Okta is investigating an alleged data breach apparently launched by the Lapsus$ hacker group. Okta CEO Todd McKinnon on March 22, 2022, initially downplayed reports about screenshots tied to the alleged incident. Later the same day, Okta Chief Security Officer disclosed that up to 366 customers may be impacted by the attack -- which involved a contractor named Sitel.
In two tweets, McKinnon initially wrote on March 22, 2022:
"In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor. (1 of 2)
We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2)".
The screenshots were posted by Lapsus$ on the group's Telegram channel late on March 21, 2022, Reuters reported. In an accompanying message, the group said its focus was "ONLY on Okta customers," the report indicated.
Okta Cyberattack Timeline Emerges
A more expansive statement from Okta Chief Security Officer David Bradbury disclosed that a hacker had access to a support engineer's laptop during a five-day window in January 2022. Bradbury emphasized that "the Okta service has not been breached and remains fully operational. There are no corrective actions that need to be taken by our customers."
Bradbury followed up with timely outlining the attack details. Here's the timeline he published:
Identity and Access Management (IAM): Under Attack?
Security experts are watching the situation closely. The reason: Okta's identity and access management (IAM) software -- spanning various single sign-on and multi-factor authentication (MFA) software tools -- may permit hackers to launch supply chain attacks that extend to Okta's MSP partners and downstream customers.
More than 15,000 organizations run Okta's software, and the platform supports 7,000 integrations, Okta's website indicates.
Although there are no reports of supply chain attacks against Okta's partner and customer ecosystem, investors appear concerned about the alleged Lapsus$ activity. Indeed, Okta's stock was down roughly 7 percent in pre-market trading on March 22, 2022 -- though shares recovered some of that lost territory during the day.
Alleged Lapsus$ Cyberattack Targets, Victims
Meanwhile, the Lapsus$ hacker group has been very active in recent weeks. The group's alleged victims include Microsoft, Nvidia and Samsung, among many others.
Blog originally published March 22, 2022. Updated thereafter with new information.
