A few days after hacking group Lapsus$ claimed it breached Okta’s customer data systems, the company has confirmed and provided new information regarding the incident.
Okta said that Lapsus$ — believed to be based in South America — gained access to certain customer data through a third-party contractor in January 2022. In a statement, Okta Chief Security Officer David Bradbury provided a timeline of key events surrounding the incident.
Bradbury also reassured customers that Okta itself was not breached, and that its customers do not need to take any action on their end.
Okta Sub-Processor Sitel Targeted
On March 22, the prolific ransomware group Lapsus$ posted screenshots on its Telegram channel, claiming it contained Okta customer data. Okta’s new statement puts forward the company’s view of the incident based on its own investigations, as well as that of Sitel, the compromised sub-processor.
“The scenario here is analogous to walking away from your computer at a coffee shop, whereby a stranger has (virtually in this case) sat down at your machine and is using the mouse and keyboard,” Bradbury said.
Okta has a contract with Sitel for customer support engineers. According to Bradbury, one of Sitel’s engineers was the source of the leaked screenshots. The attackers apparently gained access to the support engineer’s computer through RDP (Remote Desktop Protocol), and took the screenshots from the compromised system.
“Okta Security team was alerted that a new factor was added to a Sitel customer support engineer’s Okta account,” Bradbury said in a statement. “This factor was a password. Although that individual attempt was unsuccessful, out of an abundance of caution, we reset the account and notified Sitel who engaged a leading forensic firm to perform an investigation.”
Lapsus$ had Limited Access to Okta Information
Bradbury was quick to point out that the attackers did not have “god-like access” to its customers. In fact, customer support engineers have very basic levels of access. This is limited to the basic functions for handling inbound queries. Bradbury added that support engineers “are granted only the specific access they require to perform their roles.”
Therefore, Lapsus$ never had the ability to create or delete users, download customer databases, or access Okta’s source code repositories, the company said. However, Okta and Sitel both confirmed that Lapsus$ had access to the latter’s environment between January 16 to 21.
Okta estimates that, in the worst-case scenario, Lapsus$ had access to 366 customers — approximately 2.5% of Okta’s total customer base.
Timeline of Key Events
Bradbury’s latest statement contains some insight regarding the response times of both Okta and Sitel. Below is a timeline of the key events:
| Date and Time (UTC) | Event |
|---|---|
| January 20, 2022, 23:18 | Okta Security received an alert that a new factor was added to a Sitel employee’s Okta account from a new location. The target did not accept an MFA challenge, preventing access to the Okta account. |
| January 20, 2022, at 23:46 | Okta Security investigated the alert and escalated it to a security incident. |
| January 21, 2022, at 00:18 | Okta Service Desk added to the incident to assist with containing the user’s account. |
| January 21, 2022, at 00:28 | Okta Service Desk terminated the user’s Okta sessions and suspended the account until the root cause of suspicious activity could be identified and remediated. |
| January 21, 2022, at 18:00 | Okta Security shared indicators of compromise with Sitel. Sitel informed us that they retained outside support from a leading forensic firm. |
| January 21, 2022, to March 10, 2022 | Forensic firm’s investigation and analysis conducted until February 28, 2022 – report to Sitel dated March 10, 2022. |
| March 17, 2022 | Okta received an incident summary report from Sitel |
| March 22, 2022, at 03:30 | Screenshots shared online by LAPSUS$ |
| March 22, 2022, at 05:00 | Okta Security determined the screenshots were related to the January incident at Sitel |
| March 22, 2022, at 12:27 | Okta received the complete investigation report from Sitel |
Bradbury expressed his disappointment at Sitel for not acting sooner after receiving Okta’s notification. He added that Okta could have acted faster after receiving Sitel’s summary report.
