Okta support system breach: HAR files with session tokens stolen
Okta Help Center (customer support system)
An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.
Why this severity: Identity provider breach; session hijacking at downstream customers
- Started
- Sep 28, 2023
- Closed
- Nov 29, 2023
Affected
Not published yet
Fixed in
No fixed release yet
Updates by day6
▸Nov 29, 2023
Link #Okta: the attacker downloaded the names and email addresses of all customer support system users
Source
▸Nov 3, 2023
Link #Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked
Source
▸Oct 19, 2023
Link #Okta notifies customers of the security incident
Source
▸Oct 18, 2023
Link #Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta
Source
▸Oct 2, 2023
Link #BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta
Source
▸Sep 28, 2023
Link #Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC
Source
Advisories3
News & write-ups3
Get an email when a new major security incident drops. No spam, unsubscribe any time.
