$380M lawsuit: intruder got Clorox's passwords from Cognizant simply by asking (theregister.com)

Makes me wonder if this was an inside job. Was the service desk contractor, part of the attack?

I really, am not sure how this happens? I feel like this should have been in the security training? Also... 2FA?