Hackers Stole Access Tokens from Okta’s Support Unit
Summary: Okta suffered a breach of its customer support case management system after an attacker used a stolen credential to view files customers had uploaded with support cases, and the company says the intruder had access to the platform for at least two weeks before containment. BeyondTrust's CTO said his firm detected on Oct. 2 that someone was trying to create an administrator account using an engineer's Okta account, 30 minutes after that engineer shared a HAR file containing a valid Okta session token at Okta's request, and Okta identified and contained the incident by Oct. 17.
Key Takeaway: Okta told TechCrunch it notified about 1 percent of its customer base, roughly 170 of more than 18,000 customers, and 1Password and Cloudflare have since disclosed compromises of their Okta authentication platforms - so the blast radius of a support-ticket file upload is measured in identity providers, not documents.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026