Top 7 recs for responding to the Lapsus$ breach claims

This advisory discusses the Okta/Lapsus$ compromise claims and Okta’s ongoing investigation (as of March 23, 2022), and provides seven prioritized recommendations—rotate privileged credentials and API tokens, restrict Okta support access, review admin/authentication logs for specific event types, enforce and expand MFA (prefer FIDO), configure network zones, establish/test incident response retainers and plans, and communicate transparently with stakeholders.