Clorox is seeking about $380 million from Cognizant in a lawsuit over an August 2023 cyberattack. Clorox alleges that Cognizant-operated helpdesk agents reset employee credentials and multifactor authentication (MFA) without the identity checks required by their procedures, helping an attacker access its network. Cognizant disputes Clorox’s account and says it provided a limited helpdesk service, not cybersecurity management. The $380 million is Clorox’s claimed damages—not a court award.
What happened in the Clorox cyberattack?
Clorox’s complaint alleges that on August 11, 2023, a cybercriminal called a Cognizant-operated service desk and requested account credentials and MFA resets. Clorox says agents granted the requests without adequate identity verification, including after repeat requests. Those details are allegations in the complaint, not findings that a court has established. Read Clorox’s complaint.
What verification process does Clorox say should have been followed?
Clorox says callers seeking account help should have been directed to MyID, a verification and self-reset tool. If MyID was unavailable, its complaint says agents were supposed to verify the employee’s identity using employee information before changing credentials. Clorox alleges the service desk did not follow those steps. Ars Technica’s account of the alleged process also describes MyID and the alternate verification procedure.
Clorox says the incident disrupted operations, damaged IT infrastructure, and forced workarounds. The Record, from Recorded Future News, reported that Clorox said sales volume was 6% lower over the six months after the attack because shipments were reduced. That figure is attributed to the outlet’s reporting on Clorox’s disclosures; it does not by itself establish how much of the decline is legally attributable to Cognizant.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Did Cognizant give hackers Clorox passwords?
That is Clorox’s allegation in substance, but it is not an adjudicated fact. Clorox says Cognizant’s service desk reset credentials and MFA without the required checks, enabling the attacker’s access. The complaint is evidence of what Clorox claims; it does not prove that the alleged call handling occurred as described or establish that it caused all the losses Clorox attributes to the incident.
Cognizant’s reported response is that it performed a narrow helpdesk role and reasonably carried out that work, and that it did not manage Clorox’s broader cybersecurity. The company has also criticized Clorox’s internal security and mitigation, according to The Record. The central dispute is whether the helpdesk’s contractual responsibilities and its handling of the requests make Cognizant legally responsible for the attack-related losses.
How much is Clorox seeking from Cognizant?
Clorox’s 2025 complaint claims approximately $380 million in damages, including more than $49 million in remediation costs. These are amounts Clorox says it incurred or lost; they are not damages awarded by a judge. The complaint attributes the claimed losses to remediation and business interruption.
The Record reported that Clorox had received $100 million in insurance recoveries related to the attack. That reported recovery should not be subtracted from the lawsuit demand as if the two figures were directly comparable: the available reporting does not establish how insurance proceeds interact with Clorox’s damages calculation.
Rank #3
Why is Clorox suing Cognizant?
Clorox filed suit against Cognizant-related entities in Alameda County Superior Court in July 2025. The complaint brings claims for breach of contract, breach of the implied covenant of good faith and fair dealing, gross negligence, and intentional misrepresentation. Clorox alleges that Cognizant failed to follow agreed credential-support procedures and later impeded Clorox’s response.
The parties describe the service relationship differently. Clorox’s position is that Cognizant had critical responsibilities for safeguarding access to Clorox systems and failed to meet them. Cognizant says its assignment was limited to helpdesk services and did not include managing the company’s cybersecurity. A court will have to resolve the relevant contractual duties and the parties’ responsibility; the allegations alone do not settle that dispute.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is the status of the Clorox Cognizant lawsuit?
As of the latest procedural report cited here, dated March 25, 2026, a California judge dismissed Clorox’s intentional misrepresentation claim while allowing the bulk of the case to proceed, according to Law360. The report does not establish a final ruling on liability or damages. It also does not establish a settlement, trial date, or later final judgment.
Accordingly, the case has not been shown by these reports to be resolved. Clorox’s remaining claims still concern disputed allegations, and the $380 million figure remains the company’s claimed amount rather than a court-approved recovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
