LarsL.60672 (Customer) asked a question.
Any comments on the LAPSUS hack?
There are Okta screenshots and Reuters reports about an hack by the LAPSUS$ hacking group. Any comments on that?
User16370330035893835179, MauricioB.65394, and BenjaminR.74887 like this.
- User16142552977446488522 (Customer)
see Linkdin for a first response (not that helpful): https://www.linkedin.com/posts/okta-inc-_in-late-january-2022-okta-detected-an-attempt-activity-6911959838587559936-QkYT
- AlexS.24309 (Customer)
Their "official" statement. https://sec.okta.com/articles/2022/03/official-okta-statement-lapsus-claims
Not sure how no one was notified...
- SeanM.56424 (Customer)
The lack of notification is especially frustrating. I would expect customers would be informed by Okta, not Reuters. Where are the details about the "January event"? I'm not clear what data was in scope for any access for that, and I don't see any link to details for that occurrence.
- AlexS.24309 (Customer)
Agreed. I'd just recommend making sure okta support access is disabled, and only enabled as needed.
Ontop of reviewing some of this guidance from the twittersphere.
https://twitter.com/bengoerz/status/1506262107532238852?s=20&t=v7Ms1oiaB5pZSKfAov7K3g
Expand Post- AlexS.24309 (Customer)
Check your okta admin app, and see if anyone new was added
target.id eq "APPID" and target.type eq "AppInstance" and legacyEventType eq "app.generic.provision.assign_user_to_app"
- JohnN.03536 (Customer)
Some substantiation on the belief expressed in the official response would be greatly appreciated.
Did not enjoy hearing about this from end users about the same time I heard about it. Admins need to be empowered to be your advocates within our companies when events like this happen and this is not setting up for us to do so.
- BjornG.44668 (Customer)
Really would have expected some form of official communication from Okta instead about reading about in the media.
- User16142552977446488522 (Customer)
it is absolutely bizar - minimal communication and we have to help each pointing to logs etc..
- m1b9h (m1b9h)
Are there any updates or patches that need to deployed to mitigate the vulnerability that LAPSUS$ use to obtain access to Okta systems?
This question is closed.
Hi @m1b9h (m1b9h)
Sharing information to refer to that can help with your question.
There's been more recent updates to Okta statement here with additional information:
https://www.okta.com/blog/2022/03/updated-okta-statement-on-lapsus/
Also, Okta’s investigation and timeline of the January 2022 compromise:
https://www.okta.com/blog/2022/03/oktas-investigation-of-the-january-2022-compromise/
Hope this is helpful.