Okta warns of "unprecedented" credential stuffing attacks on customers

Okta has observed an "unprecedented" spike in credential stuffing attacks leveraging TOR and residential proxy services (e.g., NSOCKS, DataImpulse) that successfully breached accounts for a small percentage of customers. The attacks were particularly effective against organizations using the Okta Classic Engine with ThreatInsight set to Audit-only and those that do not block anonymizing proxies; Okta recommends enabling ThreatInsight in Log and Enforce mode, denying anonymizing proxies, adopting Okta Identity Engine, multi-factor or passwordless authentication, and implementing Dynamic Zones and IP blocking.