Cybersecurity Flaws and Delayed Upgrades Expose Clorox to Disruptive Attack

In 2023, Clorox Co. faced a severe cyberattack that disrupted its manufacturing operations ahead of the flu season, revealing systemic cybersecurity weaknesses within the company’s production systems. An internal audit conducted in 2019 and 2020 had already highlighted significant vulnerabilities, including outdated computers running on obsolete Windows operating systems, making them easy targets for hackers. The audit recommended isolating manufacturing plants to mitigate potential disruptions from cyberattacks, advice that was largely ignored due to cost concerns by senior leaders at Clorox.

Despite these ignored warnings, the cyberattack’s method of intrusion was unrelated to the identified vulnerabilities. However, employees argue that the recommended security measures could have lessened the attack’s impact. The aftermath of the cyberattack saw Clorox struggling to resume full production, resulting in significant financial losses and shortages of cleaning supplies in stores.

The company’s spokesperson disputed claims of neglecting cybersecurity upgrades and emphasized their disconnection from the breach’s cause. Clorox identified the intrusion method as a social engineering attack targeting a third-party IT help desk vendor, emphasizing their quick response to mitigate damage.

This incident not only highlights the challenges of securing industrial control systems but also the importance of adequately investing in cybersecurity to protect against sophisticated threats. Despite Clorox’s efforts to bolster its digital defenses post-attack, the breach serves as a stark reminder of the potential consequences of overlooking cybersecurity in an increasingly connected industrial environment.