Following Okta’s most recent data breach that impacted nearly 200 customers and cost the company over $2 billion, critical security gaps have been at the forefront of their issues. However, new discoveries have been uncovered that reveal the initial source of their breach.
Notably, this breach originated from the compromise of an Okta employee, who inadvertently logged into the service account while using their personal Google profile in Chrome on an Okta-managed laptop. This lapse in security allowed the attacker to gain access to the service account credentials, although the precise method remains unclear.
Why it matters: This breach emphasizes the connection between personal and professional technology use. Employees often blur the lines between work and personal devices, posing a security challenge for organizations.
- Once inside, the attacker used session tokens found in HTTP Archive (HAR) files to impersonate staff members and take control of legitimate Okta sessions, affecting five customers, including 1Password, BeyondTrust, and Cloudflare. In response, Okta has taken steps to prevent the use of personal Google profiles on company-managed computers, aiming to enhance security.
- In addition, Okta has implemented additional controls like requiring re-authentication for admin accounts when networks change. The company aims to prevent similar breaches by enhancing security around employee devices and accounts.
- This breach underscores the pressing need for organizations to implement robust security measures and stringent employee training programs to prevent the inadvertent blending of personal and professional technology, ensuring the protection of sensitive customer data.
Go Deeper —> Okta breach happened after employee logged into personal Google account – MalwareBytes
