Okta says the “maximum potential impact” of its security breach was to 366 customers, out of 15K+, whose data was accessed by contractor Sitel; Okta is down 5%+

Hundreds of customers of digital authentication firm Okta Inc have possibly been affected by a security breach caused …

Reuters 2022-03-23 Raphael Satter

Context & Ripple Effects

A day earlier, Okta was investigating alleged internal-system screenshots tied to a January incident; its new estimate narrows the immediate customer exposure while putting contractor access at the center of the response. The episode matters because Okta sits in digital authentication, where customers depend on confidence in the handling of account-related data.

Later coverage shows the same trust boundary recurring: an October support-system breach initially reported as affecting 134 customers was followed by disclosure that information on all support-system users had been taken, underscoring the stakes of scope assessments that expand after an initial disclosure.

First-order effects

Up to 366 Okta customers face direct incident-response work after Sitel's access to their data, while Okta must explain why a contractor could reach data across its customer base.
Okta's shares fell more than 5% following the disclosure, immediately attaching a market cost to the breach assessment.

Second-order effects

Okta customers and prospects gain reason to scrutinize the access controls and data-handling practices of its contractors, not only Okta's own systems.
The disclosure makes the security of support and service-provider workflows a competitive trust issue for identity vendors; later, stolen-credential access to Okta support files triggered a sharper 11.57% share-price decline.

Third-order effects

If contractor and support-system incidents continue to expose customer information, identity-security providers will be judged on controls across their full vendor-operated access chain, not solely on their core authentication products.
The pattern points toward targeted follow-on attacks after support-file access becoming part of the risk model customers use when evaluating identity platforms.

The trend: Identity-security risk is broadening from product defenses to the third-party and support-access systems that handle customer data.

Discussion

@runasand Runa Sandvik on x
This incident timeline from Okta is pretty interesting. Breach of Sitel happened in January, but Okta did not receive a complete investigation report until after Lapsus$ shared the screenshots. https://www.okta.com/... https://twitter.com/...
@zackwhittaker Zack Whittaker on x
I've reported lots of data breaches in my time. Almost every time I hear the breach isn't the problem, annoying as they can be. It's how breaches are handled, often badly (or covered up entirely), that pisses people off. Trust is a fickle thing that can be wiped out in a second.
@billdemirkapi Bill Demirkapi on x
The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords: https://twitter.com/...
@carnage4life @carnage4life on x
The CEO of Okta going on Twitter to say only a support engineer was hacked only for an official blog post to say 375 customers had their data viewed or modified is quite a dramatic change. An example of how crisis management shouldn't get ahead of the facts of an investigation. h…
@arekfurt Brian on x
“Our investigation determined that the screenshots, which were not contained in the Sitel summary report, were taken from a Sitel support engineer's computer upon which an attacker had obtained remote access using RDP.” https://www.okta.com/... https://twitter.com/...
@razhael Raphael Satter on x
New: Authentication firm Okta says up to 366 customers were potentially affected by Lapsus$ gang intrusion. One executive calls the count a “worst case scenario.” https://www.reuters.com/...

Chronicles