Okta Breach: The Identity Provider That Protects Everyone Gets Compromised
Lapsus$ gained access to an Okta customer support engineer's laptop via a subcontractor, potentially compromising the accounts of 366 Okta enterprise customers — organisations that relied on Okta for their own employees' authentication.
Background
Okta provides identity and access management for over 15,000 organisations worldwide. Its customer support engineers have the ability to view customer tenants to assist with support requests — making their access a uniquely high-value target.
The Attack
Lapsus$ compromised the laptop of a customer support engineer employed by Sitel, an Okta subcontractor. Using Sitel's remote desktop tools, they accessed the engineer's Okta dashboard, which showed customer tenant information. Screenshots taken during the access were shared publicly on Telegram in March 2022. The breach had actually occurred in January 2022 — Okta waited two months before notifying customers.
Response
Okta's delayed disclosure triggered significant customer anger. The company eventually confirmed 366 customers were potentially affected. Okta terminated its relationship with Sitel, moved all customer support functions in-house, and implemented additional controls on support tool access. CEO Todd McKinnon acknowledged the company should have disclosed faster.
Outcome
The Okta breach illustrated the "identity provider as single point of failure" risk: if an IdP is compromised, every downstream customer is at risk. The incident and delayed disclosure damaged Okta's reputation significantly and triggered stock price drops.
Key Takeaways
- Identity providers are the highest-value supply chain target — a single breach affects all downstream customers
- Subcontractor access must be scoped and monitored as strictly as direct employee access
- Rapid breach disclosure is a regulatory and ethical obligation — delays compound harm
- Support tooling that can view production customer data is extremely sensitive and must have dedicated security controls