In a recent SEC filing, Clorox, the American manufacturing giant known for its consumer and professional cleaning products, has disclosed the financial aftermath of a cyberattack that struck the company in August 2023. This cyber incident, which commenced on August 11, led to the company identifying unauthorized activities within its systems, prompting immediate action to halt and remediate the unauthorized access. The swift response included taking certain systems offline and engaging third-party cybersecurity experts to assist in the investigation and recovery efforts.
The attack caused significant disruptions to Clorox’s business operations, affecting the company’s ability to process orders and resulting in widespread product shortages. Despite these challenges, Clorox implemented its business continuity plans, resorting to manual ordering and processing to continue servicing its customers, albeit at a reduced operational capacity. This operational hiccup persisted through the end of the quarter on September 30, 2023, impacting net sales and earnings due to the delays in order processing and substantial product outages.
By the end of December 2023, the cyberattack had cost Clorox approximately $49 million in incremental expenses, covering the costs of products sold and selling and administrative expenses. These expenses were largely attributed to third-party consulting services for IT recovery, forensic experts, and other professional services needed to address and rectify the attack’s repercussions. Despite these substantial financial setbacks, Clorox reported making significant progress in returning to normalized operations, transitioning back to automated order processing. Boasting a workforce of 8,700 and generating nearly $7.5 billion in revenue in 2023, they’ve been working diligently on recovery efforts to restore production levels and product availability.
The company’s chair and CEO, Linda Rendle, reflected on the incident in an 8-K filing, emphasizing Clorox’s commitment to recovery and resilience in the face of this cyber challenge. Rendle highlighted the company’s efforts to restore distribution and drive top-line growth as it navigates the recovery process in what continues to be a challenging environment.
The attack on Clorox is attributed to Scattered Spider, a group known for social engineering tactics and affiliations with the BlackCat/ALPHV ransomware gang, a departure from the gang’s typical association with Russian-speaking actors. Scattered Spider has a history of targeting prominent organizations, including MGM, Caesars, DoorDash, and Reddit.
For more information, please refer to Clorox’s February 1st SEC Filing, and their 8K Filing from September.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
https://www.netizen.net/contact
