Digital authentication firm Okta has revealed that up to 366 customers have faced the security breach caused by a hacking group known as Lapsus$.
Okta Chief Security Officer David Bradbury — in a series of blog posts — said the potential impact was to 366 customers whose data was accessed by an outside contractor, Sitel.
The contractor employed an engineer whose laptop the hackers had hijacked, he added.
The 366 number represented a worst case scenario, Bradbury cautioned, adding that, in any case, the hackers had been constrained in their range of possible actions.
Okta, based in San Francisco, helps employees of more than 15,000 organizations securely access their networks and applications, so a breach at the company could lead to serious consequences across the Internet.
Bradbury said the intrusion would not have given god-like access to the intruders as they would have been unable to perform actions such as downloading customer databases or accessing Okta’s source code.
Okta noticed the breach in January, while the Miami-based Sitel Group only received a forensic report about the incident on March 10, giving Okta a summary of the findings a week later.
Bradbury said he was disappointed by the long period of time that transpired between our notification to Sitel and the issuance of the complete investigation report.
