Clorox hacked via a single phone call: Support staff gave away password and disabled MFA

The Unbelievable Simplicity of the Clorox Breach

In a stark reminder that even the most sophisticated digital defenses can crumble under the weight of human fallibility, consumer goods giant Clorox fell victim to a devastating cyberattack in 2023, orchestrated not by a legion of elite hackers, but by a single, surprisingly effective phone call. This incident, which led to a staggering $380 million loss and the temporary layoff of 700 employees, highlights a gaping vulnerability in corporate cybersecurity: the human element.

A Single Call, A Cascade of Catastrophe

The ease with which attackers breached Clorox's systems is almost comical, if it weren't for the severe consequences. The perpetrators, rather than employing complex exploits or intricate social engineering, simply dialed into the company's outsourced IT support, provided by Cognizant. Posing as a disgruntled Clorox employee unable to access their account, the attacker's request was met with alarming credulity.

"Cognizant was not tricked by elaborate ploys or sophisticated hacking methods," the lawsuit states. "The cybercriminal simply called and asked for credentials to access the Clorox network, which he was immediately provided with, without any authentication questions."

The support staff, shockingly, divulged the password without any verification of the caller's identity. This initial breach, described as a critical information leak, was just the beginning. The attacker, now armed with network access, escalated their demands. They requested the disabling of multi-factor authentication (MFA) on corporate Okta and Microsoft accounts, citing issues with their old phone.

The audacity of the request was matched only by the support team's compliance. The dialogue, as revealed in the lawsuit, is a chilling testament to the breakdown of security protocols:

Hacker: "I don't have a password, so I can't connect."
Support: "Okay, I can give you the password?"
Hacker: "Yes, what's the password?"
Support: "Just a moment. So, it starts with..."
Following this, the hacker asked, "My Microsoft multi-factor authentication isn't working. Can you turn it off? It's on my old phone... ." The support representative obliged, responding, "Thank you for waiting, Alex. Multi-factor authentication is disabled. Check if you can log in." The hacker confirmed, "Okay. I can log in now. Thank you."

A Pattern of Complacency, A Devastating Replay

The following day, the same charade was repeated. This time, the cybercriminal impersonated a member of Clorox's own information security team. The tactic, disturbingly, proved effective once more. Another support agent readily reset the password, which was revealed to be the laughably weak "Clorox@123". This simple password, coupled with the disabled MFA, effectively handed the keys to the kingdom to the attackers.

The Aftermath: Millions Lost, Lessons Learned (Hopefully)

With unchecked access, the cybercriminals infiltrated Clorox's systems, deploying malware and exfiltrating sensitive corporate data. The fallout was immediate and severe, leading to a complete halt in production and significant disruptions to the company's logistics. The financial repercussions were colossal, with Clorox estimating the damage at a staggering $380 million. This is the sum the company is now attempting to recover from Cognizant.

Cognizant, however, vehemently denies responsibility. Their spokesperson stated, "It's shocking that a corporation like Clorox had such a clueless internal cybersecurity system to counter an attack. They are trying to blame us for these failures, but in reality, Cognizant was hired for a narrow scope of support services, which the company reasonably performed. Cognizant was not responsible for Clorox's cybersecurity."

This incident serves as a potent, albeit painful, case study in the critical importance of robust cybersecurity awareness training. It underscores that even the most advanced technological safeguards are rendered obsolete if the human gatekeepers are not adequately trained to identify and resist social engineering tactics. The case of Clorox is a stark reminder that in the digital battleground, the weakest link is often not the code, but the person behind the keyboard.