January 2018–November 2026
2026: $5 million settlement over cybersecurity failings in federal contracts
On 13 November 2026 the US Department of Justice announced a $5 million global settlement with Johnson Controls, Inc. and two subsidiaries, Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC. The authorities alleged that they had failed to implement cybersecurity controls and documentation required by federal contracts, including for NASA and the Defense Department. The settlement resolves these False Claims Act allegations without any admission of liability.
- State of the evidence
- Confirmed settlement; alleged failures have not been judicially established.
- Legal status — source text
- False Claims Act settlement; no criminal conviction.
- Attribution
- Alleged noncompliance with federal contract cybersecurity duties by Johnson Controls, Inc..
Sources · 3
- [1]U.S. Department of JusticeHVAC Supplier Johnson Controls Inc. and Two Subsidiaries Agree to Pay $5 Million to Settle Cybersecurity Fraud Allegations13 November 2026Official documentHigh reliability
- [2]U.S. Attorney’s Office, Northern District of GeorgiaJohnson Controls, Inc. and Two Subsidiaries Agree to Pay $5 Million to Settle Federal Fraud Allegations13 November 2026Official documentHigh reliability
- [3]
Last verified: 14 November 2026
