Incidents Timeline
On March 22nd, 2022 the hacking group Lapsus$ published information regarding a security breach at Okta on their behalf. As was later confirmed by Okta, the account of a contract worker for their Customer Support organization was used to access internal systems on January 20th and 21st, 2022 for approximately one hour. During this period the attacker was potentially able to access 2.5% of Okta's customer base with limited privileges.
...
On October 20th, 2023 Okta informed that credentials of a service account to access Okta's support case management system had been stolen and the threat actor was able to view files uploaded by 134 customers (equates to 1% of the customer base). It was later specified that all users of its customer support system were affected. Some customers shared their own response to the event, notably Cloudflare, 1Password, and BeyondTrust (see references below). The credentials of the service account were stored in an employee’s personal Google account that was signed in on a company laptop.
Okta and eduGAIN
As an identity and access management company Okta's services may be used by eduGAIN's constituency as well. The company claims that all customers that are possibly affected have been contacted directly. However, if You're an Okta customer the eduGAIN Security team CSIRT recommends to:
- examine Okta related logs for malicious activity
- contact Okta to clarify, whether You are impacted by the incident and which additional measures are advised
If You need help assessing the incident or need some proxy for the communication with Okta, please contact the eduGAIN Security TeamCSIRT, as per https://edugain.org/edugain-security/.
References
Okta develops cloud-based software solutions for identity and authentication management (Identity as a Service, IDaaS) used by many large organizations.
https://www.okta.com/
...