In August 2023 an intrusion into Clorox’s IT systems sent order-taking to manual processing and paused production. The $356M loss everyone quotes is in no Clorox filing, and it is not a cost. The disclosed cost was $49M.
Nothing in Clorox’s record says a factory was hacked. Every filing describes information technology systems. Yet on 18 September 2023 the company said it had resumed production at the vast majority of its manufacturing sites, which means production had stopped. The plants did not need to be reached. They only needed to depend on something that was.
Clorox had a fallback and used it, taking orders by hand at a reduced rate. What it could not do was run at the rate full shelves need; that gap is BlastWave’s analysis, not a disclosed fact. The $356M appears in a trade magazine’s account of a fall in quarterly net sales, which the filed lines put at $354M and which Clorox said was “driven largely by lower volume resulting from the cyberattack.” A sales decline is not a cost. The disclosed incremental cost was $49M through December 2023 and $57M through March 2024. They are not the same number.
What is not known: No Clorox filing names an attacker, an initial access vector or any malware, and none explains why production depended on the systems taken offline. The help desk account, in which a caller was allegedly handed a password with no identity check, is Clorox’s claim in a civil complaint that Cognizant disputes; no court has ruled on it. How many sites stopped, and for how long, is undisclosed. So is what the insurance recoveries paid for, and how much of the $354M sales decline the attack caused beyond Clorox’s own words, “driven largely.”
Recommendation
Take the path away from production Order, scheduling and shipping systems a line depends on should not share a flat network with email, identity and the help desk. Separate them.
Remove the phone call as a door A password or MFA reset should need out-of-band proof of identity and notify the employee and manager. Clorox alleges this failed; the control stands on its own.
Read production one way Anything that only consumes production data should get it over a one-way path, and the manual order path should be rehearsed at the rate full shelves need.
Sources: Form 8-K, 14 Aug 2023 (Item 8.01); Form 8-K, 18 Sep 2023 (Item 8.01); Q1 FY2024 results, 8-K Ex. 99.1, 1 Nov 2023; Form 10-Q, 1 Feb 2024 and 30 Apr 2024; Clorox v. Cognizant, complaint, 22 Jul 2025, as reported.. Full list with links.
Soft Spots: The help desk account is Clorox’s allegation, disputed by Cognizant, and the complaint was read only through reporting. That production depended on the IT systems taken offline is BlastWave’s analysis, not a disclosed fact.
The full record
Every claim numbered to its source. Last updated .
An intrusion into Clorox's IT systems sent order-taking to manual processing and paused production, though no filing says a plant was reached. What is verified, what is only reported or alleged, and what is still unknown.
Summary
In August 2023, an intrusion into Clorox's information technology systems forced manual order processing at a reduced rate and paused production, which resumed at most manufacturing sites by 18 September. No filing says a plant or control system was reached. The disclosed cost was $49M through December 2023; the widely quoted $356M is a sales decline in no Clorox filing.2,4,11
Timeline of the Clorox cyberattack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Unauthorized activity begins. Clorox becomes aware of it that evening and immediately begins taking steps in response.1
Clorox files a Form 8-K under Item 8.01: it has identified unauthorized activity on some of its IT systems, taken certain systems offline, and put workarounds in place under its business continuity plans.2
A second 8-K: the attack damaged portions of Clorox's IT infrastructure and caused widescale disruption. Ordering and processing are running manually at a reduced rate. Clorox has "already resumed production at the vast majority of its manufacturing sites" and cannot estimate when operations will be fully normalized.4
Clorox begins the transition back to automated order processing.9
Preliminary first-quarter update: the vast majority of orders are now automated; the quarter saw order processing delays and "significant product outages."9
First-quarter results: net sales of $1,386M against $1,740M a year earlier, a decrease Clorox said was "driven largely by lower volume resulting from the cyberattack, partially offset by favorable price mix." Incremental costs in the quarter: $24M.8,14
IndustryWeek updates its story under the headline "Updated: Clorox Cyberattack Cost $356 Million," describing a "$356 million decline, most of which it blamed on the cyberattack."15
10-Q: incremental costs of $49M cumulative through 31 December 2023; no insurance proceeds recognized.11
10-Q: $8M in the quarter, $57M cumulative through 31 March 2024; no insurance proceeds recognized.12
Fiscal 2024 results: $30M of insurance recoveries recognized in the fourth quarter; fiscal 2024 costs stated as $29M net of insurance recoveries. Clorox reports it has fully restored distribution losses and regained the vast majority of lost market share.10
Clorox sues its service desk contractor, Cognizant, for $380M in California state court, alleging the help desk handed an intruder a password without verifying identity. Cognizant disputes the claims.5,6,7
Fiscal 2025 results: $70M of further insurance recoveries; "No additional insurance recoveries related to the cyberattack are anticipated."13
Law360 reports that the judge dismissed an intentional misrepresentation claim but kept the bulk of the suit alive. No court has made findings of fact.16
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What systems were affected?
Information technology systems. No filing describes production or control systems being reached2,4
Verified
Did production stop?
Yes, by necessary reading: on 18 September 2023 Clorox said it had "already resumed production at the vast majority of its manufacturing sites"4
Verified
Why did production depend on the IT systems?
Not described in engineering terms in any filing. The dependency is BlastWave's analysis, not a disclosed fact4
Alleged in Clorox's civil complaint: service desk calls on 11 August 2023 that produced a password and MFA resets without identity verification. Cognizant disputes it; no court finding5,6,7
Allegation, disputed
Who was the attacker?
No government attribution and no public claim. "Scattered Spider" is researcher and media inference and appears in no Clorox filing3
Undisclosed
Malware or ransomware?
No incident disclosure we read names malware or calls the incident ransomware2,4,8
Undisclosed
Disclosed incremental cost
$49M through 31 December 2023; $57M through 31 March 202411,12
Verified
Is $356M the cost of the attack?
No. $356M is in no Clorox filing; the filed lines give a $354M fall in quarterly net sales, which is not a cost3,14
Verified (EDGAR search, September 2026)
Insurance recoveries
$30M in fiscal 2024 and $70M in fiscal 2025; none further anticipated. What they covered is not stated10,13
Verified
Time to recover
Automated ordering resumed from 25 September 2023; distribution fully restored, reported August 20249,10
Verified
Were Clorox's factories hacked?
Nothing in Clorox's record says a factory or control system was reached. Every filing describes information technology systems. The 14 August 2023 8-K reported unauthorized activity on "some of its Information Technology (IT) systems" and said Clorox had taken certain systems offline.2 The 18 September 8-K said the attack "damaged portions of the Company's IT infrastructure" and caused widescale disruption.4 The same filing contains the sentence that makes this an operational technology story:
"already resumed production at the vast majority of its manufacturing sites."
Resumed means production had stopped. The filings attribute the disruption to the cyberattack, but they do not say in engineering terms why the plants stopped. That production depended on the IT systems taken offline is BlastWave's analysis, not a disclosed fact. On the record, this is one of the cleanest cases in this volume of an IT compromise halting physical operations, with no OT compromise shown at all.
Did the Clorox cyberattack cost $356 million?
No. $356M appears in no Clorox filing, and it measures a fall in sales, not a cost. On 1 November 2023 Clorox reported first-quarter net sales of $1,386M against $1,740M a year earlier, a decline of $354M by subtraction of the filed lines.14 Clorox described the cause in measured words:
"driven largely by lower volume resulting from the cyberattack, partially offset by favorable price mix."
Six days later, IndustryWeek updated its coverage under the headline "Updated: Clorox Cyberattack Cost $356 Million," describing a "$356 million decline, most of which it blamed on the cyberattack."15 Three things shifted in that week:
The figure moved from the $354M the filed lines give to $356M. How the magazine reached its number is not shown in the article.14,15
Clorox's "driven largely" became the magazine's "most of." The company did not quantify how much of the decline the attack caused.14,15
A decline in sales became, in the headline, a cost.15
The cost Clorox did disclose is smaller and different in kind. Incremental costs were $24M in the first quarter, relating primarily to third-party consulting, IT recovery and forensic experts and other professional services, as well as incremental operating costs from the disruption.8 They reached $49M cumulative through 31 December 2023 and $57M through 31 March 2024.11,12 An EDGAR full-text search of Clorox's filings, re-run in September 2026, found no "356 million" since August 2023.3 IndustryWeek's 7 November update is where the figure appears; nothing on the record shows where it started.
Clorox later recognized insurance recoveries of $30M in fiscal 2024 and $70M in fiscal 2025, and said no further recoveries were anticipated.10,13 Those recoveries exceed the incremental costs disclosed through March 2024, but the filings do not say what they covered. Nothing on the record supports inferring a profit or a business interruption payout.
How did the intruder get into Clorox?
No Clorox filing says. The help desk account is Clorox's allegation in a lawsuit, disputed and unresolved. In July 2025 Clorox sued its service desk contractor, Cognizant, for $380M in the Superior Court of California, County of Alameda. As reported, the complaint alleges that on 11 August 2023 a caller to the Cognizant-run service desk obtained a password and multifactor authentication resets without any identity verification, and that the attack forced Clorox to pause manufacturing and rely on manual order processing for weeks.5,6,7,17 Quotations from the complaint here come from that dated reporting.
Cognizant disputes the account. It says it did not manage cybersecurity for Clorox, blames Clorox's "internal cybersecurity system," and says Clorox:7
"hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed."
As reported by Law360 in March 2026, the judge dismissed one claim and let most of the case go forward.16 That is a ruling on whether the case can proceed, not a finding of fact. No court has found the help desk account true, and an EDGAR full-text search for "Cognizant" in Clorox's filings from August 2023 to September 2026 returns no hits.3
Who was behind the Clorox cyberattack?
Undisclosed. No government has publicly named an attacker and no group is on the record as claiming the attack. Clorox's filings name no actor; an EDGAR full-text search for "Scattered Spider" across its filings from 2023 to 2026 returns no hits.3 The complaint, as reported, names no actor.6
The name "Scattered Spider" appears in coverage as researchers' and reporters' inference from the help desk technique described in the litigation.7 It is a hypothesis about who uses that technique, not an attribution of this incident.
How did Clorox keep operating, and how long did recovery take?
Clorox invoked its business continuity plan within days and served customers by hand at a reduced rate. The 14 August 8-K described workarounds under its business continuity plans; the 18 September 8-K described manual ordering and processing procedures at a reduced rate of operations, and said plainly that the company could not yet estimate how long it would take to resume fully normalized operations.2,4 On 25 September Clorox began the transition back to automated order processing.9
By August 2024 the company reported a full recovery in the market:
"fully restored distribution losses and regained the vast majority of lost market share."
A manual path existed and was used. Whether it had been rehearsed at scale is not on the record.
What is still not known about Clorox
Who carried out the intrusion. No government attribution, no public claim, and no actor in any Clorox filing.3
How the intruder got in, beyond Clorox's allegation in a civil complaint that Cognizant disputes and no court has ruled on.5,7
What malware, if any, was used, and whether the incident involved ransomware.
Why production depended on the systems taken offline. No filing explains it in engineering terms.
How many manufacturing sites stopped, and for how long.
What the $100M of insurance recoveries paid for.10,13
How much of the $354M sales decline the attack caused, beyond Clorox's own words, "driven largely."14
How the $356M figure in circulation was calculated. The magazine's inputs are not shown.15
Claims about Clorox the record does not support
Widely repeated claim
What the record says
"The Clorox cyberattack cost $356 million."
$356M is in no Clorox filing. The filed net sales lines give a $354M quarterly sales decline, which is not a cost. The disclosed incremental cost was $49M through December 2023 and $57M through March 2024.3,11,12,14
"Most of the sales decline was blamed on the cyberattack."
"Most of" is IndustryWeek's paraphrase. Clorox said the decrease was "driven largely by lower volume resulting from the cyberattack, partially offset by favorable price mix."14,15
"Scattered Spider attacked Clorox."
No government attribution, no public claim, and no actor named in any Clorox filing or, as reported, in the complaint. The name is inference from technique.3,6
Were Clorox's disclosures made under the SEC's cyber incident rule?
No. Both 2023 filings are Form 8-Ks under Item 8.01 (Other Events), and the September filing is a new 8-K, not an amendment.2,4 They predate the SEC's Form 8-K Item 1.05 requirement for material cybersecurity incidents, which took effect for most registrants on 18 December 2023.18 The cost and recovery figures on this page come from Clorox's subsequent 10-Qs, 10-Ks and results releases.
BlastWave analysis: the plants only had to depend on something that was reached
Analysis, not a disclosed fact
The plants did not need to be reached. They only needed to depend on something that was. That is the volume's argument in its plainest form, and it is BlastWave's reading of the record rather than a disclosed fact: the filings describe IT systems only, and then report that production had to be resumed.2,4
The dependency is the finding, and the fallback is the credit. Clorox had a business continuity plan and used it, taking and processing orders by hand at a reduced rate.4 What a manual path cannot do is run at the rate full shelves need. Whether anyone had rehearsed it at scale is not on the record, and the gap between a fallback that exists and one that carries the business is BlastWave's analysis, not a disclosed fact.
Podcast: “The Card Rack” (9:19). Joe Baxter and Cam Cullen on how the factories stopped without anyone reaching them, and why a fall in sales is not a cost.
Video: Clorox Short (60 to 90 seconds).
Frequently asked questions
What happened in the Clorox cyberattack?
Clorox disclosed on 14 August 2023 that it had found unauthorized activity on some of its information technology systems, which began on Friday 11 August. It took systems offline and moved to manual order processing at a reduced rate. On 18 September 2023 it said it had already resumed production at the vast majority of its manufacturing sites. Automated ordering began returning on 25 September, and by August 2024 Clorox reported distribution fully restored.
Were Clorox's factories or control systems hacked?
No Clorox filing says so. Every filing describes information technology systems only, yet the company's 18 September 2023 8-K said it had resumed production at the vast majority of its manufacturing sites, which means production had stopped. The filings do not explain in engineering terms why. BlastWave reads it as a dependency on the affected IT systems, which is analysis, not a disclosed fact.
How much did the Clorox cyberattack cost?
Clorox disclosed incremental costs of $49 million through 31 December 2023, in its 10-Q filed 1 February 2024, and $57 million through 31 March 2024. It later recognized $30 million of insurance recoveries in fiscal 2024 and $70 million in fiscal 2025. The filings do not say what those recoveries covered. The widely quoted $356 million is not a cost figure.
Where does the $356 million Clorox figure come from?
It appears in IndustryWeek's coverage, updated 7 November 2023 under the headline "Updated: Clorox Cyberattack Cost $356 Million." It is in no Clorox filing. Clorox's 1 November 2023 results show first-quarter net sales of $1,386 million against $1,740 million a year earlier, a $354 million decline, which Clorox said was driven largely by lower volume resulting from the cyberattack. A sales decline is not a cost.
How did hackers get into Clorox?
No Clorox filing says. In a civil complaint filed in July 2025, Clorox alleged that on 11 August 2023 a caller to the Cognizant-run service desk was given a password and multifactor resets without identity verification. Cognizant disputes this and says it reasonably performed a narrow scope of help desk services. As reported in March 2026, the case is proceeding; no court has found the allegation true.
Was Scattered Spider behind the Clorox attack?
That is not established. No government has publicly named an attacker, no group is on the record as claiming the attack, and an EDGAR full-text search of Clorox's filings in September 2026 found no mention of Scattered Spider. The complaint against Cognizant, as reported in July 2025, names no actor. The name comes from researchers and reporters reasoning from the help desk technique.
Was the Clorox cyberattack ransomware?
Clorox has not said so. Clorox's incident disclosures, including the August and September 2023 8-Ks and the 10-Q filed 1 November 2023, name no malware and do not describe the incident as ransomware. Whether ransomware was involved has not been disclosed by Clorox as of September 2026.
Primary sources are The Clorox Company's own SEC filings and results releases, read on EDGAR. The complaint against Cognizant is cited as quoted in dated reporting, and press is cited only as evidence of what was said.
Company filingThe Clorox Company, Form 10-K for the fiscal year ended 30 June 2024, filed 8 August 2024: Item 1A (the activity began on Friday, 11 August 2023) and Exhibit 99.1 (MD&A). sec.gov
Company filingThe Clorox Company, Form 8-K, Item 8.01 (Other Events), 14 August 2023 (accession 0001206774-23-000969). sec.gov
GovernmentSEC EDGAR, company record and full-text search of The Clorox Company's filings (CIK 0000021076), run 24 September 2026 and re-run 28 September 2026: "Cognizant" and "Scattered Spider" return no hits; "356 million" returns no hits since August 2023.
Company filingThe Clorox Company, Form 8-K, Item 8.01 (Other Events), 18 September 2023 (accession 0001206774-23-001133). A new 8-K, not an amendment. sec.gov
Court recordThe Clorox Company v. Cognizant, complaint, Superior Court of California, County of Alameda, filed 22 July 2025. Quoted here as reported by The Register, BleepingComputer and CSO Online.
PressThe Register, report on Clorox's complaint against Cognizant, 23 July 2025. Cited as evidence of what the complaint says. theregister.com
PressBleepingComputer, report on Clorox's complaint against Cognizant, including Cognizant's published statement, 23 July 2025. Cited as evidence of what was said. bleepingcomputer.com
Company filingThe Clorox Company, Form 10-Q for the quarter ended 30 September 2023, filed 1 November 2023, Note 2 (Cyberattack). sec.gov
Company filingThe Clorox Company, Form 8-K, Exhibit 99.1, "Clorox Provides Preliminary Q1 Financial Information and Operations Update," 4 October 2023. sec.gov
Company filingThe Clorox Company, Form 8-K, Exhibits 99.1 and 99.2, fourth quarter and fiscal year 2024 results, 1 August 2024. sec.gov
Company filingThe Clorox Company, Form 10-Q for the quarter ended 31 December 2023, filed 1 February 2024, Note 2: incremental costs of about $25M and $49M for the three and six months ended 31 December 2023; no insurance proceeds recognized. sec.gov
Company filingThe Clorox Company, Form 10-Q for the quarter ended 31 March 2024, filed 30 April 2024: $8M in the quarter, $57M for the nine months; no insurance proceeds recognized. sec.gov
Company filingThe Clorox Company, Form 8-K, Exhibit 99.1, fourth quarter fiscal year 2025 results, 31 July 2025, and Form 10-K for fiscal year 2025, filed 8 August 2025, Exhibit 99.1. sec.gov
Company filingThe Clorox Company, Form 8-K, Exhibit 99.1, "Clorox Reports Q1 Fiscal Year 2024 Results, Updates Outlook," and Exhibit 99.2 supplemental information, 1 November 2023. sec.gov
PressIndustryWeek, Dennis Scimeca, "Updated: Clorox Cyberattack Cost $356 Million," first published 5 October 2023, updated 7 November 2023. Cited as evidence of what was published. industryweek.com
PressLaw360, "Cognizant Must Face Clorox's $380M Suit Over Login Sharing," 25 March 2026. Cited for the ruling as reported; the order itself was not read.
PressCSO Online, report on Clorox's complaint against Cognizant. Cited as evidence of what the complaint says. csoonline.com
RegulatorUS Securities and Exchange Commission, Release No. 33-11216, July 2023 (Form 8-K Item 1.05 compliance from 18 December 2023 for most registrants).
Cite this page
BlastWave. “Clorox Cyberattack (2023): What Is Verified.” Hackopedia, Volume 2, FILE 036. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/clorox-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 036 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Re-verification: EDGAR full-text search of Clorox's filings re-run, confirming that "356 million" (since August 2023), "Cognizant" and "Scattered Spider" appear in none of them; consistency checked against related entries.
26 Sep 2026
Full validation against Clorox's 8-Ks, 10-Qs, 10-K and results releases, and against dated reporting of the Cognizant litigation. Every figure, date and quotation checked; wording tightened to quote Clorox's "driven largely" in full and to describe manual order processing in the filings' own terms.
24 Sep 2026
Entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
