Loading story…
The LAPSUS$ extortion group claimed access to Okta through a compromised third-party support engineer’s endpoint and published screenshots of internal communications, administrative tools, customer-management systems, and customer-account interfaces. Okta said the intrusion occurred in January 2022; its initial assessment stated the endpoint could not create or delete users or download customer information, but could reset user passwords and MFA factors.
Okta later revised its impact assessment, saying roughly 2.5% of customers may have been affected. Organizations should review retained Okta System Log records for password or MFA resets, primary-email changes, privilege grants, and administrative impersonation, particularly activity associated with support workflows. Elastic reported it had not identified malicious activity tied to the incident in its own investigations.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Okta said a system used by a subprocessor or third-party support engineer was compromised. The endpoint could reset user passwords and MFA factors, though Okta said the attacker did not obtain those credentials or factors.
Okta corrected its earlier assessment and said that approximately 2.5% of its customer base could potentially have been affected by the incident.
LAPSUS$ claimed it accessed Okta through the third-party support-engineer endpoint and published screenshots purportedly showing internal communications, administrative tools, customer-management tools, and customer accounts. The group said its interest was access to Okta customers rather than Okta itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked documents indicate the **LAPSUS$** extortion group compromised Sykes Enterprises, an Okta subprocessor owned by Sitel Group, and maintained access from January 16 to January 21 while using tools including `Mimikatz` and disabling security controls. Screenshots later published by the group appeared to show access to an Okta support engineer’s workstation, prompting scrutiny of whether attackers could use that access to interact with customer tenants through support channels rather than by breaching Okta’s core service directly. Okta said its own service was not directly breached, but later acknowledged it should have communicated and acted faster after receiving Sitel’s summary report on March 17, days before LAPSUS$ published evidence of the intrusion. The company said the maximum potential impact reached **366 customers**, while leaked customer notifications and an intrusion timeline raised broader concerns about Sitel/Sykes’ security posture and Okta’s handling of the incident disclosure.
Aug 14, 2026
Microsoft confirmed that **LAPSUS$** compromised a single employee account and used that foothold to gain limited access to internal source-code repositories, leading to the leak of code tied to projects including **Bing**, **Cortana**, and **Bing Maps**. The company said no customer code or customer data was affected and that the compromised account was remediated, but the incident reinforced the group’s ability to turn relatively simple access methods into high-impact breaches at globally recognized targets. Reporting across multiple investigations describes LAPSUS$ as a fast-moving **data extortion** actor that relied heavily on **social engineering**, **SIM swapping**, **credential theft**, **session-token abuse**, **MFA fatigue**, help-desk manipulation, and purchases or solicitation of insider access rather than advanced malware or ransomware deployment. The group publicly used **Telegram** to leak stolen data, pressure victims, and recruit access brokers, and it was linked to intrusions affecting organizations including **NVIDIA, Okta, Samsung, Microsoft, Vodafone Portugal, Ubisoft, LG**, and Brazil’s **Ministry of Health**; researchers said its behavior mixed financial motives with disruption, publicity, and notoriety, suggesting the threat could persist through remaining members or copycat actors even after arrests.
Aug 15, 2026
Microsoft said **DEV-0537**, also tracked as **LAPSUS$** and later **Strawberry Tempest**, ran a broad campaign of identity-driven intrusions that led to data theft, extortion, and destructive actions against organizations in government, technology, telecom, media, retail, healthcare, manufacturing, energy, and higher education. The group reportedly gained access through stolen credentials, session token replay, **MFA fatigue**, SIM swapping, help-desk social engineering, and recruiting insiders or suppliers, then moved to reconnaissance, privilege escalation, data exfiltration, and deletion of cloud and on-premises resources. Microsoft also disclosed that the actor accessed a single Microsoft account with limited permissions and viewed some source code, but said no customer code or customer data was affected. The reporting and Microsoft guidance underscore that push-based MFA abuse was a key part of the actor’s playbook, prompting stronger controls around authentication workflows. Microsoft’s Entra documentation says **number matching** is now enabled for Authenticator push notifications to replace weaker approve/deny prompts, extending across Entra MFA, self-service password reset, combined registration, and supported AD FS deployments, while older or unsupported environments may still require updates or alternate methods such as TOTP. The company recommended hardening identity protections, restricting access to trusted devices, improving cloud security posture, and preparing incident-response teams for adversaries that may monitor or interfere with response communications.
Aug 15, 2026