Who Answers for an Outsourced Help Desk? Lessons From Clorox
Clorox’s $380 million suit against Cognizant is still unproven. It already shows what a help-desk contract needs for a procedure to hold during a call.
Clorox outsourced its IT service desk in 2013. On August 11, 2023, according to the company’s lawsuit, someone called that service desk posing as an employee and got access reset without being properly identified. Clorox filed suit against Cognizant in July 2025, seeking $380 million. In March 2026 a California judge narrowed the case but let most of it continue. No court has found that the allegations are true, and Cognizant disputes them.
Whatever the outcome, the case has already made public something most organizations keep private: how a verification procedure, a vendor’s training claim and a contract’s scope look when a single phone call goes wrong. Anyone who buys support services should read it as a stress test of their own arrangement.
What is claimed, and by whom
| Point | Clorox’s allegation | Status |
|---|---|---|
| Procedure | Agents were to direct employees to a self-reset tool, or else verify identity through the manager’s name and a username and send confirmation emails to the employee and manager | Alleged in the complaint, as reported |
| The call | An agent reset access “in direct violation of Clorox’s credential support procedures” | Alleged; not adjudicated |
| Follow-up | Multi-factor credentials reset repeatedly, and the SMS phone number changed, with no notification emails sent | Alleged; not adjudicated |
| Training | In February 2023 a service desk lead reported an updated procedure as done, with the comment “Educated the team”; Clorox calls this a “blatant lie” | Alleged; not adjudicated |
| Response | Delays in restoring tools and handling network information during containment | Alleged; not adjudicated |
These details come from The Register’s reporting on the complaint and CSO Online’s coverage; we did not read the court filing itself. CSO reports the suit was brought in Alameda County Superior Court, and that the claims include breach of contract, gross negligence and intentional misrepresentation.
Cognizant’s response is equally pointed. It said it was hired for “a narrow scope of help desk services” and that “Cognizant did not manage cybersecurity for Clorox,” and it described Clorox’s own cybersecurity system as “inept.” Law360 reported on March 25, 2026 that the judge dismissed the intentional misrepresentation claim while allowing most of the case to continue. We could read only the summary of that report and do not know the court’s reasoning.
Why this dispute is hard to resolve
Strip away the adjectives and each side is describing a real feature of outsourcing. Clorox’s position is, in effect: we wrote down what you were supposed to do. Cognizant’s is: you hired us to perform a limited task, and security was your job. Both can be partly right, because a help desk reset is a security decision being carried out by a person whose job description may say “customer support.”
That is the structural issue, and our piece on the reset process as the boundary makes the case that the reset is the security control. Outsourcing moves the person who performs that control to another company, while the consequences stay at home. The buyer is likely to discover where the boundary lies only after an incident.
Help desks are not an obscure target in any of this. CISA’s advisory on Scattered Spider, revised in July 2025, describes actors making calls “to convince IT help desk personnel to reset passwords and/or transfer MFA tokens,” and notes attempts designed to first learn the steps a help desk requires. Public reporting has linked the Clorox incident to that group, although as CSO’s coverage notes the attribution is not a finding in the case. The relevance for a buyer is that a caller may phone several times to learn the procedure before attempting it, and a vendor’s staff will treat each of those calls as separate.
Procedure, training claim, evidence
The February 2023 allegation deserves special attention. Set aside whether it is true. What it illustrates is how a change of procedure gets confirmed in many organizations: someone reports that it is done. The customer receives a status line. Nothing in that exchange shows that an agent, on a busy day, will do the new thing.
| Weak evidence that a control exists | Stronger evidence |
|---|---|
| “Team educated,” in a status report | Sampled call recordings or tickets showing the verification step, reviewed by the customer |
| A policy attached to the contract | A system that cannot complete a reset until the check is logged |
| Annual attestation by the vendor | Test calls run under agreed rules, with results reported to both sides |
| Notifications “required” | Automated notice to the employee and manager on every reset, generated by the identity platform and not an agent |
| Agents told to be vigilant | A limit on repeat resets for the same account in a day, with automatic escalation |
The last two rows address the specific allegations of repeated resets and missing notifications. Neither depends on a person remembering anything. A confirmation message that the identity system sends automatically would not depend on an agent’s memory or honesty, and it would reach the one person who can say “that wasn’t me.”
Testing a vendor’s agents raises its own questions, and our guide to tabletop exercises explains how to test a process and not a person. An outsourced desk adds a contractual question, since the test has to be permitted, scoped and described in advance in a way that does not punish individual agents.
What a contract can and cannot do
Analysts quoted by CSO offered blunt advice. “Enterprises must no longer equate outsourcing with abdication,” said Sanchit Vir Gogia of Greyhound Research. Prabhjyot Kaur of Everest Group warned that “an outsourced helpdesk can become a single point of catastrophic failure,” recommended contract terms requiring verified resets and supervisor co-approval for credential changes, and noted that vendor failures can exceed the liability caps common in IT outsourcing.
The liability point is worth pressing. A company can write the strongest possible clause and still find, at the end of a long case, that the recoverable amount is a small part of the loss. Clorox’s claim alone is $380 million. A contract allocates risk after the fact. It does not stop the call.
| Contract area | Question to ask before signing or renewing |
|---|---|
| Scope | Does the agreement say in plain words that verifying identity for resets is part of the service? |
| Procedure ownership | Who approves a change to the verification steps, and how is the change delivered to agents? |
| Proof | What evidence will the vendor supply each quarter, and can the buyer sample it directly? |
| High-risk accounts | Are resets for administrators and security staff handled differently? |
| Incident duties | Which actions must happen within what time during an incident, and who has authority? |
| Liability | Does the cap bear any relationship to the loss a single failed reset could cause? |
A different vendor risk to keep in view
This case concerns an allegation of a failure to follow procedure. A separate risk involves agents who are paid to break it, which we covered in when attackers bribe the support agent. The control sets overlap: automatic notifications, reset limits and sampling catch both. A contract should assume that the person at the other end of the phone may be mistaken, deceived or compromised, and that the system should hold up in all three cases.
Outsourcing and third-party dependence are not going away. The NCSC’s review observes that organizations are increasingly reliant on suppliers and service providers, and coverage of Verizon’s 2026 report cites third-party involvement in breaches rising 60% year on year. A help desk is one of the more intimate of these dependencies, because it holds the power to change who is allowed in.
Reading the case as it proceeds
The lawsuit may settle, and even if it goes to trial any judgment will reflect California law and the specific contract. When you see coverage of further developments, watch for three distinctions: an allegation versus a finding, a ruling on whether a claim may proceed versus a ruling on whether it is true, and any description of the attacker’s skill, which both parties have an interest in shaping.
The useful work does not have to wait for a verdict. Pull your service desk contract and your current reset procedure and put them side by side. Then ask one question of whoever manages the relationship: if a caller were reset without being verified tomorrow, what would show that it happened, and who would be told?
Sources
- $380M lawsuit claims intruder got Clorox’s passwords from Cognizant (The Register, July 23, 2025): allegations and Cognizant response.
- Clorox sues Cognizant (CSO Online, July 2025): court, claims, quotations, analyst comments.
- Cognizant Must Face Clorox’s $380M Suit (Law360, March 25, 2026; visible summary only).
- Scattered Spider advisory AA23-320A (CISA, revised July 29, 2025): help desk calls.
- NCSC Annual Review 2026 (NCSC, November 3, 2026): supplier reliance, access methods.
- Verizon DBIR findings (Help Net Security, May 20, 2026): third-party involvement.
Found a factual error or a source that has changed?
Send a correction →
