Okta now says: Lapsus$ may in fact have accessed customer info Identity management as-a-service platform Okta says the Lapsus$ extortion gang may in fact have gained unauthorized access some of its customers' data, and Microsoft has confirmed the crew got its grubby paws on some source code. An updated post detailing Okta's response to claims of an intrusion into the service sees chief …
Because Lapsus$ monitors victims' internal communications, Microsoft recommends development of an out-of-band communication plan for incident responders "that is usable for multiple days while an investigation occurs."
My former employer has gone all-in with MS so they did not replace the ageing Cisco VoIP phone network that was sort-of independent, but mandated that Teams and other MS products be used for all internal communications. The issues of 999 calls was blustered away by saying everyone will have a phone.
Should be fun to hear the outcome when they eventually get hit!
Compromises happen, even to authentication providers.
What doesn't instill trust though, has been Oktas communication about the issue.
They've gone from "no, it's just something that happened months ago that we never mentioned" to "yeah, it was months ago, and it turns out they accessed some customer data, we're making contact"
Forensic investigations take time, it's not Okta's fault they only got the report back recently, but they should have been proactively contacting customers *in january*.
They're a gateway to a myriad of other systems, there's absolutely no excuse for having left those systems at risk despite knowing that a "limited" compromise of their own systems had occurred.
All they needed to say was
"Dear customer, we've detected a possible security incident with a third party supplier, we're investigating, but please consider whether you wish to reset access credentials"
Instead they kept quiet and let their customers shoulder the risk.
Not exactly a ringing endorsement for a provider that's supposed to be part of your first line of defence
Answering my own question.......
Apparently Okta have scaled to 50 billion accounts so that suggests that 1.25 billion accounts have been accessed.
This just goes to show how you can make bad news look like good news.......
Source:
https://www.okta.com/resources/whitepaper/scaling-okta-to-billions-of-users/
Abusive comments are not helpful. The article states that 2.5% of Okta customers, there is no information
on the number of accounts, they could be tiny, they could be massive.
All I did was look at Okta's boast that they have scaled to 50 billion accounts. That puts a bit more perspective on it. It is unlikely to be 2.5% of that total but nobody appears to know how many accounts are affected and only Okta know that.
You don't need that many customers for it to be a very large number.
Percentages can make large problems sound nice and small.
This post has been deleted by its author
It's 2.5% of company accounts (so 2.5% of Okta tenants) that have been impacted. That doesn't equate to 2.5% of the total user accounts in Okta. Tenants vary wildly in size, some will be very small and some are enormous.
I've specifically asked Okta how many potential user accounts there are but so far, and as expected, they've declined to answer that.
The article estimates 375 tenants ("Okta claims to have more than 15,000 customers, so if 2.5 per cent have been compromised that could be 375 organisations")
Okta claim it's 366 tenants in their follow up post https://www.okta.com/blog/2022/03/oktas-investigation-of-the-january-2022-compromise/
"Okta claims to have more than 15,000 customers, so if 2.5 per cent have been compromised that could be 375 organisations that now need to determine if all logons to their preferred clouds – and the actions taken by authenticated users – were legitimate and/or innocuous."
But all 15,000 will need to assume they were amongst the 375.
Hmmm. "Laptop", "[external] support engineer", "customer data"... looks like those three terms always appear together in articles which also contain the term "compromised", and "[company name] takes the security of its customers' data very seriously."
I wonder why...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
