Identity and access management provider Okta concluded its investigation into the January security breach of a third-party vendor by the LAPSUS$ hackers. The company stated that the hackers were able to access the laptop of a third-party customer support engineer that lasted just 25 minutes and impacted only two active customer tenants.
The impact of the incident was significantly less than the maximum potential impact the company had previously shared last month which was initially assumed to be 366.
The security event took place on January 21 when the LAPSUS$ hacking group gained unauthorized remote access to a workstation belonging to a Sitel support engineer. The news of the breach came to light nearly two months later when the adversary posted screenshots of Okta’s internal systems on their Telegram channel.
In addition to accessing two active customer tenants within the SuperUser application — used to perform basic management functions — the hacker group also have viewed limited additional information in other applications like Slack and Jira, corroborating prior reports.
According to David Bradbury, Okta’s chief security officer, the threat actor was unable to successfully perform any configuration changes, MFA or password resets, or customer support ‘impersonation’ events. They also could not authenticate directly to any Okta accounts.
Okta was criticized for its delayed disclosure and handling of the incident. The company has terminated its relationship with Sitel and will now directly manage all devices of third parties that access its customer support tools.
Comments