Security alert: Okta “support user” data theft

Okta disclosed that in October a threat actor ran a report on its support system and obtained details for all customer support users (names, phone numbers, addresses); the attacker also attempted to create new admin users. Okta and defenders updated detections (including for stolen session cookie usage), reviewed customer environments for indicators, and recommend hardening admin MFA, testing password-reset processes, and reinforcing phishing defenses to mitigate social-engineering-based abuse of the stolen data.