Id companies supplier Okta has disclosed that it detected “further menace actor exercise” in reference to the October 2023 breach of its assist case administration system.
“The menace actor downloaded the names and electronic mail addresses of all Okta buyer assist system customers,” the corporate mentioned in an announcement shared with The Hacker Information.
“All Okta Workforce Id Cloud (WIC) and Buyer Id Answer (CIS) clients are impacted besides clients in our FedRamp Excessive and DoD IL4 environments (these environments use a separate assist system NOT accessed by the menace actor). The Auth0/CIC assist case administration system was not impacted by this incident.”
Information of the expanded scope of the breach was first reported by Bloomberg.
The corporate additionally advised the publication that whereas it doesn’t have any proof of the stolen info being actively misused, it has taken the step of notifying all clients of potential phishing and social engineering dangers.
It additionally acknowledged that it “pushed new security measures to our platforms and offered clients with particular suggestions to defend towards potential focused assaults towards their Okta directors.”
Okta, which has enlisted the assistance of a digital forensics agency to assist its investigation, additional mentioned it “may also notify people which have had their info downloaded.”
The event comes greater than three weeks after the identification and authentication administration supplier mentioned the breach, which befell between September 28 to October 17, 2023, affected 1% – i.e., 134 – of its 18,400 clients.
The identification of the menace actors behind the assault towards Okta’s techniques is presently not recognized, though a infamous cybercrime group known as Scattered Spider has focused the corporate as just lately as August 2023 to get hold of elevated administrator permissions by pulling off subtle social engineering assaults.
In line with a report printed by ReliaQuest final week, Scattered Spider infiltrated an unnamed firm and gained entry to an IT administrator’s account by way of Okta single sign-on (SSO), adopted by laterally transferring from the identity-as-a-service (IDaaS) supplier to their on-premises property in lower than one hour.
The formidable and nimble adversary, in latest months, has additionally developed into an affiliate for the BlackCat ransomware operation, infiltrating cloud and on-premises environments to deploy file-encrypting malware for producing illicit income.
“The group’s ongoing exercise is a testomony to the capabilities of a extremely expert menace actor or group having an intricate understanding of cloud and on-premises environments, enabling them to navigate with sophistication,” ReliaQuest researcher James Xiang mentioned.