ClosedHighNo fix needed
Day · Nov 3, 2023
Okta support system breach: HAR files with session tokens stolen
Okta Help Center (customer support system)
Updates on Nov 3, 2023
Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked
Source
Summary
An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.
Read the full incident →
