Okta says 366 customers potentially affected in data breach

Customer data is safe, the company says. But an Okta official says it should have handled some things differently.

Okta, the identity authentication company whose customers were targeted by a prolific cybercrime group in a late-January breach, said Wednesday that 366 customers’ accounts were potentially accessed as part of the incident.

In a nine-minute Zoom call Wednesday, the company’s chief security officer, David Bradbury, said that number represents the maximum of customer accounts accessed by third-party contractors during a five-day window when hackers had gained entry to a contractor’s laptop.

Bradbury added that he was “greatly disappointed by the long period of time” between when the incident occurred and March 17, when a summary of a third-party investigation of the incident became available. An unnamed company was hired to examine what happened at Sitel Group, the Miami-based contractor providing outsourced contact center services.

“Upon reflection, once we received the Sitel summary report, we should have moved more swiftly to understand its implications,” he said.

A laptop belonging to a contractor with Sitel was accessed by the hacking group Lapsus$ in January. Lapsus$ posted screenshots of the incident to its Telegram channel earlier this week, which showed Okta’s Slack channels and a “Superuser” dashboard for Cloudlfare, a major content delivery network.

Bradbury said Wednesday that “Superuser” refers to an internal application used by employees to perform basic management functions for Okta customers. “Despite its name, this application does not provide godlike access to all its users,” Bradbury said. It does not allow for the creation or deletion of users, does not allow for the download of customer databases, or access to source code repositories, he said.

The affected customers will receive a report of all actions performed by Sitel on their accounts during the five-day period, Bradbury said. Okta has more than 15,000 customers around the world, including major firms like Cloudflare and U.S. government agencies.

Okta posted a detailed timeline of events on its blog late Tuesday.

Lapsus$ emerged in December and has racked up a string of high-profile victims in pursuit of what it says are purely financial motives. Microsoft confirmed Tuesday that the group gained access portions of its source code, without going into detail. The group claimed on its Telegram channel to have taken source code related to Bing, the company’s search engine, Bing Maps, and Cortana, the company’s virtual assistant software. The group has also targeted Samsung, Nvidia and Ubisoft, among others.

Dan Tentler, a founder of cybersecurity firm Phobos, told Wired that Lapsus$ operation was “indeed quite a big deal” depending on the level of access and privileges the contractors had to Okta customer accounts.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure