Clorox intrusion after outsourced help desk reset passwords and MFA
Clorox disclosed in an August 14, 2023 8-K that an attack had damaged parts of its IT infrastructure, causing widescale disruption and product shortages. In its July 2025 lawsuit, Clorox alleges an attacker posing as an employee called the Cognizant-run service desk and was given password and MFA resets without identity verification, citing call transcripts. Press coverage of the suit tied the attack to Scattered Spider.
- Victim
- The Clorox Company
- Industry
- Manufacturing
- Country
- United States
- Intrusion began
- Aug 2023
- First disclosed
- Aug 14, 2023
- Actor
- Scattered Spider (Extortion group)
- Initial access
- Help desk social engineering
- Identity control that failed
- Identity lifecycle
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Damages Clorox claims in its July 2025 lawsuit against Cognizant (lost sales plus remediation). This is a claimed figure, not an audited cost; Clorox's FY2024 10-K reported about $29 million of incremental costs net of $30 million in insurance recoveries.
The identity lesson
The reset path is part of authentication. Requiring verified identity before any password or MFA reset, plus notifying the employee and manager on every reset, closes the route Clorox describes.
Regulatory and legal outcome
Clorox sued its help desk provider Cognizant in California state court in July 2025, seeking about $380 million; Cognizant disputes the claims.
Go deeper on SWI
Sources
- Clorox Form 8-K (cybersecurity incident), US SEC, Aug 14, 2023
- Clorox Form 10-K for fiscal 2024, US SEC, Aug 13, 2024
- Lawsuit says Clorox hackers got passwords simply by asking (Reuters), Insurance Journal, Jul 22, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Marks & Spencer ransomware attack via impersonation of a third-party user 2025 · Help desk social engineering
- Caesars Entertainment loyalty database theft via IT support vendor 2023 · Help desk social engineering
- MGM Resorts help desk social engineering and ransomware 2023 · Help desk social engineering
- Help desk resets of Okta super administrator MFA at multiple customers 2023 · Help desk social engineering
Cite this record
SWI Community Team. (2026). Clorox intrusion after outsourced help desk reset passwords and MFA. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-clorox-help-desk-password-reset/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.