Okta concludes investigation into alleged Lapsus$ security breach | #computerhacking | #hacking


After security alarm bells rang following an undisclosed months-old breach, Okta’s investigation concluded that the impact was less severe than first feared

Pro

Image: Getty/Dennis


Okta has announced the conclusion of its investigation into a breach of its systems by the Lapsus$ hacking group, saying the scope of the attack is far smaller than originally predicted.

Okta and the outside digital forensics company it hired to support the investigation, believed to be Mandiant, concluded hackers were able to control just a single computer belonging to a Sitel support engineer for 25 minutes on 21 January 2022.

This computer had access to Okta’s resources but the hacker was only able to access a total of two customer tenants during that 25-minute window, many fewer victims than the hundreds it originally believed to have been affected. Okta said both of these customers have been notified privately.

 
advertisement


 

The hackers were unable to perform any configuration changes, reset any multi-factor authentication (MFA) passwords, or impersonate customer support with Okta customers, it said.

The identity and access management company admitted that although the impact is much less severe than originally thought, it understands “the broad toll” such a breach could have on its customers.

Going forwards, Okta said it is strengthening its audit procedures for sub-processors, will directly manage all devices of third parties that access Okta customer support tools, and review its customer communication process to ensure a similar event is prevented in future.

“Okta’s customers are our pride, purpose, and #1 priority. It pains us that, while Okta’s technology excelled during the incident, our efforts to communicate about events at Sitel fell short of our own and our customers’ expectations,” said David Bradbury, chief security officer at Okta.

“Okta’s leadership team has met with thousands of customers over the past few weeks to talk through our response directly. We conclude this investigation with a far stronger partnership and a sense of a shared journey with our customers. We recognise how critical Okta is to so many organisations and the individuals who rely on them, and are more determined than ever to deliver for them.”

© Dennis Publishing

Read More: cyber security LAPSUS$ Okta security






Original Source link




Leave a Reply

Your email address will not be published.

forty three − forty =