$380M lawsuit claims intruder got Clorox's passwords from Cognizant simply by asking Clorox is suing its service desk provider, Cognizant, for $380 million in a California state court, alleging the IT support crew "enabled a cybercriminal to gain a foothold in Clorox's network" by handing over staffers' passwords to attackers after they simply requested them. Someone holding up two bottles of Clorox in a store …
Can't say I am overly impressed by ths claim. If Cognizant were (and should have been) aware that a severe security compromise was in play then it seems reasonable that they would be especially cautious about making any rushed decisions about installing software and this would seem a prudent and proper thing.
Cognizant look to have had some very serious failings, but why load up the legal suit with this sort of trivia? It seems to be the sort of thing that makes lawyers so widely despised.
The lesson you should learn from this example is, "Don't outsource to the cheapest outfit you can find -- nor to an outfit owned by a board member's relly or special friend."
(Cue startled, shocked, and angry looks by members of boards of directors at this. The angry looks come from those riding the graft gravy-train.)
It's no surprise to anyone that cheap IT outsourcing sucks, and that you get what you pay for. But that response by their *PR* rep? Holy *bleep!*. "If your IT security was better, it wouldn't have been a problem when our agents handed out password and MFA resets just for asking!"
The utterly anodyne "We don't comment on ongoing litigation" would have been about 100x better.
