News Heading

Okta Breach: Threat Actors Use Stolen Credentials to Access Its Support System

Reading time: 2 min

San Francisco-based identity and access management firm Okta disclosed a new security breach incident by unknown threat actors. Using stolen employee credentials, the hackers accessed its support management system to steal sensitive user information.

Okta’s Chief Security Officer (CSO), David Bradbury in an advisory revealed few details about the incident, including customer browser files accessed by the hacker. ‘’The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases,’’ Bradbury stated.

‘’It should be noted that the Okta support case management system is separate from the production Okta service, which is fully operational and has not been impacted,’’ he continued.

Bradbury further revealed that Okta’s case management system, Auth0/CIC was not impacted by this incident, and it had notified customers whose Okta environment or support tickets were exposed during the breach.

The advisory also revealed few details about the type of information stored in the support case management system. ‘’Okta support will ask customers to upload an HTTP Archive (HAR) file, which allows for troubleshooting of issues by replicating browser activity,’’ the advisory explained. These HAR files contain sensitive information like cookies and session tokens, which can be used to hack valid accounts.

To stem the adverse impact resulting from the incident, Okta is working with its customers, including revocation of embedded session tokens.

Although, the company did not disclose the scale of impact or number of affected customers. BeyondTrust, Cloudflare and 1Password are some of the customers that were impacted by this support system breach.

BeyondTrust, an identity security platform revealed that it had first notified Okta on October 2, about the security breach; however, Okta did not confirm the incident until October 19.

In the past two years, Okta has been on the radar of various threat actors, owing to its clientele that includes some of the largest companies in the world.

Did you like this article? Rate it!
I hated it I don't really like it It was ok Pretty good! Loved it!

We're thrilled you enjoyed our work!

As a valued reader, would you mind giving us a shoutout on Trustpilot? It's quick and means the world to us. Thank you for being amazing!

Rate us on Trustpilot
0 Voted by 0 users
Title
Comment
Thanks for your feedback
Loader
Please wait 5 minutes before posting another comment.
Comment sent for approval.

Leave a Comment

Loader
Loader Show more...