LAPSUS$ Breach of Okta Subprocessor Exposed Customer Support Access

Leaked documents indicate the LAPSUS$ extortion group compromised Sykes Enterprises, an Okta subprocessor owned by Sitel Group, and maintained access from January 16 to January 21 while using tools including Mimikatz and disabling security controls. Screenshots later published by the group appeared to show access to an Okta support engineer’s workstation, prompting scrutiny of whether attackers could use that access to interact with customer tenants through support channels rather than by breaching Okta’s core service directly.

Okta said its own service was not directly breached, but later acknowledged it should have communicated and acted faster after receiving Sitel’s summary report on March 17, days before LAPSUS$ published evidence of the intrusion. The company said the maximum potential impact reached 366 customers, while leaked customer notifications and an intrusion timeline raised broader concerns about Sitel/Sykes’ security posture and Okta’s handling of the incident disclosure.