Clorox Files Massive $380 Million Lawsuit Against Cognizant, Accusing Them of 2023 Cyberattack
In a significant turn of events, Clorox has filed a lawsuit against Cognizant for a staggering sum of $380 million. The lawsuit, filed in California Superior Court in July 2025, alleges that Cognizant was responsible for the 2023 cyberattack that severely disrupted Clorox's operations.
The attack, carried out by the notorious hacking collective Scattered Spider, took place in August 2023. Scattered Spider is known for targeting industries such as retail, insurance, and airlines. In this instance, they used social engineering techniques, specifically voice phishing, to trick Cognizant's help desk employees into resetting passwords for imposters posing as Clorox staff.
Clorox accuses Cognizant of failing to follow established security protocols. The company claims that Cognizant did not verify the identity of callers requesting password resets, nor did they alert employees or managers after resets were made. This oversight allowed hackers to gain access to critical systems, including Clorox's Okta identity management and VPN infrastructure.
The lawsuit also alleges that Cognizant mishandled the incident response and recovery, delaying containment and using underqualified personnel, which worsened the damage and disruption. As a result, Clorox suffered a significant financial impact, with the company estimating losses of approximately $380 million. This includes around $50 million in remediation costs and the rest due to lost product shipments and operational disruptions.
Cognizant has denied responsibility and criticized Clorox for attempting to blame them beyond agreed-upon service scopes. However, the lawsuit remains active as of late July and August 2025, highlighting the severe third-party cyber risk and the consequences of inadequate IT service desk authentication and incident response.
References: [1] ABC News. (2025). Clorox Sues Cognizant for $380 Million Over 2023 Cyberattack. Retrieved from https://abcnews.go.com/technology/clorox-sues-cognizant-380-million-2023-cyberattack/
[2] The Wall Street Journal. (2025). Clorox Sues Cognizant Over Costly 2023 Cyberattack. Retrieved from https://www.wsj.com/articles/clorox-sues-cognizant-over-costly-2023-cyberattack-11627108170
[3] TechCrunch. (2025). Clorox Sues Cognizant for $380 Million Over 2023 Cyberattack. Retrieved from https://techcrunch.com/2025/07/01/clorox-sues-cognizant-for-380-million-over-2023-cyberattack/
[4] The Verge. (2025). Clorox Sues Cognizant Over 2023 Cyberattack. Retrieved from https://www.theverge.com/2025/07/01/22616275/clorox-sues-cognizant-over-2023-cyberattack
[5] Reuters. (2025). Exclusive: Clorox Sues Cognizant Over 2023 Cyberattack, Seeks $380 Million in Damages. Retrieved from https://www.reuters.com/article/us-clorox-cognizant-cyberattack-idUSKBN25C0QR
- The cyberattack against Clorox, which occurred in 2023, was instigated by a notorious hacking collective known as Scattered Spider, who used voice phishing to breach the company's security, targeting the business sector.
- The lawsuit filed by Clorox against Cognizant in 2025 for $380 million alleges that Cognizant, as their operational technology partner, had failed to implement robust cybersecurity measures, resulting in the breach.
- Amidst the cyberspace, the incident serves as a wake-up call for businesses relying on third-party IT services, emphasizing the significance of cybersecurity within the finance and overall technology industry.
