit monitoring if wanted, and pick payment by PayPal, Venmo, Zelle, virtual Mastercard or check.What Happens Next?
The Court will hold the final approval hearing by telephone on January 15, 2027 at 9:30 a.m. Central time, where it will decide whether to approve the settlement and rule on the request for attorneys’ fees, costs and service awards. The hearing date can change without further notice.Under the agreement, Johnson Controls funds the remaining $5,075,000 within 45 days after final approval. Benefits are distributed after final approval and the resolution of any appeals. No payment date had been announced as of November 9, 2026.
Sources and Verification
• Official settlement website — Johnson Controls Data Settlement, including its important dates and the notice of the temporary online claim outage• Settlement Agreement, In re Johnson Controls, Inc. Data Incident Litigation, Lead Case No. 2:25-cv-00955-BHL (E.D. Wis.), ECF No. 38-1 (filed July 24, 2026)
• Order Granting Preliminary Approval for Class Action Settlement, ECF No. 39 (E.D. Wis. Sept. 18, 2026)
• Notice of Proposed Class Action Settlement and Claim Form, posted on the official settlement website
Questions
Is the Johnson Controls $50 payment guaranteed?
No. The $50 alternate cash payment is an estimate. Under the settlement agreement, the fund pays credit monitoring first, then documented-loss claims, and whatever remains of the net fund is divided equally among the alternate cash claims, so the amount goes up if fewer people claim and down if more do. With about 578,699 people notified, the final figure depends heavily on the claims rate.
Can a Johnson Controls class member claim documented losses and the $50 payment?
No. The settlement lets each class member choose one cash option: documented losses up to $5,000 or the alternate cash payment. Credit monitoring can be added to either. A documented-loss claim that is rejected and not cured is converted to the alternate cash payment.
What counts as a documented loss in the Johnson Controls settlement?
The settlement agreement lists unreimbursed losses from actual identity theft that are fairly traceable to the data incident and occurred between February 1, 2023 and the date of the claim, along with postage, copying and faxing, mileage and travel, parking, notary and research charges, per-minute phone, per-use data and per-message text charges, long-distance calls, bank fees and professional fees such as accountants and attorneys. Expenses already reimbursed, including through the identity protection Johnson Controls offered in its notice letter, are not covered.
Who is Johnson Controls, and why did it have this information?
Johnson Controls, Inc. is a publicly traded, Wisconsin-based company that provides building technology, software and services. According to the settlement agreement, an unauthorized actor accessed certain Johnson Controls systems from about February 1, 2023 to September 30, 2023, and the company began notifying potentially affected people in June 2025. The notice lists names, Social Security numbers, dates of birth, health insurance and medical information, financial account information, government ID numbers and biometric data among the information potentially involved.
How much will the lawyers be paid from the Johnson Controls fund?
Class counsel will ask the Court for attorneys’ fees of up to one-third of the fund, $1,825,000, plus reasonable costs, and service awards of $4,000 for each of the eight class representatives. Those amounts and the administration costs come out of the $5.475 million fund before class members are paid, subject to the Court’s approval at the January 15, 2027 hearing.
