A look at Lapsus$, a data extortion group that surfaced in December 2021 and specializes in stealing data from big companies by bribing or tricking employees
Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$, a relatively new cybercrime group …
Context & Ripple Effects
Microsoft's disclosure that Lapsus$ obtained portions of source code through one compromised account and Okta's report of access to an engineer's laptop put two different access paths into the same incident pattern. The group's employee-focused tactics matter because they can turn ordinary corporate and vendor access into an extortion lever.
The pattern later extended to Globant, where the group allegedly shared data from a partially breached code repository, reinforcing that source code and identity-adjacent systems were both valuable targets.
First-order effects
- Microsoft and Okta must prioritize containment and exposure assessments around the employee and account paths tied to their reported Lapsus$ incidents, rather than treating the events solely as perimeter breaches.
- Okta customers face an immediate need for clarity on whether access to an engineer's device affected their environments; its later probe found the vendor incident lasted 25 minutes and affected two active customers.
Second-order effects
- Software companies with valuable code repositories face a more direct extortion risk, as Globant's reported breach and the alleged release of 70GB of data showed.
- Identity providers and their enterprise customers are pressed to examine third-party support and administrator access, since a compromise at a vendor can create uncertainty across customer environments.
Third-order effects
- If employee-targeted intrusion becomes a repeatable route to code and customer data, enterprise security investment will shift further toward verifying sensitive actions and limiting what individual accounts and vendor sessions can reach.
- Cybersecurity disclosures may increasingly carry operating and market consequences alongside technical remediation, as Globant's reported breach coincided with a 10% stock decline.
The trend: Data extortion is moving toward human and identity-layer access, making employee, administrator, and vendor privileges central points of enterprise risk.