NOTICE OF PROPOSED CLASS ACTION SETTLEMENT United States District Court for the Eastern District of Wisconsin In re Johnson Controls, Inc. Data Incident Litigation, Lead Case No. 25-cv-00955-BHL Were you notified that your Private Information may have been impacted by a Data Incident at Johnson Controls from February 1, 2023 through September 30, 2023? You may be eligible for benefits from a class action settlement. A federal Court authorized this Notice. You are not being sued. This is not a solicitation from a lawyer.  A Settlement has been reached with Johnson Controls, Inc. (the “Defendant” or “Johnson Controls”) in a class action lawsuit regarding a cybersecurity incident impacting the Defendant from approximately February 1, 2023 through September 30, 2023 (the “Data Incident”). The Data Incident may have resulted in unauthorized access to personally identifiable information (“Private Information”). The Defendant denies all allegations and any wrongdoing.  The Settlement Class consists of all living individuals residing in the United States who were sent notice that their Private Information may have been compromised as a result of the Data Incident.  If approved by the Court, the Defendant will pay into a Settlement Fund to resolve the lawsuit. The Settlement Fund will provide benefits to Settlement Class Members who submit Valid Claims as well as Settlement Administration Costs and any Court-awarded Attorneys’ Fees, Costs and Service Awards to Class Representatives. Monetary benefits include a cash payment of up to $5,000 per Settlement Class Member for documented losses related to the Data Incident (Cash Payment A) or an alternate cash payment estimated to be $50 (Cash Payment B). Settlement Class Members may also claim two (2) years of Credit Monitoring.  Your rights are affected whether you do or do not act. Please read this Notice carefully. YOUR LEGAL RIGHTS AND OPTIONS DEADLINE SUBMIT A The only way to receive benefits from this Settlement February 1, 2027 CLAIM FORM is to submit a valid and timely Claim Form. OPT OUT If you opt out, you will not be bound by the terms of January 4, 2027 OF/EXCLUDE the Settlement and you keep the right to sue the YOURSELF Defendant about the claims resolved by this Settlement. FROM THE You will not receive any benefits from the Settlement. SETTLEMENT OBJECT TO THE If you do not opt out of the Settlement, you may object January 4, 2027 SETTLEMENT to it and tell the Court what you do not like about it. AND/OR ATTEND You may also ask the Court for permission to speak A HEARING about your objection at the Final Approval Hearing. If you object, you can still submit a Claim Form for benefits. DO NOTHING If you do nothing, you will not get any benefits and you No deadline give up the right to sue the Defendant about the claims resolved by this Settlement.  These rights and options—and the deadlines to exercise them—are explained in this Notice.  The Court in charge of this case still must decide whether to approve the Settlement. WHAT THIS NOTICE CONTAINS Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 1 Basic Information 1. Why was this Notice issued? 2. What is this Action about? 3. What is a class action? 4. Why is there a Settlement? Who is in the Settlement? 5. Who is included in the Settlement? 6. Are there exceptions to being included? The Settlement Class Benefits 7. What does the Settlement provide? 8. Tell me more about the Documented Losses. 9. Tell me more about the Pro Rata Cash Payment. 10. Tell me more about the Credit Monitoring. 11. How will payments be calculated? 12. What claims am I releasing if I stay in the Settlement? How to get Settlement Class Benefits – Making a Claim 13. How do I submit a Claim Form to get Settlement Class Benefits? 14. When will I get Settlement Class Benefits? The Lawyers Representing You 15. Do I have a lawyer in this case? 16. Should I get my own lawyer? 17. How will the lawyers be paid? Excluding Yourself From the Settlement 18. How do I opt out of the Settlement? Objecting to the Settlement 19. How do I tell the Court if I do not like the Settlement? 20. What is the difference between objecting and opting out? The Court’s Final Approval Hearing 21. When is the Court’s Final Approval Hearing? 22. Do I have to come to the Final Approval Hearing? If You Do Nothing 23. What happens if I do nothing at all? Getting More Information 24. How do I get more information? Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 2 BASIC INFORMATION 1. Why was this Notice issued? A Court authorized this Notice because you have a right to know about the proposed Settlement of this class action and about all of your options before the Court decides whether to grant final approval of the Settlement. This Notice explains the Action, your legal rights, what benefits are available, and who can receive them. The Action is called In re Johnson Controls, Inc. Data Incident Litigation, Lead Case No. 25-cv-00955- BHL pending in the United States District Court for the Eastern District of Wisconsin. The people who filed this Action are called the “Plaintiffs” and the company they sued, Johnson Controls, Inc. (the “Defendant” or “Johnson Controls”), is called the “Defendant.” 2. What is this Action about? On or about September 24, 2023, the Defendant became aware of a Data Incident that involved the disruption of its information technology systems. The Defendant determined that an unauthorized actor accessed certain Johnson Controls systems from approximately February 1, 2023 to September 30, 2023, and potentially accessed or exfiltrated certain data from its systems, including Private Information. This Private Information consisted of some combination of Settlement Class Members’ names, Social Security numbers, dates of birth, health insurance and medical information, financial account information, government identification numbers, and biometric data. Beginning in June 2025, the Defendant began notifying potentially impacted individuals about the Data Incident. The Plaintiffs brought claims for negligence, breach of implied contract, unjust enrichment, and violations of various consumer protection statutes, among other claims. The Defendant denies all of the Plaintiffs’ claims and maintains that it did not do anything wrong. 3. What is a class action? In a class action, one or more individuals sue on behalf of other people with similar claims. These individuals who sue are known as “Class Representatives” or Plaintiffs. Together, the people included in the class action are called a “Settlement Class” or “Settlement Class Members.” One court resolves the lawsuit for all Settlement Class Members, except for those who exclude themselves (“opting out”) from a settlement. In this Settlement, the Class Representatives are Jennifer C. Gorman, Hal Bauer, Derek Hefley, Carol McKinnon, Frank Waddell, Chris Broadhead, Mohammad Asem Alkhatib, and William John Pacheco. 4. Why is there a Settlement? The Court has not decided in favor of the Plaintiffs or Defendant. The Defendant denies all claims and contends that it has not violated any laws. The Plaintiffs and Defendant agreed to a Settlement to avoid the costs and risks of a trial, and through the Settlement, Settlement Class Members are eligible to claim Settlement Class Benefits. The Plaintiffs and their attorneys, who also represent Settlement Class Members as “Class Counsel,” believe the Settlement is in the best interests of all Settlement Class Members. WHO IS IN THE SETTLEMENT? 5. Who is included in the Settlement? The Settlement Class consists of all living individuals residing in the United States who were sent notice that their Private Information may have been compromised as a result of the Data Incident. 6. Are there exceptions to being included? Yes. Excluded from the Settlement Class are all persons who are: (a) directors or officers of Defendant, and any entity in which Defendant has a controlling interest; (b) governmental entities; (c) the Judge assigned to the Action, that Judge’s immediate family, and Court staff; (d) any Settlement Class Member who timely and validly opted out of the Settlement; and (e) any person found by a court of competent jurisdiction to be Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 3 guilty under criminal law of initiating, causing, aiding or abetting the criminal activity occurrence of the Data Incident, or who pleads nolo contendere to any such charge. THE SETTLEMENT BENEFITS 7. What does the Settlement provide? If approved by the Court, the Defendant will pay $5,475,000 into a Settlement Fund to resolve the lawsuit. The Settlement Fund will provide benefits to Settlement Class Members who submit Valid Claims as well as Settlement Administration Costs and any Court-awarded Attorneys’ Fees, Costs and Service Awards to Class Representatives. Settlement Class Members may choose to receive one of the following Cash Payments:  Cash Payment A – Documented Losses: Up to $5,000 for each Settlement Class Member for documented losses related to the Data Incident. Documentation is required. OR  Cash Payment B – Alternate Cash: An alternate cash payment estimated to be $50. The payment amount will be subject to pro rata (proportional) increase or decrease based on the number of Valid Claims. In addition to Cash Payment A or Cash Payment B, Settlement Class Members may also claim two (2) years of one bureau Credit Monitoring, including real-time alerts and insurance coverage for up to $1,000,000 for identity theft. 8. Tell me more about Cash Payment A - Documented Losses. All Settlement Class Members may submit a Claim for a Cash Payment for up to $5,000 per person for documented losses related to the Data Incident. Documented Losses eligible for reimbursement under this section include, but are not limited to, the following:  Monetary losses as a result of actual identity theft if: (a) the loss is an actual, documented, and unreimbursed monetary loss; (b) the loss was fairly traceable to the Data Incident; and (c) the loss occurred between February 1, 2023, and the date you submit your Claim;  Postage;  Copying, scanning, and faxing;  Mileage and other travel-related charges;  Parking;  Notary charges;  Research charges;  Cell phone charges (only if charged by the minute);  Long-distance phone charges;  Data charges (only if charged based on the amount of data used);  Text message charges (only if charged by the message);  Bank fees; and  Professional fees, such as fees for accountants and attorneys. To receive a documented loss payment, you must select Cash Payment A on the Claim Form and attest under penalty of perjury to having incurred documented losses. You will be required to submit reasonable documentation supporting the losses. Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 4 You cannot be reimbursed for expenses if you have been reimbursed for the same expenses by another source in connection with the identity protection and credit monitoring services offered as part of the notification letter provided by Defendant or otherwise. If you do not submit reasonable documentation supporting a loss, or if your Claim is rejected by the Settlement Administrator for any reason, and you fail to cure your Cash Payment A Claim, the Claim will be converted to Cash Payment B – Alternate Cash. 9. Tell me more about Cash Payment B – Alternate Cash. In lieu of Cash Payment A – Documented Losses, Settlement Class Members may submit a Claim for Cash Payment B – Alternate Cash, which is a cash payment that does not require attestation or the submission of any supporting documentation. Cash Payment B will be a pro rata amount of the Net Settlement Fund (see Question 11). The current estimated amount is approximately $50, which could be lower or higher based on the number of Valid Claims (see Question 11). 10. Tell me more about the Credit Monitoring. In addition to Cash Payment A or Cash Payment B, Settlement Class Members may claim two years of one- bureau Credit Monitoring. The Credit Monitoring product will provide the following benefits: credit monitoring, real-time alerts, and insurance coverage for up to $1,000,000 for identity theft. This Credit Monitoring benefit is available to any Settlement Class Member regardless of whether you previously received any credit monitoring product related to the Data Incident or otherwise. 11. How will the Cash Payments be calculated? After deducting Settlement Administration Costs and any Court-approved Attorneys’ Fees, Costs, and Service Awards, the remaining balance of the Settlement Fund (the “Net Settlement Fund”) will be used to pay Valid Claims for Settlement Benefits in following order: 1) Credit Monitoring, 2) Cash Payment A – Documented Losses, and 3) Cash Payment B – Alternate Cash Payment. After paying Valid Claims for Credit Monitoring and Cash Payment A, the Cash Payment B amount will be calculated by dividing remaining balance of the Net Settlement Fund by the number of Valid Claims. 12. What claims am I releasing if I stay in the Settlement? Unless you opt out of the Settlement, you cannot sue, continue to sue, or be part of any other lawsuit against the Defendant about any of the legal claims this Settlement resolves. The Releases section in the Settlement Agreement describes the legal claims that you give up if you remain in the Settlement Class. The Settlement Agreement can be found at www.johnsoncontrolsdatasettlement.com. HOW TO GET SETTLEMENT BENEFITS – MAKING A CLAIM 13. How do I submit a Claim Form to get Settlement Benefits? You must submit a Claim Form by February 1, 2027 to receive Settlement Benefits. Claim Forms may be submitted online at www.johnsoncontrolsdatasettlement.com by 11:59 p.m. PT, or mailed postmarked by February 1, 2027 to the Settlement Administrator at: In re Johnson Controls, Inc. Data Incident Litigation c/o Kroll Settlement Administration LLC ATTN: Claims P.O. Box 5324 New York, NY 10150- 5324 14. When will I get Settlement Benefits? The short answer is – after the Settlement is “finally approved” and any challenges to that approval are finally resolved. The Court is scheduled to hold a Final Approval Hearing on January 15, 2027, to decide Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 5 whether to approve the Settlement, Class Counsel’s request for attorneys’ fees and costs, and the Service Awards to the Class Representatives who brought this Action on behalf of the Settlement Class. If the Court approves the Settlement, there may be appeals. It is always uncertain whether appeals will be filed and, if so, how long it will take to resolve them. Settlement Benefits will be distributed as soon as possible, if and when the Court grants Final Approval of the Settlement and after any appeals are resolved. THE LAWYERS REPRESENTING YOU 15. Do I have a lawyer in this case? Yes, the Court appointed Raina Borrelli of Strauss Borrelli PLLC, Jeff Ostrow of Kopelowitz Ostrow, Gary Klinger of Milberg PLLC, and Kevin Laukaitis of Laukaitis Law, LLC to represent you and other members of the Settlement Class as Class Counsel. You will not be charged directly for these lawyers; instead, they will receive compensation from the Settlement Fund (subject to Court approval). 16. Should I get my own lawyer? It is not necessary for you to hire your own lawyer because Class Counsel works for you. If you want to be represented by your own lawyer, you may hire one at your own expense. 17. How will the lawyers be paid? Class Counsel will ask the Court to approve attorneys’ fees up to one-third of the Settlement Fund ($1,825,000) plus reimbursement of reasonable costs, as well as a $4,000 Service Award to each of the eight Class Representatives. If approved, these amounts will be paid from the Settlement Fund before making payments to Settlement Class Members who submit Valid Claims. EXCLUDING YOURSELF FROM THE SETTLEMENT 18. How do I opt out of the Settlement? If you do not want to receive any benefits from the Settlement, and you want to keep your right to separately sue the Defendant about the legal issues in this case, you must take steps to exclude yourself from the Settlement Class. This is called “opting out” of the Settlement Class. To exclude yourself from the Settlement, you must submit a written request to opt out to the Settlement Administrator that includes the following information:  Your full name, current address, telephone number, and email address (if any);  A statement indicating your intent to request exclusion “I wish to opt out of the Settlement Class in In re Johnson Controls Inc. Data Incident Litigation, Lead Case No. 25-cv-00955-BHL.”;  Your personal signature. Your request for exclusion must be mailed to the Settlement Administrator at the address below, postmarked no later than January 4, 2027. In re Johnson Controls, Inc. Data Incident Litigation c/o Kroll Settlement Administration LLC ATTN: Requests to Opt Out P.O. Box 5324 New York, NY 10150- 5324 You may only exclude yourself from the Settlement Class. No group or class requests to opt out or requests to opt out by a third party are permitted under the Settlement Agreement unless they include the required information for every Settlement Class Members and are personally and individually signed by each Settlement Class Member. Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 6 OBJECTING TO THE SETTLEMENT 19. How do I tell the Court if I do not like the Settlement? If you are a Settlement Class Member, you can choose (but are not required) to object to the Settlement if you do not like it or a portion of it, whether that be to the Settlement Benefits, request for Attorneys’ Fees and Costs, or Service Awards, Releases provided to the Defendant, or some other aspect of the Settlement. Through an objection, you give reasons why you think the Court should not approve the Settlement. To be considered by the Court, your objection must include:  The case name and number, In re Johnson Controls Inc. Data Incident Litigation, Lead Case No. 25-cv-00955-BHL;  Your full name, mailing address, telephone number, and email address (if any);  All grounds for the objection, accompanied by any legal support for the objection known to you or your counsel;  The number of times you have objected to a class action settlement within the five (5) years preceding the date that you file your objection, the caption of each case in which you have objected, and a copy of any orders related to or ruling upon your prior objections that were issued by the trial and appellate courts in each listed case;  The identity of all counsel who represent you, including any former or current counsel who may be entitled to compensation for any reason related to the objection to the Settlement and/or Application for Attorneys’ Fees, Costs, and Service Award;  The number of times in which your counsel and/or their law firm have objected to a class action settlement within the five (5) years preceding the date of the filed objection, the caption of each case in which your counsel or their firm objected and a copy of any orders related to or ruling upon their prior objections that were issued by the trial and appellate courts in each listed case in which they have objected to a class action settlement within the preceding five (5) years;  A statement disclosing whether you or your counsel used Artificial Intelligence to assist in drafting your objection and what platform you used;  The identity of all counsel (if any) representing you, and whether they will appear at the Final Approval Hearing;  A list of all persons who will be called to testify at the Final Approval Hearing in support of the objection (if any);  A statement confirming whether you intend to personally appear and/or testify at the Final Approval Hearing; and  Your signature (an attorney’s signature is not sufficient). Objections must be filed with the Court no later than January 4, 2027. Clerk of the Court United States District Court for the Eastern District of Wisconsin 517 E. Wisconsin Ave., Milwaukee, WI 53202 A copy of your objection also must be sent to Class Counsel, Defendant’s Counsel, and the Settlement Administrator by mail or courier at the addresses below, with a postmark or shipping date no later than January 4, 2027. Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 7 SETTLEMENT CLASS COUNSEL DEFENDANT’S COUNSEL ADMINISTRATOR Raina Borrelli Jeffrey D. Coren In re Johnson Controls Inc. Strauss Borrelli PLLC Ogletree Deakins Data Incident Litigation 980 N. Michigan Ave., Suite Seneca One Tower c/o Kroll Settlement 1610 1 Seneca Street, Suite 1075 Administration LLC Chicago, IL 60611 Buffalo, NY 14203 ATTN: Objections PO Box 5324 New York, NY 10150-5324 20. What is the difference between objecting and opting out? Objecting is telling the Court that you do not like something about the Settlement. You can object to the Settlement only if you do not exclude yourself from it. Excluding yourself from the Settlement means telling the Court you do not want to be part of the Settlement. If you exclude yourself or opt out of the Settlement, you cannot object to it because the Settlement no longer affects you. THE COURT’S FINAL APPROVAL HEARING 21. When is the Court’s Final Approval Hearing? The Court is scheduled to hold a Final Approval Hearing on January 15, 2027 at 9:30 a.m. CT, via telephonic hearing, to decide whether to approve the Settlement, Class Counsel’s request for Attorneys’ Fees of $1,825,000, plus reasonable costs, and a $4,000 Service Award to the each of the Class Representatives who brought this Action on behalf of the Settlement Class. The date and time of this hearing may change without further notice. Please check www.johnsoncontrolsdatasettlement.com for updates. 22. Do I have to come to the Final Approval Hearing? No. Class Counsel will answer any questions the Court may have. You may attend at your own expense. If you file an objection, you may, but you do not have to, come to the Final Approval Hearing to talk about it. If you file your written objection on time and in accordance with the requirements above, the Court will consider it. You may also pay your own lawyer to attend, but it is not necessary. IF YOU DO NOTHING 23. What happens if I do nothing at all? If you are a Settlement Class Member and you do nothing, you will give up your right to start a lawsuit, continue a lawsuit, or be part of any other lawsuit against the Defendant and the Released Parties, as defined in the Settlement Agreement, about the legal issues resolved by this Settlement. In addition, you will be bound by the Releases in the Settlement and will not be eligible to receive any Settlement Benefits. GETTING MORE INFORMATION 24. How do I get more information? This Notice summarizes the proposed Settlement. Complete details are provided in the Settlement Agreement. The Settlement Agreement and other related documents are available at the Settlement Website, www.johnsoncontrolsdatasettlement.com. If you have additional questions or need to update your address, you may contact the Settlement Administrator by telephone at (833)453-2575, or by mail at: In re Johnson Controls, Inc. Data Incident Litigation c/o Kroll Settlement Administration LLC P.O. Box 5324 New York, NY 10150-5324 Questions? Call (833)453-2575 or visit www.johnsoncontrolsdatasettlement.com. 8