TrustedSec Okta Breach Recommendations

TrustedSec issued an urgent incident-response advisory after LAPSUS$ claimed compromise of Okta; the advisory recommends exporting and analyzing Okta system logs and remote access authentication logs, checking for anomalous geographic or “impossible travel” logins, auditing registered MFA devices and hardware token changes, rotating Okta administrator passwords, disabling suspect support/debug access, and disabling/resetting compromised accounts and sessions while investigating for lateral movement or data exfiltration.