Lapsus$ Attack on Okta: How to Evaluate the Impact

This ThreatLabz report details a Lapsus$ intrusion involving a compromised Okta third-party support engineer account in January 2022 that exposed information from up to 366 Okta customers. The report explains Lapsus$'s low-tech but effective methods (social engineering, SIM swapping, paid insiders), notes that Okta says the impact was limited and quickly mitigated, and provides Zscaler-specific SOC playbook steps, detection queries for SIEMs, and remediation/best-practice guidance for IDP customers.