Between 28 September and 17 October 2023, an attacker had access to Okta's customer support case management system. The way in was a service account: its credentials had been saved to an employee's personal Google profile in Chrome on an Okta-managed laptop, and Okta said the most likely route to exposure was the compromise of that personal account or device. The service account could view and update support cases, and those cases held HTTP Archive (HAR) files that customers had uploaded for troubleshooting. Some of the HAR files contained session tokens. Okta said the attacker reached files belonging to 134 customers, less than 1% of its customer base, and used stolen session tokens to hijack the legitimate Okta sessions of five of them, including BeyondTrust, Cloudflare and 1Password. Okta later found that the attacker had also downloaded a report listing the names and email addresses of all its support system users. BeyondTrust first raised the alarm on 2 October; Okta confirmed the breach on 19 October.
Key takeaways
- The attacker used a stolen support service account credential that had been saved in an employee's personal Google profile on a work laptop.
- That service account could view and update customer support cases, which held HAR files containing session tokens.
- Okta said files for 134 customers were accessed and five customers' Okta sessions were hijacked with stolen tokens.
- BeyondTrust detected the attack on 2 October 2023; Okta confirmed the breach on 19 October.
- The identity lesson: a service account credential is only as safe as every place it is stored, and troubleshooting files can carry live session tokens.
At a glance
| Organisations | Okta (identity provider); affected customers including BeyondTrust, Cloudflare and 1Password |
|---|---|
| When | 28 September to 17 October 2023; disclosed 20 October 2023 |
| Attacker | Unattributed |
| Entry point | A support system service account credential saved in an employee's personal Google profile |
| Identities abused | An Okta support service account; customer session tokens in uploaded HAR files |
| Impact | Files of 134 customers accessed; five customers' Okta sessions hijacked; names and emails of all support system users downloaded |
| Category | NHI. Incident class: confirmed NHI breach (stolen service account credential and session tokens) |
What happened
On 20 October 2023, Okta said attackers had breached its support case management system using stolen credentials. "The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases," said Chief Security Officer David Bradbury, adding that the system "is separate from the production Okta service, which is fully operational and has not been impacted." BleepingComputer explained why the files mattered: customers uploaded HAR files to help Okta reproduce problems, and those files "contain sensitive data, such as cookies and session tokens, which threat actors could use to hijack customer accounts." Okta revoked session tokens embedded in shared HAR files.
BeyondTrust had spotted the attack weeks earlier. It detected an attempt on 2 October to log into an in-house Okta administrator account "using a cookie stolen from Okta's support system," and said: "We raised our concerns of a breach to Okta on October 2nd. Having received no acknowledgement from Okta of a possible breach, we persisted with escalations within Okta until October 19th." Cloudflare found related activity on 18 October, reporting that "the threat-actor was able to hijack a session token from a support ticket which was created by a Cloudflare employee."
On 3 November, Okta gave its findings: "From September 28, 2023 to October 17, 2023, a threat actor gained unauthorized access to files inside Okta's customer support system associated with 134 Okta customers, or less than 1% of Okta customers." It added that the attacker "was able to use these session tokens to hijack the legitimate Okta sessions of 5 customers." The entry point was a service account. BleepingComputer reported that the attackers "used credentials for a support service account stolen from an employee's personal Google account," and quoted Okta: "the most likely avenue for exposure of this credential is the compromise of the employee's personal Google account or personal device." Okta disabled the service account, blocked personal Google profiles in Chrome on managed devices and bound administrator session tokens to network location. On 29 November, Security Affairs reported Okta's further finding that the attacker "ran and downloaded a report that contained the names and email addresses of all Okta customer support system users."
Timeline
| Date | Event |
|---|---|
| 28 September 2023 | Attacker gains access to Okta's support system and downloads a report of support system users. |
| 2 October 2023 | BeyondTrust detects and blocks a login to an Okta admin account using a stolen cookie and alerts Okta. |
| 18 October 2023 | Cloudflare detects the attacker using a hijacked session token. |
| 19 October 2023 | Okta confirms the breach to affected customers. |
| 20 October 2023 | Okta publicly discloses the incident. |
| 3 November 2023 | Okta reports 134 customers affected and five sessions hijacked. |
| 29 November 2023 | Okta says all support system users' names and emails were taken. |
How it happened: the identity attack path
- Credential stored in the wrong place. An employee signed into a personal Google profile on a work laptop, and the support service account's credentials were saved there.
- Credential stolen. Okta said the personal account or device was the most likely route of exposure.
- Service account used. The attacker logged into the support system with rights to view and update cases.
- Session tokens harvested. Customer HAR files in support cases contained live session tokens.
- Customer sessions hijacked. Five customers' Okta sessions were hijacked, some with administrator rights.
Impact
- Customers: files belonging to 134 customers accessed; five customers' sessions hijacked.
- Data: names and email addresses of all Okta support system users, except those in its FedRAMP High and DoD IL4 environments.
- Response: Okta disabled the service account, revoked exposed tokens and added controls on managed devices and admin sessions.
What this means for NHI governance
Two non-human identities failed together. The first was a service account whose password lived in a browser profile that synced to a personal account, outside any control Okta had. The second was the session token, a credential that customers and support staff treated as troubleshooting data. A HAR file is a recording of browser traffic; if a user was logged in when it was captured, the file carries a working session.
For an identity provider, both risks are amplified: the sessions stolen belonged to administrators of customers' own Okta tenants. Service account credentials belong in a vault with no human copy, and session tokens need short lifetimes and binding to device or network. See our Service Account Security Guide and Token and Session Security Guide.
Recommendations
- Keep service account credentials out of browsers. Store them in a vault and block personal profiles on managed devices. See our Service Account Security Guide.
- Sanitise HAR files before sharing. Strip cookies, headers and tokens, and have support systems scrub them on upload. See the Token and Session Security Guide.
- Bind admin sessions. Tie tokens to device or network so a copied token fails elsewhere. See the Identity Provider and SSO Security Guide.
- Treat customer reports seriously. A customer's evidence of compromise should trigger an investigation, not an escalation queue. See the ITDR Guide.
- Revoke sessions after exposure. Any token in a shared file should be treated as leaked. See the Leaked Credential Response Playbook.
Frequently asked questions
How was Okta's support system breached in 2023?
The attacker used the credentials of a support service account that had been saved in an employee's personal Google profile on an Okta-managed laptop.
How many Okta customers were affected?
Okta said files for 134 customers were accessed and five customers' Okta sessions were hijacked. Names and emails of all support system users were also downloaded.
Why were HAR files dangerous?
HAR files record browser traffic, including cookies and session tokens. Anyone holding a file with a live session token can impersonate that user.
Related NHI Mgmt Group resources
Cloudflare Breach 2023 · MGM Resorts Breach 2023 · Service Account Security Guide · Token and Session Security Guide · Identity Provider and SSO Security Guide
How NHI Mgmt Group can help
Service accounts and session tokens are easy to lose track of. We help teams vault service credentials, shorten and bind sessions and respond fast when tokens leak. See our NHI and AI agent security training.
References
- BleepingComputer: Okta says its support system was breached using stolen credentials (20 October 2023)
- BleepingComputer: Okta breach: 134 customers exposed in October support system hack (3 November 2023)
- Security Affairs: Okta reveals additional attackers' activities in October 2023 Breach (29 November 2023)