Lapsus$ was able to infiltrate Okta’s internal system after accessing a spreadsheet of passwords on compromised Sitel’s internal network.
Sitel discovered the security incident in its VPN gateways on a legacy network belonging to Sykes, a customer service company working for Okta and acquired by Sitel in 2021.
The attackers used remote access services and publicly accessible hacking tools to compromise and navigate through Sitel’s network.
After gaining deeper visibility into the network, the hackers were able to gain access to a spreadsheet on Sitel’s internal network called “DomAdmins-LastPass.xlsx.”
The spreadsheet file contained passwords for domain administrator accounts that were exported from a Sitel employee’s LastPass password manager.
The hackers created a new Sykes user account that gives them broad access to the organization and helps keep them within the system in case they were discovered and locked out.