Clorox Help-Desk Vishing Hack (2023): Five Calls, Two Accounts, and a $380M Claim

The five calls described in Clorox's complaint

Clorox filed the complaint on July 22, 2025, in Alameda County's branch of the Superior Court of California. It quotes from recordings of the service-desk calls themselves. Everything below comes from that complaint. It's Clorox's side of the story, not something a court has found.

The excerpts are striking for how little effort the caller needed. No emergency, no dropping an executive's name. Just an everyday story about being locked out. On the first call the agent replied, "So let me provide the password to you ok?" and read out a password beginning with "Welcome."

Nobody on the desk asked why one employee kept needing resets so close together, according to the complaint. And the agent handling the Employee 1 calls never sent the confirmation emails to the employee and their manager that Clorox's procedure called for.

How a password reset turned into network access

Help-desk vishing is a con where someone rings the IT support line, claims to be an employee, and talks the agent into resetting their credentials or MFA. Here's how the Clorox intrusion played out, in six stages.

1. Reconnaissance. The attacker already knew real Clorox employees' names and which vendor ran the service desk. How they knew isn't in the complaint. Press coverage blames Scattered Spider, a group that's known for researching staff before picking up the phone.
2. Pretext. The caller played a locked-out employee, about the most routine request a service desk gets. This is pretexting at its simplest. A believable name, a believable reason, and nothing else.
3. Initial contact. The call went straight to the Cognizant-run desk. It's a form of vishing aimed at IT support rather than at the employee being impersonated.
4. Access. Agents reset the Okta password and Microsoft MFA, then changed the SMS-MFA phone number. The caller now held both factors, the core of help-desk MFA manipulation.
5. Escalation. Once inside, the attacker picked out a second, more privileged target in Clorox's IT security group and made the same calls again. That second account takeover gave wider reach.
6. Impact. With two accounts in hand, the intruder could roam the network. Clorox's response was to pull systems offline and pause manufacturing. For a while, orders were processed by hand. One thing's missing from the complaint, though: the words ransom, extortion, and exfiltration never appear.

Clorox cyberattack timeline, 2023 to 2026

$380 million, $59 million, or $29 million? What the Clorox hack cost

You'll see three different figures quoted, and each measures something else. Here they are, with what each one is based on.

Because they're built on different bases, don't add them together or net one against another. Most of the $380 million claim is business interruption, which turns up as lost sales, not as a cost line.

Some widely shared coverage treats the claim as if it were the cost of the attack. Ars Technica headlined its story "After $380M hack." Nothing in Clorox's own filings comes close to that amount.

The second allegation: a slow incident response

Most summaries stop at the reset calls. The second half of the complaint is about what happened after the intrusion was spotted, and for incident-response planners it's the more useful part. Cognizant disputes every point.

• Cognizant allegedly took over an hour to reinstall a security tool the intruder had removed, a task Clorox says should take under 15 minutes.
• It allegedly took its time shutting down an account Clorox had flagged, and the intruder used that account to escalate.
• It allegedly handed over the wrong list of managed IP addresses, which held up one containment step by eight hours.
• Clorox says Cognizant could not restore databases it had supported for years and had not kept application documentation, so Clorox brought in another vendor.

By Clorox's account, it spotted the intrusion within roughly three hours and had the attacker out within five days. Whoever turns out to be right, there's a planning lesson here. The vendor running your front door is often the one you'll need to reach at night to shut it.

Where the Clorox Cognizant lawsuit stands

Clorox pleaded four causes of action: breach of contract, breach of the covenant of good faith and fair dealing, gross negligence, and intentional misrepresentation. In a statement to reporters, Cognizant's chief communications officer said "Cognizant did not manage cybersecurity for Clorox." Its argument is that it was hired for a narrow slice of help-desk work.

The March 25, 2026 ruling threw out the misrepresentation claim and kept the other three alive. According to the Hunton Andrews Kurth analysis, the court treated credential handling and MFA management as critical security functions rather than low-level administrative tasks. As of September 1, 2026, there's been no finding of liability, no damages award, and no settlement or trial date made public.

What would have stopped the Clorox calls

Every stage of the chain had a control that could have broken it. Several were already written into Clorox's own procedure.

Switching to phishing-resistant MFA (FIDO2) only helps if enrolling a replacement key takes the same proof of identity as the first enrollment did. If it doesn't, the reset path is still the weakest point.

Lessons from the Clorox breach, by team

Security and identity teams

Every credential or MFA reset is a security event. Don't let it disappear into the ticket queue. If an account gets a password reset, an MFA reset, and a new phone number on the same day, someone should be alerted.

Service-desk staff and their managers

Score agents on how well they check who's calling, not just on how fast they close the call. An agent who volunteers to reset "two MFA applications" is following a speed incentive, not a security one.

Procurement and vendor management

Reset procedures, incident-response timelines, and audit rights belong in the outsourcing contract itself. As the Clorox ruling shows, what's carved out of a liability cap can matter as much as the cap does.

Security awareness trainers

The published transcript excerpts make good service-desk training material. They show that the dangerous call is the dull one, a lockout with no drama at all. The same pattern appears at MGM Resorts, at Caesars Entertainment, and in the 2020 Twitter phone-phishing breach.

What is still unknown about the Clorox hack

• How the attacker knew which employees to impersonate. The complaint doesn't say.
• Who was behind it. Reporters point to Scattered Spider. The complaint doesn't name any group.
• Whether data was taken or a ransom demanded. Neither the complaint nor the SEC filings will say.
• Where the service desk was staffed. The complaint names defendant entities registered in London and in Teaneck, New Jersey, but not the desk's location.
• How the lawsuit ends. As of September 1, 2026, nobody had reported a settlement, a trial date, or a judgment.

Clorox hack: common questions

Reviewed by SEE Team. Last reviewed: 2026-10-19. Read how cases are sourced and checked in our methodology, or learn who publishes this library.