Clorox says cyber attack remediation efforts cost approximately $49 million in 2023

American cleaning products giant Clorox said it spent approximately $49 million to remediate the impact of a significant cyber attack that struck its network in August last year.

 

Clorox said in a filing with the U.S. Securities and Exchange Commission last year that it identified “unauthorised activity” in some of its internal systems in August and immediately launched an investigation, with assistance from third party cyber security experts, to understand the nature and scope of the incident.

“After becoming aware of the activity, the Company began taking steps to stop and remediate the activity, including taking certain systems offline,” the company said in its initial 8-K filing.

 

In a separate filing with the SEC, the company said that it activated its “business continuity plans and began manual ordering and processing procedures shortly thereafter at a reduced rate of operations.”

Clorox said the security incident was contained “due to the steps the Company has taken to address the incident.” However, it was still in the process of repairing its digital infrastructure and reintegrating the systems that were proactively taken offline.

 

“The cybersecurity attack damaged portions of the Company’s IT infrastructure, which caused widescale disruption of Clorox’s operations,” Clorox said in its filing.

 

“The Company expects to begin the process of transitioning back to normal automated order processing the week of Sept. 25. Clorox has already resumed production at the vast majority of its manufacturing sites and expects the ramp up to full production to occur over time. At this time, the Company cannot estimate how long it will take to resume fully normalised operations,” it added.

 

In a recent earnings report filed with the SEC, the company said that the cyber security incident “resulted in wide-scale disruptions to the Company’s business operations throughout the remainder of the quarter ended September 30, 2023.”

 

“The impacts of these system disruptions included order processing delays and significant product outages, resulting in a negative impact on net sales and earnings. The Company has since transitioned back to automated order processing. The Company experienced lessening operational impacts in the second quarter as it made progress in returning to normalized operations,” Clorox explained.

 

The company, in its earnings report, said it incurred incremental expenses of almost $49 million by end of December to respond to the cyber security incident.

 

“The costs incurred relate primarily to third-party consulting services, including IT recovery and forensic experts and other professional services incurred to investigate and remediate the attack, as well as incremental operating costs incurred from the resulting disruption to the Company’s business operations. The Company expects to incur lessening costs related to the cyberattack in future periods,” Clorox said.

 

Last week, Johnson Controls International, a leading manufacturer of industrial control systems, said that it spent approximately $27 million between October and December 2023 to respond, remediate and recover from a ransomware incident it suffered on September 23.

 

Johnson Controls expects to incur additional expenses associated with responding to and remediating the impact of the data security incident throughout 2024, most of which it expects to incur in the first half of the year.