Summary
- Environment: Identity/IT
- Operational impact: Superuser access to Okta's customer support tools for approximately 5 days
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2022, Okta experienced an incident in its identity/it environment. The retained source describes the attack path as follows: Lapsus$; compromised subprocessor (Sitel/Sykes) support engineer laptop. [1]
The documented consequence was: Superuser access to Okta’s customer support tools for approximately 5 days. [1]
Impact
- Documented impact: Superuser access to Okta’s customer support tools for approximately 5 days. [1]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Timeline
Documented public update
The Okta’s investigation of the January 2022 compromise records the incident facts used in this briefing.
[1]Briefing updated
This briefing was last reviewed and updated on September 19, 2026.
Threat Group & Attack Vector
The retained source describes the attack path as follows: Lapsus$; compromised subprocessor (Sitel/Sykes) support engineer laptop. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- Lapsus$ — identified in the supported attack description. [1]
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The retained source describes containment action intended to limit further access or disruption. [1] The retained source describes a forensic or specialist investigation of the incident. [1]
This account is bounded to Okta’s investigation of the January 2022 compromise. Details absent from that evidence are left unresolved rather than inferred. [1]