Johnson Controls: Data Breach Doesn’t Affect Our Moat Rating or Fair Value Estimate

After market close on Sept. 27, Johnson Controls JCI issued a Form 8-K filing disclosing that a cybersecurity incident had disrupted the firm’s internal information technology systems. The stock price declined approximately 2.5% on Sept. 28 in reaction to the news. According to an article published by Bleeping Computer, a ransomware attack originating in Johnson Controls’ Asia offices spread to broader IT applications. However, Johnson Controls said that much of the firm’s IT infrastructure is unaffected. That said, it seems to us that the company’s financial reporting systems could be affected because the filing warned that this incident could delay the release of its fiscal fourth-quarter financial results. We currently don’t believe this incident will materially affect Johnson Controls’ customers, but mitigating the issue will certainly be an added (and unanticipated) expense, although such costs may be covered by insurance policies. We will maintain our near-term financial projections until we learn more about any fallout from this incident, likely during the firm’s upcoming fiscal fourth-quarter earnings call. Furthermore, we’re also maintaining our narrow moat rating and $72 per share fair value estimate. This cybersecurity incident will certainly be a near-term headache for Johnson Controls, but we don’t think it will affect our long-term outlook.