Okta reportedly hit in serious breach - Lapsus$ strikes again?

Data Breach
(Image credit: Shutterstock)

Cybercrime group Lapsus$ has seemingly struck again, with authentication services provider Okta reportedly the latest victim.

Reuters reports that the group posted screenshots on its Telegram channel, claiming they depict Okta’s internal company environment, including internal tickets and in-house Slack chats. 

Okta has already responded to the claims, issuing a statement saying the reports are being investigated and that it would provide updates as more information becomes available.

TechRadar needs yo...

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

In a tweet, Okta CEO Todd McKinnon said that the incident was not related to a new hack, but an earlier issue.

"In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor," he wrote.

"We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January."

Some have now questioned if this timing means Lapsus$ may in fact have had access to Okta's systems since January 2022.

Ongoing threat

Besides sharing the screenshots, the threat actor claimed to be focused “ONLY on Okta customers”. 

Whether or not the screenshots are authentic, or if any malware or viruses were used during the attack, is anyone’s guess at the moment. But given Lapsus$’ previous record, and the fact that multiple security experts seem to believe in the screenshots’ authenticity, it could very well end up being true.

Okta is an authentication services provider whose cloud software helps companies manage and secure user authentication, as well as allowing developers to build identity controls into apps, website web services, and endpoints.

It’s hard to say exactly how many customers the company is serving, but we do know that in 2019, it’s had more than 100 million registered users. It also has more than 5,000 employees, and brings in roughly $1.3 billion in revenue. 

In March 2021, the company signed a definitive agreement, acquiring Auth0, the provider of authentication and authorization services. The deal was reportedly worth $6.5 billion.

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.