Okta's support engineer was screen-shared into — and 366 customers were breached

In October 2022, Okta, a major identity and access management provider, disclosed that hackers had accessed its systems through a third-party customer support engineer. The hackers, linked to the Lapsus$ group, gained access to the engineer's screen during a remote support session and used that access to view Okta's internal systems.

The breach potentially affected 366 of Okta's customer organizations — approximately 2.5% of its customer base. Because Okta is an identity provider (managing login credentials for other companies), the breach had a cascading risk: if the hackers could access Okta's systems, they could potentially access the systems of Okta's customers.

Okta was criticized for its slow and incomplete disclosure of the breach. The company initially downplayed the scope, then revised its estimates upward. The case illustrated how a breach at an identity provider is qualitatively different from a breach at a regular company: the identity provider is the keys to the kingdom, and a compromise of the key master is a compromise of every door it opens.