Okta said the Lapsus breach that happened in January, was significantly smaller than expected. This was confirmed after a series of investigations.
According to Okta’s Chief Security Officer David Bradbury, the final forensic report showed that the attacker only accessed two active customers after the attacker had gained control of a single workstation used by an engineer working for Sitel.
Bradbury explained that “the threat actor was unable to successfully perform any configuration changes, MFA or password resets or customer support ‘impersonation’ events.”
Okta has ended its relationship with Sitel. Okta now directly manages all third-party devices with access to its customer support tools.
Bradbury said the company will instruct its service providers to meet the new security requirements, including the introduction of the Zero Trust security architecture and authentication via Okta’s IDAM solution for all workplace apps.
The sources for this piece include an article in BleepingComputer.