By 
Okta, a major provider of access management systems, confirmed that 2.5%, or around 375 customers, were impacted by a cyberattack claimed by the Lapsus$ data extortion group.
Okta admitted that they suffered a security incident in January when hackers compromised a laptop of one of its support engineers that could initiate password resets for customers.
The threat actors had access to the laptop for five days, during which they managed to access Okta's customer support panel and the company's Slack server.
As per the report, there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop.
The Lapsus$ group published screenshots which shows an email address of an Okta employee that appeared to have 'superuser' privileges that allowed them to list users, reset passwords, reset MFA, and access support tickets.
However, the company explains that if successful, such a compromise would be limited to the amount of access that support engineers have, which prevents creating or deleting users, or downloading customer databases.
Okta now confirmed that approximately 2.5% of its customers were affected by the Lapsus$ cyberattack which comes to approximately 375 organizations which may have had accounts that were compromised.
The company have identified those customers and are contacting them directly.
According to the screenshots from Lapsus$ there is also an email address of a Cloudflare employee whose password was about to be reset by hackers that compromised the account of an Okta employee.
Cloudflare later revealed that the company email account present in the screenshots was suspended about 90 minutes after its Security Incident Response Team (SIRT) received the first notification of a potential problem.
Cloudflare notes that Okta services are used internally for employee identity integrated in the authentication stack and that its customers have nothing to worry about unless they themselves use Okta.
Okta became aware of the breach attempt after detecting an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider.
The company notified the provider of the issue at the same time terminating the compromised user’s active sessions and suspending their account.
In response to Okta’s statements, the Lapsus$ group said that they did not compromise an Okta employee’s laptop but their thin client.
Lapsus$ is known mostly for leaking proprietary data stolen from big companies like Samsung, NVIDIA, and Mercado Libre. They also claimed to have breached Microsoft's internal Azure DevOps server and leaked 37 GB of source code allegedly for Bing, Cortana, and other Microsoft projects.
