Skip to content
Brand AI

Okta

Controversies

Controversies tied to this brand in public sources. A listing is not a finding of fault.

Back to profile3 entries

  1. 2023

    Customer support case management system compromise

    Okta disclosed that an attacker accessed its customer support case management system and viewed files uploaded by some customers. The company later issued expanded guidance as it investigated the incident and its consequences. The breach attracted significant scrutiny because Okta’s business is built around protecting identity and access.

    Source

  2. 2022

    Third-party support engineer workstation incident

    Okta reported that an attacker accessed a third-party customer-support engineer’s workstation. The company stated that the incident affected a limited number of customers. The event generated criticism and discussion concerning the timing and detail of Okta’s disclosure.

    Source

  3. 2022

    Okta investigates hacker group's data-breach claims

    Issue disclosure

    Lapsus$ claimed it targeted Okta and shared screenshots suggesting access to customer accounts. Okta said the screenshots appeared linked to a January attempt to compromise a third-party account, which it said was investigated and contained; it said there was no evidence of ongoing malicious activity beyond what was detected then.

    Company response

    • Investigation — Okta

      Okta CEO Todd McKinnon said the screenshots appear to be linked to an earlier attempt to compromise a third-party account in January, which was “investigated and contained”.

    • Clarification — Okta

      Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January.

    • Clarification — Okta

      Todd McKinnon, the CEO of Okta, took to Twitter to clarify that screenshots released by the Lapsus$ group were from the security incident that happened in January.

    • Investigation — subprocessor

      Todd McKinnon also said that the matter was contained and investigated by the subprocessor.

    Source excerpt

    • Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January.
    • Lapsus$ also claimed yesterday that it targeted Okta and shared screenshots suggesting the group gained access to Okta customer accounts.
    • Okta CEO Todd McKinnon said the screenshots appear to be linked to an earlier attempt to compromise a third-party account in January, which was “investigated and contained”.
    Source