Okta has concluded its investigation into its recent data breach incident, concluding that it was - most likely - due to an employee storing their login credentials into their private Google profile in the Chrome browser and then logging in on a company endpoint.
In an announcement published on the Okta website, the company’s Chief Security Officer David Bradbury said the threat actor abused a service account that was stored in Okta’s system.
This account had permission to view and update customer support cases.
A handful of victims
“During our investigation into suspicious use of this account, Okta Security identified that an employee had signed-in to their personal Google profile on the Chrome browser of their Okta-managed laptop," Bradbury revealed. "The username and password of the service account had been saved into the employee’s personal Google account. The most likely avenue for exposure of this credential is the compromise of the employee’s personal Google account or personal device.”
In October, unidentified hackers broke into Okta’s customer support system, which gave them access to, among other things, client session cookies. With the help of these cookies, the attackers were able to bypass login screens and even multi-factor authentication (MFA) requirements.
The attack was first spotted by security experts from BeyondTrust, who were called in by one of their clients to inspect a hacking attempt that happened soon after an admin shared a browser recording session with Okta.
To address the problem, Okta released session token binding based on network location, Bradbury concluded. “Okta administrators are now forced to re-authenticate if we detect a network change. This feature can be enabled by customers in the early access section of the Okta admin portal.”
More from TechRadar Pro
- A major online torrent service has suffered a major data breach - check if you're affected
- Here's a list of the best firewalls today
- These are the best malware removal tools around
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.