Okta: Support system breach affected all customers

While Okta initially confirmed that a support case management system breach affected only 1% of its customers, further analysis revealed that threat actors accessed information for all customers and some Okta employees.

Last month, Okta CSO David Bradbury confirmed that attackers used stolen credentials to infiltrate the vendor's support case management system and view troubleshooting files for 134 organizations -- or less than 1% of Okta's customers. The threat actor used session cookies contained in those files to impersonate valid users. Subsequently, Okta customers including 1Password, BeyondTrust and Cloudflare revealed that they had detected and stopped Okta-related attacks.

In an updated blog post Wednesday, Bradbury revealed that the threat group accessed far more customer data than the initial investigation uncovered.

"We have determined that the threat actor ran and downloaded a report that contained the names and email addresses of all Okta customer support system users," Bradbury wrote in the blog post. "All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor)."

Okta discovered the extended attack scope after manually re-creating reports that the threat actor ran in the system and the files they downloaded. Fields in the report included company names, addresses, phone numbers and dates of last password changes.

"We identified that the file size of one particular report downloaded by the threat actor was larger than the file generated during our initial investigation. After additional analysis, we concluded that the report contained a list of all customer support system users," Bradbury wrote, adding that the discrepancy stemmed from the threat actor running an unfiltered view of the report.

Okta said the majority of the fields in the report were blank and that it did not include user credentials or sensitive personal data. For 99.6% of customers, the only information accessed was full names and emails, but that could be enough for attackers to cause damage.

Phishing emails sent with malicious attachments are commonly used in social engineering attacks. Several threat groups, including the notorious Scattered Spider, are known to leverage phishing and vishing to eventually gain admin privileges.

"While we do not have direct knowledge or evidence that this information is being actively exploited, there is a possibility that the threat actor may use this information to target Okta customers via phishing or social engineering attacks," Bradbury wrote. "Okta customers sign-in to Okta's customer support system with the same accounts they use in their own Okta org. Many users of the customer support system are Okta administrators."