our outsourced help desk verifies identity before resetting access

what everyone assumed

When you outsource the help desk, you are buying a process: the contract specifies how a caller’s identity gets checked before anything is handed over, and you trust that the people on the calls follow it. It is a reasonable trust, because identity verification at the help desk is a solved, written-down procedure. The agent on these calls was doing the job in front of them, working a queue of reset requests the way the role is shaped. The process meant to sit behind that moment was the thing that did not hold.

what happened

Here the gap was not months but the span of a few calls. According to Clorox’s complaint, the caller reached the Cognizant service desk and obtained a password reset, then called again and had the employee’s MFA reset, and called back to have it reset once more. The complaint alleges the agent did not verify the caller’s identity and did not follow Clorox’s credential support procedures before making the changes. With the password and the MFA both in hand, the attacker held what every later check would read as a legitimate employee. The two facts that should have stopped this, who is calling and does the procedure allow this, were never the question the calls turned on.

how it surfaced

The intrusion became a network-wide incident. Clorox has said the attack disrupted its operations, contributing to product shortages, and the company has put the damage at roughly 356 million dollars. In 2025 it sued Cognizant for 380 million dollars, alleging the help desk handed over credentials without verifying identity. The reset that started it had been, at the time, an unremarkable ticket.

A verification procedure protects you only when it is the gate every reset has to pass through, not a policy that exists alongside a busy queue.

If a reset can be completed without the check, then the check is advisory, and an advisory check stops nothing.