Johnson Controls International plc

Item 8.01 Other Events. Johnson Controls International plc (the “Company”) previously announced that it had experienced disruptions in portions of its internal information technology (IT) infrastructure and applications resulting from a cybersecurity incident . The incident was initially detected by the Company during the weekend of September 23, 2023 following outages to certain of the Company’s systems. Promptly after detecting the issue, the Company implemented its incident management and response plan and business continuity plans, including implementing remediation measures to mitigate the impact of the incident and restore affected systems and functions. The Company also engaged leading cybersecurity experts and other specialized consultants to assist in its investigation and remediation of the incident, as well as the restoration of impacted applications and systems. The cybersecurity incident consisted of unauthorized access and deployment of ransomware by a third party to a portion of the Company’s internal IT infrastructure. The incident caused disruptions and limitation of access to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions. To date, the Company has largely restored the impacted applications and systems, and continues to execute business continuity and restoration plans for the remaining impacted applications and systems. Based on the information reviewed to date, the Company believes the unauthorized activity has been contained. The Company’s investigation and remediation efforts remain ongoing, including the analysis of data accessed, exfiltrated or otherwise impacted during the cybersecurity incident. Based on the information reviewed to date, the Company has not observed evidence