Okta, an authentication company used by thousands of organizations around the world, has now confirmed an attacker had access to one of its employees’ laptops for five days in January 2022 — but claims its service “has not been breached and remains fully operational.”
The disclosure comes as hacking group Lapsus$ has posted screenshots to its Telegram channel claiming to be of Okta’s internal systems, including one that appears to show Okta’s Slack channels, and another with a Cloudflare interface.
Any hack of Okta could have major ramifications for the companies, universities, and government agencies that depend upon Okta to authenticate user access to internal systems.
But in a statement on Tuesday afternoon, Okta now says that an attacker would only have had limited access during that five-day period — limited enough that the company claims “there are no corrective actions that need to be taken by our customers.”
Here’s what Okta chief security officer David Bradbury says is and isn’t at stake when one of its support engineers is compromised:
The potential impact to Okta customers is limited to the access that support engineers have. These engineers are unable to create or delete users, or download customer databases. Support engineers do have access to limited data – for example, Jira tickets and lists of users – that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords.
Writing in its Telegram channel, the Lapsus$ hacking group claims to have had “Superuser/Admin” access to Okta’s systems for two months, not just five days, that it had access to a thin client rather than a laptop, and claims that it found Okta storing AWS keys in Slack channels. The group also suggested it was using its access to zero in on Okta’s customers. The Wall Street Journal notes that in a recent filing Okta said it had over 15,000 customers around the world. It lists the likes of Peloton, Sonos, T-Mobile, and the FCC as customers on its website.
In a earlier statement sent to The Verge, Okta spokesperson Chris Hollis said the company has not found evidence of an ongoing attack. “In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor.” Hollis said. “We believe the screenshots shared online are connected to this January event.”
“Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January,” Hollis continued. But again, writing in their Telegram channel, Lapsus$ suggested that it had access for a few months.
This is our 3rd attempt at sharing the 5th – 8th photo. LAPSUS$ displayed a lot of sensitive information and/or user information, so much so we end up missing to censor some.
Photos 5 – 8 attached below. pic.twitter.com/KGlI3TlCqT
— vx-underground (@vxunderground) March 22, 2022
Lapsus$ is a hacking group that’s claimed responsibility for a number of high-profile incidents affecting Nvidia, Samsung, Microsoft, and Ubisoft, in some cases stealing hundreds of gigabytes of confidential data.
Okta says it terminated its support engineer’s Okta sessions and suspended the account back in January, but claims it only received the final report from its forensics firm this week.
Update, 2:38PM ET: Added Okta’s statement and claims that the hack was very limited, with no corrective actions that need to be taken.
Update, 2:58PM ET: Added the Lapsus$ hacker group’s claim that it had access to a thin client rather than a laptop, that it found Okta storing AWS keys in Slack channels.