Okta, the San Francisco-based identity and access management company, reported a security breach on Friday. Hackers gained access to private customer information through its customer support management system.
In a site-wide announcement, Okta Chief Security Officer David Bradbury revealed that hackers viewed content uploaded by some Okta customers related to recent support cases. These files, known as HTTP archive (HAR) files, help support personnel replicate customer browser activity for troubleshooting.
SEE ALSO:23andMe may have suffered yet another breach – your data is in jeopardy"HAR files can also contain sensitive data, including cookies and session tokens, that malicious actors can use to impersonate valid users," Bradbury said.
Bradbury did not disclose how the credentials were stolen nor if two-factor authentication was in place for the compromised support system. To mitigate the damage, Okta revoked embedded session tokens and advised customers to sanitize credentials within HAR files before sharing.
According to Arstechnica, the initial hack was stopped by security firm BeyondTrust, which alerted Okta to suspicious activity about a month ago. However, due to some flaws within Okta's security model, some actions were still carried out by malicious actors.
Bradbury confirmed that all affected customers have been informed. He also provided IP addresses and browser user agents associated with the hackers for further investigation. He also added that Okta's main production service and Auth0/CIC case management system remain unaffected.
Okta has had its fair share of hacker troubles lately. In March 2022, a group called Lapsus$ accessed an Okta admin panel, allowing them to reset customer passwords and authentication credentials. In December of that same year, Okta's source code was stolen from a GitHub account.
TopicsCybersecurity
(责任编辑：探索)
U.S. pole vaulter skids to a halt for national anthem'Persona 5' explained: Is this 10010 burning questions we have about the 'Thor: Ragnarok' trailerThe Bill O'Reilly/Smash Mouth mashup nobody was asking forWatch MTV's Video Music Awards 2016 livestreamThe Weeknd teases new music in Instagram post
The Weeknd is approaching. 。 The Grammy award-winning singer looks to be in full third-studio-album m
...[详细]Completely understandable reasons why Trump and I both won't release our tax returns
President Trump has resisted extraordinary pressure to release his tax returns, and as someone who s
...[详细]Rogue deer tackles innocent man in a parking lot
Out of all of the animals in the world, deers may be the biggest jerks of them all. 。Sure, there are
...[详细]Internet angrily reminds Jeff Sessions that Hawaii is, in fact, a state
They fly the American flag in Hawaii. You can pay for things there with U.S. currency. If you're Ame
...[详细]WhatsApp announces plans to share user data with Facebook
Big changes are coming to WhatsApp. 。On Thursday, WhatsApp announced in a blog post it will begin sha
...[详细]China is dominating the world in esports earnings
As esports have evolved over the years, global player representation has soared, prize money has flu
...[详细]Man kicked out of city council meeting for trying to recreate Kendall Jenner's Pepsi ad
After Kendall Jenner's now-infamous Pepsi ad was memed to hell on Twitter, we really should have exp
...[详细]China is dominating the world in esports earnings
As esports have evolved over the years, global player representation has soared, prize money has flu
...[详细]Amazon's Echo made controlling music with your voice easy-peasy, but its sound quality could be a lo
...[详细]Watch out, Ticketmaster: SeatGeek spends $56 million on TopTix
SeatGeek is serious about defeating Ticketmaster.。 The ticketing platform just spent $56 million on
...[详细]Visualizing July's astounding global temperature records
Airline mistakenly priced Mac Pro at a whopping $4,000 discount