Ransomware attack on Johnson Controls may have exposed sensitive DHS data

Experts warn that the recent attack on building automation giant Johnson Controls may have exposed data of the Department of Homeland Security (DHS).

Johnson Controls International plc is a multinational conglomerate with a diversified portfolio of products and services primarily focused on building technologies and solutions. The company provides HVAC (heating, ventilation, and air conditioning), solutions for building automation, fire and security systems, and components for energy management.

Bleeping Computer last week reported that Johnson Controls International has suffered a ransomware attack that impacted many systems of the company.

“The threat actors also claim to have stolen over 27 TB of corporate data and encrypted the company’s VMWare ESXi virtual machines during the attack.” reported Bleeping Computer.

Threat actors initially breached the systems at Asia offices, the ransomware also targeted the VMware ESXi servers.

The security breach forced the company to shut down its systems to prevent the threat from spreading.

“Johnson Controls International plc (the “Company”) has experienced disruptions in portions of its internal information technology infrastructure and applications resulting from a cybersecurity incident.”  reads the 8-K form filed with SEC. “To date, many of the Company’s applications are largely unaffected and remain operational. To the extent possible, and in line with its business continuity plans, the Company implemented workarounds for certain operations to mitigate disruptions and continue servicing its customers. However, the incident has caused, and is expected to continue to cause, disruption to parts of the Company’s business operations.”

Immediately after detecting the intrusion, the company launched an investigation with the help of leading third-party cybersecurity experts and is also coordinating with its insurers. The investigation is still ongoing and aims at determining the scope of the incident. The Company is assessing whether the security breach will impact its ability to timely release its fourth quarter and full fiscal year results, as well as the impact on its financial results.

Security researcher Gameel Ali speculated that Johnson Controls was the victim of the Dark Angels Team. According to BleepingComputer, the ransomware group is demanding $51 million to provide a decryptor, the amount of the ransom was confirmed by Malware Hunter Team researchers.

On Thursday, CNN warned that the security breach may have exposed US DHS data after having obtained an internal memo of the agency. The CNN speculates that Johnson Controls holds classified/sensitive contracts for DHS, the exposure of such documents potentially post a risk to the physical security of many DHS facilities.

“Senior Department of Homeland Security officials are working to determine whether a ransomware attack on government contractor Johnson Controls International has compromised sensitive physical security information such as DHS floor plans, according to internal DHS correspondence reviewed by CNN.” reads the article published by CNN.

“We are assessing the potential impacts of this incident and implementing additional safeguards to our layered security model. This was not a breach of any DHS network or system.” A DHS spokesperson told CNN on Friday.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DHS)