https://pwn.watch/t/1password Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 29 Nov 2023 00:00:00 GMT https://pwn.watch/i/okta-support-system-breach-2023 https://pwn.watch/i/okta-support-system-breach-2023 Wed, 29 Nov 2023 00:00:00 GMT high <p>An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2023-11-29: Okta: the attacker downloaded the names and email addresses of all customer support system users (<a href="https://sec.okta.com/articles/october-security-incident-recommended-actions/">source</a>)</li><li>2023-11-03: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked (<a href="https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/">source</a>)</li><li>2023-10-19: Okta notifies customers of the security incident (<a href="https://sec.okta.com/harfiles">source</a>)</li></ul>