\n<\/p>\n
Identity and access giant Okta said a hacker broke into its customer support ticket system and stole sensitive files that can be used to break into the networks of Okta\u2019s customers.<\/p>\n
Okta chief security officer David Bradbury said in a blog post<\/a> Friday that a hacker used a stolen credential to access the company\u2019s support case management system, which contained browser recording files uploaded by Okta customers for troubleshooting.<\/p>\n Browser recording sessions (or HAR files) are used for diagnosing problems during a web browsing session, and often include website cookies and session tokens, which if stolen can be used to impersonate a real user account without needing their password or two-factor.<\/p>\n Bradbury said \u201ccustomers who were impacted by this have been notified.\u201d It\u2019s not clear how Okta\u2019s support case management system was initially compromised.<\/p>\n Okta provides organizations and companies with access and identity tools, such as \u201csingle sign-on,\u201d which allows employees access all of a company\u2019s resources on the network with one set of credentials. Okta has around 17,000 customers and manages around 50 billion users, the company said in a March 2023 blog post<\/a>.<\/p>\n Okta spokesperson Vitor De Souza told TechCrunch that around 1% of customers are affected by this breach, but declined to provide a specific number.<\/p>\n Security firm BeyondTrust, which uses Okta, said in its own blog post<\/a> that it notified Okta of a potential breach on October 2 after it detected an attempted compromise to its network a short time after an administrator shared a browser recording session with an Okta support agent.<\/p>\n BeyondTrust\u2019s chief technology officer Mark Maiffret said the hacker used a session token from the uploaded browser recording session to create an administrator account on BeyondTrust\u2019s network, which it immediately shut down. Maiffret said the incident \u201cwas the result of Okta\u2019s support system being compromised which allowed an attacker to access sensitive files uploaded by their customers.\u201d<\/p>\n Security journalist Brian Krebs first reported<\/a> the news. Krebs reported that Okta contained the incident by October 17, citing the company\u2019s deputy chief information security officer Charlotte Wylie.<\/p>\n This is the latest incident at Okta, which in 2022 said that hackers stole some of its source code<\/a>. Earlier in 2022, hackers posted screenshots showing access to the company\u2019s internal network<\/a> after hacking into a company Okta used for customer service.<\/p>\n Okta\u2019s stock closed down 11% on Friday following news of the breach.<\/p>\n Read more on TechCrunch:<\/b><\/p>\n<\/p><\/div>\n