{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-clorox-attack-traced-to-help-desk-agents-resetting-passwords-without-ver"},"incident":{"title":"Clorox attack traced to help desk agents resetting passwords without verification","date":"2023-08-11","date_precision":"day","victim_org":"The Clorox Company","sector":"Manufacturing","country":"United States","primary_vector":"Help Desk Impersonation","secondary_vectors":["Vishing (Voice Phishing)","Vendor / Supply Chain Impersonation"],"ai_involvement":"No AI reported","ai_notes":"No AI element reported; the complaint describes live phone calls.","outcomes":["Ransomware Deployment","Service Disruption","Data Breach","Wire Fraud / Financial Loss"],"loss_usd":380000000,"loss_note":"$380 million is the total damages Clorox sought in its 2025 lawsuit against Cognizant, including about $49 million in direct remediation costs; it is a litigation claim, not an adjudicated loss.","records_affected":null,"threat_actor":"Scattered Spider","summary":"Clorox suffered an August 2023 cyberattack that halted manufacturing and caused widespread product shortages. In a July 2025 lawsuit against IT services provider Cognizant, Clorox alleged the attackers simply telephoned the outsourced service desk, impersonated Clorox employees, and were given password and multifactor resets without any identity verification. Clorox is seeking $380 million in damages; Cognizant disputes the claims.","how_it_worked":"According to the complaint, the attacker called the Cognizant-run service desk multiple times claiming to be a Clorox employee and asked for a password reset. The agent reset the credential and the multifactor enrolment without confirming the caller's identity, and transcripts quoted in the filing show no verification step took place. The attacker used the same technique against a Clorox IT security employee, which yielded privileged network access. From there the intrusion progressed to network-wide disruption; Clorox took systems offline, reverted to manual order processing, and saw sales and shipments fall for months afterwards.","lessons":"Outsourced service desks need contractually mandated, auditable identity proofing before any credential or MFA reset, with higher-assurance checks for accounts holding privileged access.","confidence":"Confirmed","sources":[{"title":"Hackers fooled Cognizant help desk, says Clorox in $380M cyberattack lawsuit","url":"https://www.bleepingcomputer.com/news/security/hackers-fooled-cognizant-help-desk-says-clorox-in-380m-cyberattack-lawsuit/","publisher":"BleepingComputer"},{"title":"Clorox lawsuit says help-desk contractors handed over passwords in 2023 cyberattack","url":"https://therecord.media/clorox-cyberattack-lawsuit-cognizant-it-contractor","publisher":"The Record"},{"title":"Clorox files $380 million suit blaming Cognizant for 2023 cyberattack","url":"https://www.cybersecuritydive.com/news/clorox-380-million-suit-cognizant-cyberattack/753837/","publisher":"Cybersecurity Dive"},{"title":"$380M lawsuit: intruder got Clorox's passwords from Cognizant simply by asking","url":"https://www.theregister.com/2025/07/23/lawsuit_clorox_vs_cognizant/","publisher":"The Register"},{"title":"Clorox estimates the costs of the August cyberattack will exceed $49 Million","url":"https://securityaffairs.com/158575/security/clorox-attack-costs-exceed-49m.html","publisher":"Security Affairs"}],"entry_type":"incident","slug":"2023-clorox-attack-traced-to-help-desk-agents-resetting-passwords-without-ver","year":2023,"loss_kind":"business_impact","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-clorox-attack-traced-to-help-desk-agents-resetting-passwords-without-ver"}}