Lapsus$ Threat Actor Demonstrates Access to Backend Okta Tooling

Okta disclosed a security incident in mid-January 2022 attributed to the Lapsus$ group in which an attacker accessed a contractor support engineer's laptop (Jan 16–21), potentially allowing password and MFA resets and impacting approximately 2.5% of core Okta customers; Okta investigated and contained the event, notified impacted customers, and the CFC (Kudelski Security) recommends searching logs for account/MFA changes, suspending suspect accounts, and engaging incident response.