Okta Confirms Expanded Impact of September Breach on Customer Support System Clients

Okta, a leading single sign-on provider, has updated its assessment of a cyberattack that occurred in late September, revealing a broader impact than initially reported. According to CSO David Bradbury, the incident compromised data from every client of Okta’s customer support system, a significant expansion from the earlier estimate that less than 1% of clients were affected.

Initially, Okta reported that the breach impacted files related to 134 customers, which led to the compromise of five customers, including BeyondTrust, Cloudflare, and 1Password. However, recent investigations have revealed that on September 28, a threat actor ran a report that included names and email addresses of all users of Okta’s customer support system.

As of October, Okta reported having over 18,400 business customers, though the exact number of clients affected by this breach has not been specified. The company clarified that the report accessed by the threat actor primarily contained blank fields and did not include user credentials or sensitive personal information.

The nature of the data exposed raises concerns about the potential for follow-on attacks, especially since many users of Okta’s support system are administrators within their organizations. Bradbury acknowledged the possibility of the threat actor using the information for phishing or social engineering attacks.

The discrepancy in Okta’s initial analysis of the breach’s scope was attributed to an oversight of a large file that the threat actor had accessed within the customer support system. Further investigation revealed additional reports and support cases accessed by the threat actor, extending the exposure to all clients using Okta Workforce Identity Cloud and Customer Identity Solutions. However, government agency customers using Okta’s FedRamp High and Department of Defense IL4 environments were reportedly not affected.

Some employee information from Okta was also included in these accessed reports, but again, this did not encompass user credentials or sensitive personal data.

This incident marks the second significant security challenge for Okta and its customers since late July. Okta has engaged an external digital forensics firm to validate its findings and plans to share a comprehensive report with its customers upon completion of the investigation.