Johnson Controls, a critical infrastructure provider, faced severe exposure of its industrial control systems (ICS) due to unpatched vulnerabilities and misconfigurations. The systems, integral to power grids, water treatment plants, and manufacturing operations, were left accessible online with default credentials or known flaws. This negligence enabled potential cyber intrusions capable of triggering catastrophic outcomes—such as blackouts, chemical contamination (e.g., tampering with chlorine levels in water utilities), or operational shutdowns in energy and healthcare sectors. The 2025 CISA advisory highlighted these vulnerabilities as high-severity risks, emphasizing the systemic failure to enforce air-gapping or zero-trust security models. The lapse not only jeopardized public safety but also invited state-sponsored or criminal exploitation, amplifying threats to national security. The company’s delayed mitigation efforts, coupled with regulatory gaps and legacy system dependencies, exacerbated the exposure, leaving critical infrastructure defenseless against attacks with life-threatening or war-escalating potential.

A'massive ransomware attack' reportedly affected Johnson Controls International, encrypting many company devices, including VMware ESXi servers, and negatively affecting the business operations of both the parent corporation and its subsidiaries. Development and production of industrial control systems, security tools, air conditioners, and fire safety gear are all activities of the international company Johnson Controls. However, the incident has disrupted some of the Company's business operations and is anticipated to continue doing so. The Company is evaluating the incident's potential effects on its ability to deliver its financial results for the entire fiscal year and the fourth quarter on schedule.