Clorox lawsuit says hackers got passwords simply – Business News
Bleach maker Clorox stated Tuesday that it has sued data technology supplier Cognizant over a devastating 2023 cyberattack, alleging that the hackers pulled off the intrusion simply by asking the tech company’s employees for workers’ passwords.
Clorox was one of a number of main firms hit in August 2023 by the hacking group dubbed Scattered Spider, which makes a speciality of tricking IT help desks into handing over credentials after which utilizing that entry to lock them up for ransom.
The group is commonly described as unusually refined and chronic, however in a case filed in California state court docket on Tuesday, Clorox stated one of Scattered Spider’s hackers was in a position to repeatedly steal workers’ passwords simply by asking for them.
Clorox was one of a number of main firms hit in August 2023 by the hacking group dubbed Scattered Spider. AP
“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” in accordance with a copy of the lawsuit reviewed by Reuters. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over.”
Cognizant didn’t instantly return a message in search of touch upon the go well with, which was not instantly seen on the public docket of the Superior Court of Alameda County. Clorox offered Reuters with a receipt for the lawsuit from the court docket.
Three partial transcripts included within the lawsuit allegedly show conversations between the hacker and Cognizant assist employees during which the intruder asks to have passwords reset and the assist employees complies with out verifying who they’re speaking to, for instance by quizzing them on their worker identification quantity or their supervisor’s identify.
“I don’t have a password, so I can’t connect,” the hacker says in a single call. The agent replies, “Oh, ok. Ok. So let me provide the password to you ok?”
The 2023 hack triggered $380 million in damages, Clorox stated within the go well with, about $50 million of which had been tied to remedial prices and the remainder of which had been attributable to Clorox’s lack of ability to ship merchandise to retailers within the wake of the hack.
Clorox stated the clean-up was hampered by different failures by Cognizant’s employees, together with failure to de-activate sure accounts or correctly restore information.
