ATLANTA — Johnson Controls, Inc. and two subsidiaries agreed to pay $5 million to settle allegations that they violated the False Claims Act by failing to comply with federal cybersecurity requirements in contracts for building products and services.
[DOWNLOAD: Free WSB-TV News app for alerts as news breaks]
The Milwaukee-based heating, ventilation, and air conditioning supplier was accused of failing to comply with cybersecurity rules across multiple federal agency contracts.
According to the Justice Department, the alleged security violations occurred between January 2018 and August 2025. During that period, Johnson Controls and its subsidiaries—Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC—entered into contracts with NASA and the Departments of Defense, Energy and Justice that required specific security controls to protect government information.
Federal prosecutors alleged Johnson Controls failed to control access to protected information due to insufficient system controls. Prosecutors also alleged the company failed to maintain a compliant system security plan and failed to document or implement plans to correct deficiencies and reduce system vulnerabilities.
The settlement resolves two whistleblower lawsuits filed under the qui tam provisions of the False Claims Act, which permit private citizens to sue on behalf of the United States and share in financial recoveries. Former Johnson Controls employees Kelly Vance and David Thomas brought the actions. Under the agreement, Vance will receive an $850,000 share.
The lawsuits were filed in federal court as United States ex-rel. Vance v. Johnson Controls, Inc. in the U.S. District Court for the Northern District of Georgia and United States ex rel. Thomas v. Johnson Controls Int’l PLC in the U.S. District Court for the District of Columbia.
TRENDING STORIES:
- $30 holiday scratcher turns into $3M
- Body camera footage shows moments after UGA student’s eighth floor fall
- Man kills girlfriend, shoots 2 others during family gathering in DeKalb County
Federal officials emphasized the importance of contractor compliance with government security mandates. Theodore S. Hertzberg, U.S. Attorney for the Northern District of Georgia, said federal prosecutors will pursue long-standing security lapses.
“Cybersecurity requirements are of the utmost importance to the government,” Hertzberg said.
“My office will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors.”Justice Department officials noted that compliance ensures protection of sensitive data and taxpayer funds.
Justice Department Assistant Attorney General Jonathan Guynn’s Civil Division stated that contractors must meet required standards.
“Federal contractors must follow required cybersecurity standards to safeguard sensitive government information,” Guynn said. “The Justice Department will continue working with its law enforcement partners to ensure that federal agencies and taxpayers get what they paid for and to hold accountable government contractors who violate cybersecurity requirements.”
Naval oversight officials highlighted security risks to military installations. Brian Merkal, acting Special Agent in Charge of the Naval Criminal Investigative Service Economic Crimes Field Office, addressed contractor responsibilities.
“Defense contractors who misrepresent their cybersecurity credentials and fail to safeguard critical infrastructure pose a direct threat to our Department of the Navy installations and warfighters,” Merkal said. “NCIS and our federal partners will relentlessly pursue any company or contractor who cuts corners on security mandates and leaves us vulnerable to adversarial threats.”
Federal property investigators also emphasized transparency in protecting government systems. Floyd Martinez, Special Agent in Charge of the General Services Administration Office of Inspector General Southeast and Caribbean Investigations Division, discussed oversight.
“Government contractors must be honest and vigilant in protecting the sensitive information entrusted to them,” Martinez said. “GSA OIG and our law enforcement partners remain committed to holding contractors accountable when they put national security at risk for financial gain.”
The settlement resulted from a joint effort involving the U.S. Attorney’s Offices for the Northern District of Georgia and the District of Columbia, alongside the Justice Department Civil Division’s Commercial Litigation Branch.
Investigative partners included the Defense Criminal Investigative Service, NCIS, the Air Force Office of Special Investigations and the Inspector General offices for NASA, the Department of Energy, the Department of Justice and the GSA. Assistant U.S. Attorney Adam Nugent, Trial Attorney Jennifer Cook and Assistant U.S. Attorney Sean Tepe handled the case for the District of Columbia.
This year, federal authorities launched the Task Force to Eliminate Fraud and the National Fraud Enforcement Division to combat fraud in federal programs. Enforcement under the False Claims Act supports the task force by recovering funds for taxpayers and holding contractors accountable.
[SIGN UP: WSB-TV Daily Headlines Newsletter]
©2026 Cox Media Group
