Clorox lawsuit says help-desk contractors handed over passwords in cyberattack