Menu Close

Okta confirms another breach after hackers steal source code

Okta has confirmed that it’s responding to another major security incident after a hacker accessed its source code following a breach of its GitHub repositories.

The identity and authentication giant said in a statement on Wednesday that it was informed by GitHub about “suspicious access” to its code repositories earlier this month. Okta has since concluded that hackers used this malicious access to copy code repositories associated with Workforce Identity Cloud (WIC), the organization’s enterprise-facing security solution.

“As soon as Okta learned of the possible suspicious access, we promptly placed temporary restrictions on access to Okta GitHub repositories and suspended all GitHub integrations with third-party applications,” Okta said in a statement.

When asked by TechCrunch, Okta declined to say how attackers managed to gain access to its private repositories.

Okta says there was no unauthorized access to the Okta service or customer data, and products related to Auth0 — which it acquired in 2021 — are not impacted. “Okta does not rely on the confidentiality of its source code for the security of its services. The Okta service remains fully operational and secure,” Okta said.

The company said that since it was alerted to the breach, it has reviewed recent access to Okta software repositories, reviewed all recent commits to Okta software repositories, and rotated GitHub credentials. Okta said it has also notified law enforcement.

Okta did not explicitly say if it has the technical means, such as logs, to detect what, if any, of its own systems were accessed or what other data may have been exfiltrated.

The company’s latest incident was first reported by Bleeping Computer earlier this week, prior to Okta’s announcement.

Earlier this year, Okta was targeted by the now-notorious Lapsus$ extortion group, which gained access to the account of a customer support engineer at Sykes, one of Okta’s third-party service providers, and posted screenshots of Okta’s apps and systems. Okta experienced a second compromise in August this year after it was targeted by another hacking campaign that breached more than 100 organizations, including Twilio and DoorDash.

Okta confirms another breach after hackers steal source code by Carly Page originally published on TechCrunch

Okta has confirmed that it’s responding to another major security incident after a hacker accessed its source code following a breach of its GitHub repositories. The identity and authentication giant said in a statement on Wednesday that it was informed by GitHub about “suspicious access” to its code repositories earlier this month. Okta has since
Okta confirms another breach after hackers steal source code by Carly Page originally published on TechCrunch   TechCrunch 

Generated by Feedzy

Disclaimer

Innov8 is owned and operated by Rolling Rock Ventures. The information on this website is for general information purposes only. Any information obtained from this website should be reviewed with appropriate parties if there is any concern about the details reported herein. Innov8 is not responsible for its contents, accuracies, and any inaccuracies. Nothing on this site should be construed as professional advice for any individual or situation. This website includes information and content from external sites that is attributed accordingly and is not the intellectual property of Innov8. All feeds ("RSS Feed") and/or their contents contain material which is derived in whole or in part from material supplied by third parties and is protected by national and international copyright and trademark laws. The Site processes all information automatically using automated software without any human intervention or screening. Therefore, the Site is not responsible for any (part) of this content. The copyright of the feeds', including pictures and graphics, and its content belongs to its author or publisher.  Views and statements expressed in the content do not necessarily reflect those of Innov8 or its staff. Care and due diligence has been taken to maintain the accuracy of the information provided on this website. However, neither Innov8 nor the owners, attorneys, management, editorial team or any writers or employees are responsible for its content, errors or any consequences arising from use of the information provided on this website. The Site may modify, suspend, or discontinue any aspect of the RSS Feed at any time, including, without limitation, the availability of any Site content.  The User agrees that all RSS Feeds and news articles are for personal use only and that the User may not resell, lease, license, assign, redistribute or otherwise transfer any portion of the RSS Feed without attribution to the Site and to its originating author. The Site does not represent or warrant that every action taken with regard to your account and related activities in connection with the RSS Feed, including, without limitation, the Site Content, will be lawful in any particular jurisdiction. It is incumbent upon the user to know the laws that pertain to you in your jurisdiction and act lawfully at all times when using the RSS Feed, including, without limitation, the Site Content.  

Close Bitnami banner
Bitnami