Clorox sues Cognizant for $380 mn over 2023 cyberattack; IT firm denies blame, calls claims 'shocking'

Cognizant denied any wrongdoing and pushed back against the lawsuit’s premise.

Consumer goods firm Clorox has filed a lawsuit against Cognizant Technology Solutions, seeking $380 million in damages for a 2023 cyberattack that disrupted its operations. In its filing with a US federal court, the consumer goods giant alleged that Cognizant’s mishandling of help desk support enabled hackers to breach Clorox systems by resetting employee credentials without proper verification.

The August 2023 incident forced Clorox to halt manufacturing, disrupted supply chains, and caused significant revenue losses. The company claims it incurred over $49 million in remediation expenses and sustained hundreds of millions in lost business.

Meanwhile, in a strongly worded response, Cognizant denied any wrongdoing and pushed back against the lawsuit’s premise.

“It is shocking that a corporation the size of Clorox had such an inept internal cybersecurity system to mitigate this attack,” a Cognizant spokesperson said. “Clorox has tried to blame us for these failures, but the reality is that Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed. Cognizant did not manage cybersecurity for Clorox.”

Still, several questions surrounding the breach and its aftermath remain unanswered. It is unclear why Clorox chose to file the lawsuit nearly two years after the attack, and whether that delay was due to new findings or a shift in legal strategy.

Interestingly, around the time of the incident, the company's Chief Information Security Officer, Amy Bogac, stepped down, though it has not indicated whether the move was tied to any internal lapses.

Queries sent to Cloro remained unanswered till the time of publication, the story will be updated as and when the company responds.