This isn't about who is at fault.
/me rereads TFS. Um, yeah right! "Clorox sues it's service desk"
Which is what you do when one party to a contract doesn't live up to their obligations under said contract. That is, literally, the entire point. Contractual obligations.
... It's about contractual obligations, and reasonable expectations to follow standard practices.
That's how the lawsuit is doing its thing, but the end users that were impacted don't need to care about that part.
Clorox isn't suing the end users, they're suing the company they had a contract with that (according to the suit) they did not live up to.
They are doing business with Clorox, and how Clorox (mis)handled their data is the problem.
And they can sue Clorox if the choose to. But Clorox is suing the IT company that (according to the suit) didn't live up to their contractual obligations.
As the previous posted noted, Clorox could have been verifying that said procedures were being followed (that's due diligence).
And Cognizant could have followed well established standard industry practices, but apparently, in your excuse for a mind, they are 100% completely blameless for not doing so.
If your bank account were compromised because some scammer called the bank on the phone pretending to be you, and your bank made no effort to verify the caller, would that be your fault for having the account with them in the first place? Or would you squeal like a stuck pig over the loss from their irresponsible practices?
You overlooked one of the parties involved. Was that on purpose? The above sounds like exactly what happened to their end users except that, when the scammer called the bank, they bank sent that call to a contractor they employed, rather than a direct employee. How is that any different for the end user?
I'll try to use small words this time: Clorox isn't suing the end users. If any end users are suing them, that is not part of this lawsuit. Cognizant had a contract that very likely specifically required them to follow industry standard procedures (and even if it didn't, that's implied in pretty much all contracts that don't say otherwise), and (according to the suit) they didn't.
And not verifying identity on a password (and two MFA systems) reset is something so fundamental that it really should be criminally prosecuted as an accomplice to the crime.
But they are, according to you, literally saints, completely blameless for their negligence, and should be literally worshipped for their piety. Or maybe they're paying you to spread bullshit that makes them look less negligent. Could go either way.