Clorox blames Cognizant for cyberattack, sues for $380M over alleged password reset fail

Clorox has filed a lawsuit against Cognizant, seeking $380 million in damages after claiming that the IT services provider failed to properly authenticate employee login requests, which led to a major cyberattack. This incident, which occurred in August 2023, allegedly allowed a cybercriminal to infiltrate Clorox's network by posing as an employee and requesting a password reset over the phone. According to the complaint submitted in a U.S. court, Clorox asserts that Cognizant's service desk neglected fundamental authentication protocols, enabling unauthorized access. The purported breach resulted in extensive operational disruptions for Clorox, with the company stating, "The resulting cyberattack was debilitating. It paralyzed Clorox’s corporate network and crippled business operations." The lawsuit outlines damages estimated at $380 million, which includes over $49 million spent on remediation efforts and significant revenue losses due to disrupted shipments and empty store shelves. Clorox and Cognizant have had a professional relationship since 2013, focusing on service desk and identity management. In its allegations, Clorox accuses Cognizant not only of facilitating the breach but also of mishandling the subsequent fallout. "Cognizant botched its response and compounded the damage it already caused," the company noted in its filing. The hacker reportedly made two calls impersonating a Clorox employee, with the second call involving a claim of VPN access issues that led to a password reset being performed without proper verification, directly violating Clorox's security protocols. A spokesperson for Cognizant responded to the allegations by stating to the Times of India, "It is shocking that a corporation the size of Clorox had such an inept internal cybersecurity system. Clorox hired Cognizant for a narrow scope of help desk services, which we reasonably performed. Cognizant did not manage cybersecurity for Clorox." This legal dispute highlights the significant challenges and responsibilities that come with cybersecurity in an increasingly digital world, pitting one of America's beloved consumer brands against a major player in the IT sector.