a subprocessor's laptop cannot reach our customers' data

what everyone assumed

You vet your vendor, the vendor vets its subprocessors, and the chain of contracts is supposed to hold the risk in place. A support contractor’s laptop feels comfortably far from your production data: it is someone else’s employee, on someone else’s device, inside someone else’s company. The distance is the reassurance. The whole point of a subprocessor is that they handle a slice of the work so it does not touch the core, and the paperwork says so.

what happened

Between January 16 and January 21, 2022, an attacker held remote access to the workstation of a support engineer at Sitel, a subprocessor Okta used for customer support, working through its Sykes subsidiary. That workstation had the access a support role needs, which meant it could reach the Okta tenants of the customers that engineer supported. Okta’s security team received an alert on January 20 about a new multi-factor factor added to a Sitel account from a new location, and the incident was contained. Then it went quiet. The scope was investigated privately, and for two months the wider world knew nothing.

how it surfaced

On March 22, 2022, the Lapsus$ group posted screenshots of Okta’s internal systems, taken from that Sitel engineer’s workstation. Okta disclosed that the maximum potential impact was 366 customers, the total whose tenants the compromised Sitel environment could have accessed during the window, though the attacker’s actual control of the workstation lasted about 25 minutes. The number that mattered was not the 25 minutes. It was that a support contractor’s laptop had sat within reach of 366 companies’ identity data all along. The assumption retired itself the moment the reach of a subprocessor’s device was drawn on a map.

A subprocessor is not far from your data.

A subprocessor is a door into it, sized to whatever access their role requires. The contract describes the boundary; it does not enforce it on the device where the work actually happens.