The latest news and developments

Explore a blend of security news, industry developments, and in-depth technical analysis of our services on Secora Consulting's blog. Bookmark this page to stay informed.

Descriptive Alt Text

Navigating the Aftermath of the Okta Data Breach

November 29, 2023 Reading Time: 3 minutes

In the rapidly evolving landscape of cybersecurity, even leading companies are not immune to data breaches. A recent incident involving Okta, a prominent identity and access management company, highlights this reality. This blog post aims to provide a comprehensive overview of the Okta data breach that occurred in October 2023, detailing the events, the impact on users, and crucial steps for those affected to mitigate risks.

Summary of What Has Happened

In October 2023, Okta disclosed a significant security breach in its customer support management system, commonly known as the Okta Help Center. The breach was initially believed to have limited impact, affecting less than 1% of Okta’s customers. However, further investigation revealed a more extensive breach than initially thought.

The threat actor involved in this incident accessed and downloaded a report containing the names and email addresses of all Okta customer support system users. This breach affected all Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers, excluding those in separate support systems used for FedRamp High and DoD IL4 environments. The Auth0/CIC support case management system was not impacted by this incident.

Though there is no direct evidence of the stolen information being actively exploited, the risk of phishing and social engineering attacks targeting these users, especially Okta administrators, has increased. It is critical to note that many of the exposed users are administrators, and a notable percentage have not activated multi-factor authentication (MFA), an essential defense against unauthorised access.

What You Need to Do if You Have Been Affected

If you are an Okta user, especially an administrator, and potentially affected by this breach, it is imperative to take immediate action:

  • Implement Multi-Factor Authentication (MFA): Secure admin access using MFA. It’s recommended to use phishing-resistant authenticators like Okta Verify FastPass, FIDO2 WebAuthn, or PIV/CAC Smart Cards.
  • Admin Session Binding: Enable the Early Access feature in Okta that requires admins to reauthenticate if their session is reused from an IP address with a different ASN (Autonomous System Number).
  • Admin Session Timeout: Align with NIST guidelines by setting admin console timeouts to a default of 12-hour session duration and a 15-minute idle time. This feature will be available for all production organisations by early 2024.
  • Increase Phishing Awareness: Be vigilant against phishing attempts targeting employees. Review IT Help Desk verification processes and ensure that appropriate checks are performed before high-risk actions like password or factor resets on privileged accounts.


The Okta data breach serves as a stark reminder of the importance of robust security measures in protecting sensitive information. While Okta has taken steps to address the breach and enhance security features, users must also take proactive measures to safeguard their accounts. Implementing MFA, staying vigilant against phishing attempts, and securing admin sessions are critical steps in mitigating the risks associated with such breaches. As the digital landscape continues to evolve, staying informed and prepared is key to navigating these challenges.

Let's Talk About Your Project

Leave us your details and one of our team will reach out to explore how we can assist with your cybersecurity requirements.

Postal address

The BASE Enterprise Centre

Railway Road


Co. Donegal


F93 VAK6

Phone number
IE: +353 74 970 7876 | UK: +44 20 4538 2818

To learn more about your data and privacy rights, visit our Privacy Statement.