{ "type": "bundle", "id": "bundle--b9e364a9-1809-5ab1-8f6b-5bd55df1e2ee", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--513f75e7-397f-587d-8608-18d665bfe323", "created": "2026-09-18T12:00:00Z", "modified": "2026-09-18T12:00:00Z", "x_ally_original_id": "org:01b86e2b-f9e1-570a-a581-9952a5dde6ef", "name": "Okta", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--4aeb5534-1739-5919-8ac4-8a0fcdbec301", "created": "2026-09-18T12:00:00Z", "modified": "2026-09-18T12:00:00Z", "x_ally_original_id": "brh:2c3831da-8640-5d53-b99b-e884c88022a5", "name": "Okta security incident" }, { "type": "incident", "spec_version": "2.1", "id": "incident--ee34443d-eda8-555f-8cff-2644c81c3b77", "created": "2026-09-18T12:00:00Z", "modified": "2026-09-18T12:00:00Z", "x_ally_original_id": "inc:b62065e9-e97f-5cca-96fc-0d655b048886", "name": "Okta security incident" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99467ee6-f388-5d7c-8c23-c5795812a1fe", "created": "2026-09-18T12:00:00Z", "modified": "2026-09-18T12:00:00Z", "x_ally_original_id": "clm:54893b7a-a235-5f52-a2b2-8f38a8af68aa", "relationship_type": "affected-organization", "source_ref": "incident--ee34443d-eda8-555f-8cff-2644c81c3b77", "target_ref": "identity--513f75e7-397f-587d-8608-18d665bfe323", "confidence": 100, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:23027d97-9bda-5396-a833-7ad87a081554", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4b75064a8fa32f9f1de7a0c506e945883004ee6c94c774e2728162a51c2643e1" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--293a91e7-4054-5e94-87fe-ce2b322befb0", "created": "2026-09-19T12:00:00Z", "modified": "2026-09-19T12:00:00Z", "x_ally_original_id": "clm:9a6e4394-6acb-5308-9be2-1ece0afef8ef", "confidence": 90, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:19ddf0d1-52a3-5248-bc98-5875b02fd04b", "description": "Our investigation determined that the screenshots, which were not contained in the Sitel summary report, were taken from a Sitel support engineer’s computer upon which an attacker had obtained remote access using RDP.", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:b7b160c75aaffc45371a8baf37d366b6e6479bff95a8c2c7ea4ed46a0d8f4740" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The retained source describes containment action intended to limit further access or disruption." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--356a9f2c-53f4-5be1-8006-58db86365f7d", "created": "2026-09-19T12:00:00Z", "modified": "2026-09-19T12:00:00Z", "x_ally_original_id": "clm:42465639-74b1-54de-a2de-a6d4666e2327", "confidence": 90, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:7be6641c-0b94-5804-bd60-ddf18ae7b3eb", "description": "Sitel informed us that they retained outside support from a leading forensic firm. - January 21, 2022, to March 10, 2022 - The forensic firm’s investigation and analysis of the incident was conducted until February 28, 2022, with its report to Sitel dated March 10, 2022. - March 17, 2022 - Okta received a summary report about the incident from Sitel - March 22, 2022, at 03:30 - Screenshots shared online by LAPSUS$ - March 22, 2022, at 05:00 - Okta Security determined that the screenshots were related to the January incident at Sitel - March 22, 2022, at 12:27 - Okta received the complete investigation report from Sitel", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:b7b160c75aaffc45371a8baf37d366b6e6479bff95a8c2c7ea4ed46a0d8f4740" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The retained source describes a forensic or specialist investigation of the incident." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--5ecc87ee-dd94-5e5e-837e-f59997193b5b", "created": "2026-09-19T12:00:00Z", "modified": "2026-09-19T12:00:00Z", "x_ally_original_id": "clm:57573bb4-7e87-5696-a8fc-8c9deb830217", "confidence": 86, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:bc0abb32-0e4c-5805-9377-027c143d4db4", "description": "Sitel, through its acquisition of Sykes, is an Okta sub-processor that provides Okta with contract workers for our Customer Support organization.", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:b7b160c75aaffc45371a8baf37d366b6e6479bff95a8c2c7ea4ed46a0d8f4740" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Lapsus$; compromised subprocessor (Sitel/Sykes) support engineer laptop." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--628c43b8-65c4-5759-8be3-d68aa9c97c31", "created": "2026-09-19T12:00:00Z", "modified": "2026-09-19T12:00:00Z", "x_ally_original_id": "clm:e943629f-d765-5d1f-9b5e-7b9d40627da1", "confidence": 88, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:1bda3473-fee1-5782-84ec-45830a3ce655", "description": "We have determined that the maximum potential impact is 366 (approximately 2.5% of) customers whose Okta tenant was accessed by Sitel.", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:b7b160c75aaffc45371a8baf37d366b6e6479bff95a8c2c7ea4ed46a0d8f4740" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Superuser access to Okta's customer support tools for approximately 5 days." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--8b0f1b8d-39d7-52e6-8528-de0d464edc02", "created": "2026-09-18T12:00:00Z", "modified": "2026-09-18T12:00:00Z", "x_ally_original_id": "clm:33318a79-caa0-5976-b76b-b848d58c5a9a", "confidence": 100, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:7e0ff429-7e6b-5a76-a1c6-3cc76d98257e", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4b75064a8fa32f9f1de7a0c506e945883004ee6c94c774e2728162a51c2643e1" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The reviewed source documents the okta security incident involving Okta." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--ed7be479-1f31-55cd-8be2-d400013966f6", "created": "2026-09-19T12:00:00Z", "modified": "2026-09-19T12:00:00Z", "x_ally_original_id": "clm:f4e2d54f-2ef8-55df-a44b-ff07523c9d98", "confidence": 100, "external_references": [ { "source_name": "Okta", "url": "https://www.okta.com/blog/company-and-culture/oktas-investigation-of-the-january-2022-compromise/", "external_id": "cit:960e210c-82dd-5d27-8662-1636982d2b32", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:b7b160c75aaffc45371a8baf37d366b6e6479bff95a8c2c7ea4ed46a0d8f4740" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2022-03-24" } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--5bf4b27e-2151-597d-8d7c-af125dbffb8e", "created": "2026-09-19T12:00:00Z", "modified": "2026-09-19T12:00:00Z", "x_ally_original_id": "evt:3b6d944a-a088-51c9-bdb9-f631186076be", "name": "Documented public update" } ] }