Overview

• Clorox filed suit July 22 in Alameda County Superior Court, alleging Cognizant’s negligence and breach of contract worsened the August 2023 cyberattack.
• The complaint says Scattered Spider hackers obtained network credentials by calling the Cognizant service desk and requesting password resets without identity checks.
• Partial call transcripts included in the lawsuit show support agents complying with multiple password-reset requests without verifying the callers’ identities.
• Clorox claims the breach and a botched cleanup—failing to deactivate compromised accounts and restore data—led to $380 million in remediation costs and shipment delays.
• Cognizant has rejected fault, stating its contract covered only help-desk support and that Clorox retained responsibility for broader cybersecurity measures.