What happened
Clorox suffered an August 2023 cyberattack that halted manufacturing and caused widespread product shortages. In a July 2025 lawsuit against IT services provider Cognizant, Clorox alleged the attackers simply telephoned the outsourced service desk, impersonated Clorox employees, and were given password and multifactor resets without any identity verification. Clorox is seeking $380 million in damages; Cognizant disputes the claims.
How the deception worked
According to the complaint, the attacker called the Cognizant-run service desk multiple times claiming to be a Clorox employee and asked for a password reset. The agent reset the credential and the multifactor enrolment without confirming the caller's identity, and transcripts quoted in the filing show no verification step took place. The attacker used the same technique against a Clorox IT security employee, which yielded privileged network access. From there the intrusion progressed to network-wide disruption; Clorox took systems offline, reverted to manual order processing, and saw sales and shipments fall for months afterwards.
AI involvement · No AI reported
No AI element reported; the complaint describes live phone calls.
The control that would have caught it· our reading, not a claim from the sources
Outsourced service desks need contractually mandated, auditable identity proofing before any credential or MFA reset, with higher-assurance checks for accounts holding privileged access.
Sources (5)
- Hackers fooled Cognizant help desk, says Clorox in $380M cyberattack lawsuitBleepingComputer·bleepingcomputer.comOpen ↗
- Clorox lawsuit says help-desk contractors handed over passwords in 2023 cyberattackThe Record·therecord.mediaOpen ↗
- Clorox files $380 million suit blaming Cognizant for 2023 cyberattackCybersecurity Dive·cybersecuritydive.comOpen ↗
- $380M lawsuit: intruder got Clorox's passwords from Cognizant simply by askingThe Register·theregister.comOpen ↗
- Clorox estimates the costs of the August cyberattack will exceed $49 MillionSecurity Affairs·securityaffairs.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.