From helpdesk to havoc: Why Clorox is suing Indian company for $380 million
In a San Francisco courtroom, the Clorox Company recently dropped a legal bombshell – a $380 million lawsuit against Indian-American information technology company Cognizant, alleging gross negligence in a 2023 cyberattack.
In the complaint dated July 22, 2025, Clorox contends a hacker simply called Cognizant’s helpdesk, lied about being an employee and was handed network credentials – no identity verification, no oversight, just a password transfer. The resulting cyberattack ended up paralyzing Clorox’s operations, costing upwards of $49 million in remediation and much more in lost business.
Offshoring ecosystem under the microscope
Cognizant, though officially headquartered in New Jersey, was founded in Chennai, India in 1994, and now employs over 250,000 people across India, providing everything from software development to helpdesk services for global corporations. Industry analysts have warned that shifting U.S. companies’ sensitive customer data offshore exposes Americans to significant privacy risks. India lacks comprehensive data privacy laws or an enforcement body like the Federal Trade Commission.
While offshoring offers cheap labor and scalability, it also creates layers of separation between U.S.-based clients and the employees handling their data. Those layers can conceal critical weaknesses.
Clorox case: A failed firewall
In Clorox’s telling, the hacker didn’t crack advanced encryption or “spear-phish” executives. He just called Cognizant on the phone and lied about who and what he was. That was enough. Cognizant agents reset the account, handed over passwords and reopened Clorox’s VPN access without a single identity check. Agents reportedly said phrases like: “Here’s the password … Welcome …”
Cognizant disputes the claim, saying its contract with Clorox, dating back to 2013, covered only helpdesk tasks, not broader cybersecurity responsibilities. Cognizant characterized Clorox’s own defenses as “inept,” calling the attack partly Clorox’s fault.
Is Clorox an isolated scandal or a warning sign?
India is a developing nation – its legal structures, enforcement mechanisms and low-level infrastructure are still evolving. While not a “third-world country” in the academic sense, the country certainly lacks the same data-privacy enforcement ecosystem as the U.S.
Critics point to the absence of comprehensive federal data-privacy laws and raise concerns about bribery, corruption and crime embedded at both business and government levels.
That helps explain why U.S. companies outsourcing to India may unknowingly be entrusting critical personal identification information (PII) to far-away work environments with less accountability and weaker deterrents to crime.
What happens next?
Clorox’s lawsuit is likely to go to trial. If Clorox prevails, other clients served by Cognizant or similar foreign vendors may begin re-examining their risk exposure. Investors and corporate boards may start pushing for deeper scrutiny of offshored operations. Client companies may begin demanding much stricter contractual audits and identity verification procedures – or else bring those services back onshore in America.
More than a tale of cost-savings gone wrong, the Clorox-Cognizant lawsuit serves as a cautionary tale, dramatizing how a model built on offshoring for the sake of lowering labor costs can sometimes yield disastrous results.
Put simply, for agents to literally hand over passwords without questions is not just a breach, but a major wake-up call.
Clorox’s case could foreshadow more lawsuits, more revelations and a broader re-evaluation of whether Americans’ personal identification information should be in the hands of unmonitored call centers thousands of miles away.
Follow WND for breaking exclusives, evidence-based investigations and updates on America First immigration news that the mainstream media won’t touch. Follow WND on X @Worldnetdaily, sign up for its weekly immigration newsletter and visit WND.com.