Clorox Sues Cognizant Over 2023 Cyberattack Escalation

Clorox has filed a $380 million lawsuit against IT services provider Cognizant in California, alleging that a major 2023 cyberattack resulted from Cognizant staff providing employee passwords to hackers without proper verification. The attackers, identified as the Scattered Spider group, exploited weak verification protocols by obtaining credentials through simple help desk calls. Clorox claims Cognizant ignored updated credential support protocols and failed to deactivate compromised accounts or restore data, thereby exacerbating the breach’s impact. The incident caused $50 million in remediation costs and significant operational losses due to disrupted shipments. Cognizant denies responsibility, stating its role was limited to help desk support and did not include managing Clorox’s cybersecurity. The case underscores the risks of inadequate IT support verification and social engineering threats.