Okta blames employee for hack

Okta is blaming a recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop, exposing credentials that led to the theft of data from multiple Okta customers.

In a brief post-mortem, Okta security chief David Bradbury said the internal lapse was the “most likely avenue” for the breach that affected hundreds of Okta customers, including cybersecurity companies BeyondTrust and Cloudflare.

The threat actor gained unauthorized access to files inside Okta’s customer support system from September 28 to October 17, 2023. Some of these files contained session tokens that could be used for session hijacking attacks.

Bradbury said the threat actor was able to hijack the legitimate Okta sessions of five customers. The hackers leveraged a service account stored in the system itself that was granted permissions to view and update customer support cases.

Bradbury said the most likely avenue for exposure of this credential is the compromise of the employee’s personal Google account or personal device.

The employee had signed in to their personal Google profile on the Chrome browser of their Okta-managed laptop. The username and password of the service account had been saved into the employee’s personal Google account.

Bradbury admitted to a failure of internal controls to spot the breach.

The sources for this piece include an article in SecurityWeek.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web