The Fake Colleague
On 11 August 2023 someone called the Clorox IT helpdesk and pretended to be an employee: a fake colleague. Clorox had outsourced that helpdesk and sued the company in 2025. According to the complaint, which cites recordings of the calls, the caller said he had no password. He was given one, without anyone checking who he was. According to Clorox, the helpdesk should have sent him to a self-service tool or asked for his manager's name and his user name, and the real employee and their manager should have received a confirmation email. Clorox shut down systems, temporarily stopped production and handled orders by hand for weeks. The company puts the damage at 380 million dollars. These are claims by Clorox: the helpdesk company disputes them and says it was only hired for limited helpdesk services. In March 2026 the judge decided that most of the case can go ahead; we have not found a final ruling. The characters in this puzzle are made up. The attack is real.
What can you learn?
Being helpful is good, but check who you are helping first. Does someone ask for access, a password or a code, even if they sound like a colleague? Check another way, for example by calling back yourself.
This does not give away who the weak link in the puzzle is: the characters are made up.
