Consumer goods · 2023
Clorox: a cyberattack disrupted shipments
The help desk handed the password to whoever called.
What happened
In August 2023, Clorox detected unauthorized activity and took systems offline. Order processing moved to manual procedures, shipments fell below normal levels and product availability was affected for months. Clorox later reported material operational and financial damage.
A 2025 lawsuit filed by Clorox describes how callers impersonated employees and persuaded its outsourced help desk to reset passwords and multi-factor authentication without proper identity checks, including for a privileged security account. With valid credentials and a new second factor, the attackers gained trusted access to the corporate environment. Clorox is seeking $380M from Cognizant and cites more than $49M in response costs; Cognizant disputes responsibility. The social-engineering method closely resembles tactics associated with Scattered Spider.
What would have changed it
A reset process is an access-control system, even when a supplier answers the phone. We test identity verification, privileged-account recovery and third-party responsibilities end to end.