Clorox files $380M lawsuit blaming Cognizant for 2023 cyberattack

Clorox on Tuesday sued Cognizant, which managed its IT help desk, alleging the company was responsible for a 2023 cyberattack that harmed Clorox’s production capability and cost the company $380 million. 

Hackers breached Clorox in August 2023 in a social-engineering attack that disrupted its IT infrastructure and its ability to ship core products, including household cleaners and other goods, for months. 

In a lawsuit filed in California Superior Court, Clorox argued that Cognizant failed to protect Clorox’s computer systems by handing over credentials to the attackers without proper authentication. Clorox also claims that Cognizant botched its response to the attack, prolonging the recovery time.

“Clorox entrusted Cognizant with the critical responsibility of safeguarding Clorox’s corporate systems — and Cognizant failed miserably,” said Mary Rose Alexander, outside counsel for The Clorox Co. and partner at Latham & Watkins. “Cognizant didn’t just drop the ball. They handed over the keys to Clorox’s corporate network to a notorious cybercriminal group in reckless disregard for Clorox’s policies and long-established cybersecurity standards. It’s all captured on call recordings, and it’s indefensible.”

Researchers have attributed the Clorox attack to Scattered Spider, a notorious hacking collective that has repeatedly struck targets in the retail, insurance and airline industries over the past several months. The group specializes in social-engineering attacks that use techniques like voice phishing to trick IT help desks into giving the hackers credentials and bypassing users’ multifactor-authentication protections. 

Cognizant criticized Clorox for the lawsuit and said questions remained about how Clorox managed its own internal cybersecurity protocols.

“It is shocking that a corporation the size of Clorox had such an inept internal cybersecurity system to mitigate this attack,” Cognizant told Cybersecurity Dive, HR Dive’s sister publication, in a statement. “Clorox has tried to blame us for these failures, but the reality is that Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed. Cognizant did not manage cybersecurity for Clorox.”