FEDERALHackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedPIICredentialsLowResolved

THE CLOROX COMPANY

bd_d546fd1f30aaa125 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2023

Filed

Aug 7, 2026

To disclose

37 months

Affected

Not disclosed

Confidence

65%

Full breach record for THE CLOROX COMPANY →4 incidents on file

The Clorox Company (CIK 0000021076) disclosed a cyber incident in its FY2024 10-K (filed 2026-07-22) involving unauthorized access to its network in August 2023. The incident resulted in the exfiltration of customer and employee PII. The company engaged forensic investigators and law enforcement, and the incident is now resolved.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 37 months / 1102 days

Aug 1, 2023

Begins

Aug 1, 2023

Discovered

Aug 7, 2026

Filed

vs. sector median

+150 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

Name: THE CLOROX COMPANY
norm: the clorox
SEC CIK: 0000021076

Name: THE CLOROX COMPANY
norm: the clorox
SEC CIK: 0000021076
Industry: Retail & Consumerllm

Discovered: Aug 1, 2023
Breach occurred: Aug 1, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIICredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic investigators
Notified law enforcement
Implemented additional security controls
Changes made: Enhanced security monitoring
Patched affected systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 months(1102 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/21076/000002107626000034/0000021076-26-000034-index.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 7, 2026
Raw hash: a9c51ca4a71091f755c0a7e70762ce29b36dd356ba3b97ea880f9f455e8dedf6

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html803.2 KB

Download View at source

Reporting entityTHE CLOROX COMPANY

Victim entityTHE CLOROX COMPANY

Incidentdiscovered Aug 1, 2023

Stated responseEngaged third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing