how it happened
- whoattackerservice account credentials
- the gapsupport systemcustomers' HAR files
- thencustomer sessionsno password or MFA needed
- the result134 customers, later all users' namesfound by customers
what everyone assumed
Sending a diagnostic file to your identity provider’s support team feels like handing a document to a locked filing cabinet. The vendor is the one you trust with authentication itself, so its support portal inherits that trust, and a HAR file feels like debug data rather than a live credential. It is a reasonable assumption, because you are troubleshooting with the company whose entire product is proving who you are.
what happened
Between September 28 and October 17, 2023, a threat actor had access to files inside Okta’s customer support case management system. The access came through a service account whose credentials had been saved into an employee’s personal Google account after they signed into that profile on their work laptop. Some of the files in reach were HAR files, and some of those HAR files still held valid session tokens. The tokens did what tokens do: they let the attacker resume a session without a password or a second factor, against the customers whose files carried them.
step by step
- a service account's password is saved to a personal Google profileSigned into on a work laptop.
- 28 Sep to 17 Oct 2023the attacker reads support case filesSome HAR files still hold valid session tokens.the assumption breaks here
- tokens resume sessions without password or MFA1Password, BeyondTrust and Cloudflare spot the activity first.
- 134 customers' files accessed, 5 sessions hijackedAfter a logging gap is closed, more downloaded files turn up.
how it surfaced
The surfacing came from the customers. On September 29, 2023, 1Password reported suspicious activity. BeyondTrust reported next, and on October 13 handed Okta an attacker IP address that let Okta find the file-access events its own logs had missed for fourteen days. The first count settled at 134 customers with a file accessed and 5 whose sessions were hijacked, Cloudflare identified last. Then the scope widened: after Okta closed a gap in the support-vendor logs on October 18, it found additional downloaded HAR files it had not seen before, and revoked the tokens inside them. The assumption retired itself in that correction, the one where a debug attachment turned out to be a working key.
A file uploaded to support is only as harmless as what it contains, and a browser recording can contain a live session.
The trust you place in an identity vendor does not sanitize the artifacts you send it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe vendor's support system is breached and the file is read.what it costs youThe attacker uses the session to step into your systems without a password.
- or it goes like thisit happenedReddit, 2023howA fake login page passes the password and code to the real site as they are typed.what leavesinternal documents, code and dashboardswho ends up with itthe attacker behind the page
- or it goes like thisit happenedUber, 2022howLogin prompts keep coming until a tired employee taps approve.what leavesadmin tools and company chatwho ends up with itan attacker who bought a contractor's password
sources
your turn
what you can do about it
this week
Check whether your team scrubs tokens and cookies before sending diagnostics, and confirm how a subprocessor would tell you if their support system were breached.
Your team uploads HAR files, logs, and config dumps to vendor support portals whenever something breaks, and most of those files are never sanitized first. The quiet-months question is what a session token inside one of them would still open if it leaked, and how long your sessions stay valid. The customers who recovered fastest already knew which of their files could carry a credential.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →