Loading story…
Leaked documents indicate the LAPSUS$ extortion group compromised Sykes Enterprises, an Okta subprocessor owned by Sitel Group, and maintained access from January 16 to January 21 while using tools including Mimikatz and disabling security controls. Screenshots later published by the group appeared to show access to an Okta support engineer’s workstation, prompting scrutiny of whether attackers could use that access to interact with customer tenants through support channels rather than by breaching Okta’s core service directly.
Okta said its own service was not directly breached, but later acknowledged it should have communicated and acted faster after receiving Sitel’s summary report on March 17, days before LAPSUS$ published evidence of the intrusion. The company said the maximum potential impact reached 366 customers, while leaked customer notifications and an intrusion timeline raised broader concerns about Sitel/Sykes’ security posture and Okta’s handling of the incident disclosure.
See attribution, scope, and your downstream exposure.
10 events from the most recent confirmed update back to the earliest known activity.
The reference states that LAPSUS$ targeted Globant and that the attack became public on March 30, 2022. Globant acknowledged unauthorized access to a limited section of its code repository, with source code and project documentation for a very limited number of clients exposed.
By March 28, 2022, Okta said it should have moved more quickly after receiving information about the incident and stated that the maximum potential impact reached 366 customers. The reassessment followed criticism of its initial handling and messaging.
After learning of the Okta-related compromise on March 22, 2022, Cloudflare opened an incident investigation, suspended potentially affected accounts, and forced password resets for 144 employees who had changed passwords or MFA settings since December 1, 2021. Cloudflare later said Okta confirmed there were no relevant malicious support-console events for Cloudflare instances and that it did not believe Cloudflare had been compromised.
Okta published an updated public statement on March 22, 2022, addressing the LAPSUS$ incident. In its response, the company acknowledged the issue involved a third-party support provider rather than a direct breach of Okta's core service.
On March 21, 2022, LAPSUS$ posted screenshots appearing to show access related to Okta support systems. The publication brought broad public attention to the earlier Sykes compromise.
Okta said it received Sitel's summary report about the Sykes intrusion on March 17, 2022. Leaked materials also reference a March 17 intrusion timeline reportedly produced by or based on data gathered by Mandiant.
Microsoft confirmed that LAPSUS$ gained limited access to its environment through a single compromised account and said no customer code or customer data was involved. The company said the account had been remediated and characterized the actor as focused on extortion and destructive activity rather than ransomware deployment.
A leaked customer notification indicates Sykes informed customers about the breach on January 25, 2022. The notice concerned the January compromise later linked to LAPSUS$.
Between January 16 and January 21, 2022, the attackers reportedly used common tools including Mimikatz and disabled security controls while operating in Sykes' environment. The activity was tied to the later-publicized incident involving Okta's subprocessor.
According to the leaked intrusion timeline, attackers were active in Sykes Enterprises' environment beginning on January 16, 2022. The compromise affected a Sykes employee account used to provide support for Okta customers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
cloudsek.com
Open sourcewired.com
Open sourcethehackernews.com
Open sourceokta.com
Open sourcemicrosoft.com
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The LAPSUS$ extortion group claimed access to Okta through a compromised third-party support engineer’s endpoint and published screenshots of internal communications, administrative tools, customer-management systems, and customer-account interfaces. Okta said the intrusion occurred in January 2022; its initial assessment stated the endpoint could not create or delete users or download customer information, but could reset user passwords and MFA factors. Okta later revised its impact assessment, saying roughly **2.5%** of customers may have been affected. Organizations should review retained Okta System Log records for password or MFA resets, primary-email changes, privilege grants, and administrative impersonation, particularly activity associated with support workflows. Elastic reported it had not identified malicious activity tied to the incident in its own investigations.
Sep 9, 2026
Microsoft confirmed that **LAPSUS$** compromised a single employee account and used that foothold to gain limited access to internal source-code repositories, leading to the leak of code tied to projects including **Bing**, **Cortana**, and **Bing Maps**. The company said no customer code or customer data was affected and that the compromised account was remediated, but the incident reinforced the group’s ability to turn relatively simple access methods into high-impact breaches at globally recognized targets. Reporting across multiple investigations describes LAPSUS$ as a fast-moving **data extortion** actor that relied heavily on **social engineering**, **SIM swapping**, **credential theft**, **session-token abuse**, **MFA fatigue**, help-desk manipulation, and purchases or solicitation of insider access rather than advanced malware or ransomware deployment. The group publicly used **Telegram** to leak stolen data, pressure victims, and recruit access brokers, and it was linked to intrusions affecting organizations including **NVIDIA, Okta, Samsung, Microsoft, Vodafone Portugal, Ubisoft, LG**, and Brazil’s **Ministry of Health**; researchers said its behavior mixed financial motives with disruption, publicity, and notoriety, suggesting the threat could persist through remaining members or copycat actors even after arrests.
Aug 15, 2026
A series of social-engineering campaigns targeted organizations that relied on **Okta** and similar identity systems, using SMS phishing, fake login portals, and later voice calls impersonating IT staff to steal credentials, MFA codes, and session tokens. Group-IB said the **0ktapus** operation targeted **136 organizations**, used **169** lookalike domains, and compromised thousands of accounts, with victims concentrated in technology, software, and cloud sectors in the United States and Canada. Reporting tied the same activity to breaches at **Twilio**, **Cloudflare**, **DoorDash**, and later **Coinbase**, where an attacker obtained an employee username and password and accessed limited corporate directory data but was blocked from broader access by MFA controls and incident response. Subsequent reporting described an evolution from SMS phishing to **vishing** and adversary-in-the-middle phishing kits that mirrored corporate SSO flows in real time, enabling theft of session tokens even after MFA was completed. Mandiant and other researchers linked a 2026 wave under the **ShinyHunters** banner to more than **400 organizations**, with attackers using branded phishing sites, harvesting cloud data from **SharePoint**, **OneDrive**, **Salesforce**, and **Slack**, and following theft with extortion demands. Across the incidents, phishing-resistant **FIDO2** security keys stood out as an effective defense, while earlier disputes over Okta-related intrusions, including claims by **Lapsus$**, underscored how compromises of identity providers and support channels can cascade into downstream customer exposure.
Jun 29, 2026