LAPSUS$ Accessed Okta Support Endpoint, Exposing Customer Account Controls

The LAPSUS$ extortion group claimed access to Okta through a compromised third-party support engineer’s endpoint and published screenshots of internal communications, administrative tools, customer-management systems, and customer-account interfaces. Okta said the intrusion occurred in January 2022; its initial assessment stated the endpoint could not create or delete users or download customer information, but could reset user passwords and MFA factors.

Okta later revised its impact assessment, saying roughly 2.5% of customers may have been affected. Organizations should review retained Okta System Log records for password or MFA resets, primary-email changes, privilege grants, and administrative impersonation, particularly activity associated with support workflows. Elastic reported it had not identified malicious activity tied to the incident in its own investigations.