Dark Angels ransomware group claims major attack on Johnson Controls, demands a $51m ransom

Johnson Controls International, a leading manufacturer of industrial control systems, said it suffered a significant cyber attack that affected many of its systems and of its subsidiaries.

Headquartered in Cork, Ireland, Johnson Controls International is an American, Irish-domiciled multinational conglomerate that manufactures security equipment, industrial control systems, air conditioners, and fire safety equipment. It has several subsidiary companies, including York, Tyco, Luxaire, Coleman, Ruskin, Grinnel, and Simplex.

In a notice posted on York’s website, Johnson Controls said that it suffered “IT outages” that affected several of its internal systems. Later, other Johnson control subsidiary companies, including Simplex and Ruskin, posted similar “outage” notices.

“We are currently experiencing IT outages that may limit some customer applications such as the Simplex Customer Portal. We are actively mitigating any potential impacts to our services and will remain in communication with customers as these outages are resolved,” reads a notice posted  on the Simplex website.

According to BleepingComputer, the IT outage was the result of a significant ransomware attack that affected Johnson Controls and its subsidiaries’ operations.

Many York customers took to social media and said that they are being told the company’s systems are offline due to a cyber attack. “Their computer system crashed over the weekend. Manufacturing and everything is down,” a York customer posted on Reddit.

Malware repository VX-Underground recently announced on X that a group of threat actors going by the name Dark Angels has claimed responsibility for the cyber attack on Johnson Controls and has listed the company on its data leak site.

The group claims to be in possession of 27TB of sensitive data stolen from Johnson Controls. According to BleepingComputer, the ransomware group encrypted the company’s VMWare ESXi virtual machines during the attack and has demanded a ransom of $51 million to provide a decryption key and delete the stolen data.

In a recent 8-K filing with the US Securities and Exchange Commission, the industrial control systems manufacturer acknowledged the reports of the cyber attack, stating that it is working with external cyber security experts to investigate the cyber security incident.

“Johnson Controls International plc has experienced disruptions in portions of its internal information technology infrastructure and applications resulting from a cybersecurity incident. Promptly after detecting the issue, the Company began an investigation with assistance from leading external cybersecurity experts and is also coordinating with its insurers.

“The Company continues to assess what information was impacted and is executing its incident management and protection plan, including implementing remediation measures to mitigate the impact of the incident, and will continue taking additional steps as appropriate. To date, many of the Company’s applications are largely unaffected and remain operational. To the extent possible, and in line with its business continuity plans, the Company implemented workarounds for certain operations to mitigate disruptions and continue servicing its customers.

“However, the incident has caused, and is expected to continue to cause, disruption to parts of the Company’s business operations. The Company is assessing whether the incident will impact its ability to timely release its fourth quarter and full fiscal year results, as well as the impact to its financial results.

“The Company’s investigation and remediation efforts are ongoing,” the filing reads.