10 Recommendations for Your Organization to Increase Readiness Following the Okta Breach

This advisory discusses LAPSUS$’s claimed breach of Okta—allegedly providing the group access to privileged Okta users, Okta-managed Slack and Jira, and possibly a Cloudflare tenant—and provides prioritized incident-response guidance including log acquisition and retention, proactive hunting in Okta system logs, password resets, MFA verification, third-party risk assessment, and communication/notification preparations.