# Okta support system breach: HAR files with session tokens stolen · pwn.watch > An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users. Page: https://pwn.watch/i/okta-support-system-breach-2023 · generated 2026-10-22T20:45:43.249Z ## Status - Severity: high · status: closed · patch: no-fix-needed - Product: Okta Help Center (customer support system) - Started: 2023-09-28 · closed: 2023-11-29 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/okta-support-system-breach-2023/feed.xml - JSON Feed: https://pwn.watch/i/okta-support-system-breach-2023/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/okta-support-system-breach-2023.json - This file: https://pwn.watch/i/okta-support-system-breach-2023/llms.txt ## Updates (newest first) - 2023-11-29: Okta: the attacker downloaded the names and email addresses of all customer support system users (https://sec.okta.com/articles/october-security-incident-recommended-actions/) - 2023-11-03: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked (https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/) - 2023-10-19: Okta notifies customers of the security incident (https://sec.okta.com/harfiles) - 2023-10-18: Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta (https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/) - 2023-10-02: BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta (https://www.beyondtrust.com/blog/entry/okta-support-unit-breach) - 2023-09-28: Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC (https://sec.okta.com/articles/october-security-incident-recommended-actions/) ## Fix brief # Security brief: Okta support system breach: HAR files with session tokens stolen Source: https://pwn.watch/i/okta-support-system-breach-2023 · status: closed (closed Nov 29, 2023) · severity: high · updated Nov 29, 2023 ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users. Severity detail: Identity provider breach; session hijacking at downstream customers - Product: Okta Help Center (customer support system) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Nov 29, 2023: Okta: the attacker downloaded the names and email addresses of all customer support system users - Nov 3, 2023: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked - Oct 19, 2023: Okta notifies customers of the security incident - Oct 18, 2023: Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta - Oct 2, 2023: BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta - Sep 28, 2023: Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC ## Advisories - [Tracking Unauthorized Access to Okta's Support System](https://sec.okta.com/harfiles) (Okta) - [Unauthorized Access to Okta's Support Case Management System: Root Cause and Remediation](https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/) (Okta) - [October Customer Support Security Incident - Update and Recommended Actions](https://sec.okta.com/articles/october-security-incident-recommended-actions/) (Okta) ## Write-ups & news - [BeyondTrust Discovers Breach of Okta Support Unit](https://www.beyondtrust.com/blog/entry/okta-support-unit-breach) - [How Cloudflare mitigated yet another Okta compromise](https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/) - [Okta says hackers stole data for all customer support users in cyber breach](https://www.reuters.com/technology/cybersecurity/okta-says-hackers-stole-data-all-customer-support-users-cyber-breach-2023-11-29/) --- Machine-readable: https://pwn.watch/i/okta-support-system-breach-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.