The IT firm Cognizant recently made the headlines after being sued for a cyberattack. This attack took place on bleach maker Clorox and took place during 2023. Cyberattacks are usually launched due to a myriad of reasons. The attack itself is also usually launched onto a chosen target and executed by means of specific tactics. The logic behind these can be anything such as financial gain or even data theft.
A compromise for Clorox
Bleach maker Clorox CLX.N said Tuesday that it has sued information technology provider Cognizant CTSH.O over a devastating 2023 cyberattack, alleging the hackers gained access by asking the tech company’s staff for its employees‘ passwords. Clorox was one of several major companies hit in August 2023 by the hacking group dubbed Scattered Spider, which specializes in tricking IT help desks into handing over credentials and then using that access to lock them up for ransom.
Scattered Spider is also known as UNC3944. This cybercriminal group mostly consists of young people from either the UK or the US. They are known for their complex hacking techniques. The group is often described as unusually sophisticated and persistent, but in a case filed in California state court on Tuesday, Clorox said one of Scattered Spider’s hackers was able to repeatedly steal employees’ passwords simply by asking for them.
Strategically leaking some important information
“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” according to a copy of the lawsuit reviewed by Reuters. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over.” Cognizant, in an emailed statement, pushed back, saying it did not manage cybersecurity for Clorox and it was only hired for limited help desk services.
The IT helpdesk is the company’s main point of contact for the resolution of any internal technical issues. This includes things such as password resets, software glitches, etc. “Clorox has tried to blame us for these failures, but the reality is that Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed,” Cognizant said. The suit was not immediately visible on the public docket of the Superior Court of Alameda County. Clorox provided Reuters with a receipt for the lawsuit from the court.
An open view on password information
Three partial transcripts included in the lawsuit allegedly show conversations between the hacker and Cognizant support staff in which the intruder asks to have passwords reset and the support staff complies without verifying who they are talking to, for example by quizzing them on their employee identification number or their manager’s name.
“I don’t have a password, so I can’t connect,”
the hacker says in one call. The agent replies,
“Oh, OK. OK. So let me provide the password to you, OK?”
The apparent ease with which the hackers got what they wanted wasn’t necessarily an indication that they weren’t skilled, said Maxie Reynolds, a security expert who has specialized in social engineering and is not a party to the case. The 2023 hack at Clorox caused $380 million in damages, the suit said, about $50 million of which was tied to remedial costs and the rest attributable to Clorox’s inability to ship products to retailers in the wake of the hack.
Clorox said the clean-up was hampered by other failures by Cognizant’s staff, including failure to de-activate certain accounts or properly restore data. If a company falls victim to a cyberattack, the cost thereof can be severe, with the company’s finances taking a bad knock. Apart from that, there are also some indirect costs involved in these matters. This includes business continuity issues, revenue loss, and loss of productivity due to downtime. Reputational damage is another big factor that can ripple out later.
GCN.com/REUTERS.
