Okta hit by third-party breach, stealing employee data

https://arstechnica.com/security/2023/11/okta-hit-by-another-breach-this-one-stealing-employee-data-from-3rd-party-vendor/

by Brajeshwar • 3 years ago

202 89 3 years ago

arstechnica.com

gumballindie• 3 years ago

Okta is so lame no wonder is so popular among corporate mediocrity.

danielmarkbruce2• 3 years ago

Out of interest - what makes you say this? I'm not disagreeing, just want to understand the general (and seemingly commonly held) belief that they suck.

mc322• 3 years ago

They have lots of ready to go connectors which makes it easy to integrate lots of apps instead of figuring out all the SAML settings... but any SAML provider will work as long as you can map the right fields. But people like easy things and Okta makes it easy. Many apps who don't have a connector will have docs on how to set things up with Okta, for others you'll have to take the Okta instructions and figure out what that means for an alternate provider. There are other things like counter-signatures which may be easier to do with Okta but also possible with others, if you have the right docs.

starttoaster• 3 years ago

As far as SaaS SSO providers go, I think they're pretty cool. But all the breach related news lately has me wondering what the best alternatives are. You sound like you would have opinions.

PaulWaldman• 3 years ago

What is your preferred alternative?

dijit• 3 years ago

Out of interest, why would you not just use the directory services that you get bundled with google workspace, azureAD (Now: Entra) or freeipa/keycloak?

All of these support oauth2 and SAML, and dynamic groups for less than the cost of each and okta (it seems to be the case everywhere I have seen okta used, another of the above providers is used additionally).

agilob• 3 years ago

Again? Does anyone keep a list of all their breaches and hacks? The one on wiki doesn't seem complete https://en.wikipedia.org/wiki/Okta,_Inc.#Security_incidents

Aaronstotle• 3 years ago

Not really Okta's fault here, just so happened that Okta was a client of this benefits company. Still, not a good look for Okta.

jlarocco• 3 years ago

Does that matter, though? The message I get is that Okta isn't good with security, and they're not good at choosing vendors who are good with security.

clintonb• 3 years ago

Yes, context matters. If you discount every company that might be impacted by a third-party breach of employee data, you will be left with no vendors. At some point you have to decide what is acceptable, and have insurance/indemnity for the risks.

I would not discount Okta because of a decision made by HR.

handsclean• 3 years ago

There are two types of people, people who take responsibility for things that aren’t directly their fault, and people who regularly experience negative outcomes.

Okta chose this vendor and they chose to have them store this data. They probably even have security requirements in their contract with them. They could have prevented this. And when you present yourself as a security company, you’re expected to.

cheschire• 3 years ago

There are two types of people, those who express everything in dichotomies, and those who don't, and those who start indexing at zero.

anotherhue• 3 years ago

I guess we have to decide if as customers, our security is treated better or worse than their employees'.

purpleblue2• 3 years ago

We have no evidence to suggest that your personal information has been misused against you.

What a fucking horribly disingenuous statement. They are trying to say that nothing bad happened, but their SSN and information was stolen!! The information is going to be sold and at a later date it could be used. But they're not saying that, they're trying to say "Nothing to see here, your information wasn't misused so don't worry!" I would never trust them after giving this statement.

vineyardmike2• 3 years ago

Not to discount your point- you’re right it’s so disingenuous.

BUT we’re quickly approaching a world where every American has been in a leak that affects their data and SSN. Not 100% of course (simply because young people haven’t had a chance to be screwed over) but at some point we should assume that the information is public for a large enough portion of the population and we need to set new expectations.

deathanatos• 3 years ago

we’re quickly approaching a world where every American has been in a leak that affects their data and SSN. Not 100% of course (simply because young people haven’t had a chance to be screwed over)

… that number, presently, has to be a rounding error from being 100%. My SSN was first breached when I was in high school, at least.

But yeah, I agree, we should set new expectations. There could definitely be a better system, and I would like to see companies held to account, but material fines against corps are basically unicorns in America.

SoftTalker• 3 years ago

The bigger question for me is, "why is my SSN still such a valuable bit of information"

We, the IT industry, have demonstrated repeatedly that we are not smart enough and/or not diligent enough to consistently protect this information. I think we should admit that and try the reverse approach: make knowledge of our PII worthless for committing fraud and theft. We need to fundamentally shift our methods of proving identity to something that doesn't rely on keeping a 9-digit number a secret.

purpleblue2• 3 years ago

This is the dangers of a too-powerful bureaucracy.

It's obvious that having the SSN as a single point of failure is exceedingly stupid, but our government bureaucrats refuse to do anything about it. You can't even request a new SSN, it's practically impossible to get a new one even if your identity is stolen.

The only thing holding us back is red tape, which is the dumbest reason of all.

bee_rider6• 3 years ago

That’s a bigger questions, and it is a good one, but practically it is not really relevant (other than, I guess, Okta’s vendor has made a small contribution to making it obvious how ill suited these numbers are for authentication).

ls612• 3 years ago

Because the US has a political aversion to centralized IDs at the federal level, but an identity provider of some sort is necessary for lots of business interactions.

mbwgh• 3 years ago

But this kind of statement is the unfortunate industry standard. A more honest thing to say would be to say "there is no way to prove that your personal information has been or may yet be misused against you, and as such you should take the following steps to minimize risks [...]".

But compare how that looks compared against the bigger players which can afford to treat their weekly apocalyptic security incidents like it's just a bad weather phenomenon we just have to accept, apply a patch for and move on.

0xbadcafebee• 3 years ago

Did anyone read the article? It's literally not a compromise of Okta. It's a compromise of a healthcare provider that Okta is a customer of. Has absolutely nothing to do with Okta's products, at all, whatsoever.

This is bordering on yellow journalism. I am all for giving shitty companies their due when they fuck up, but that's not what this is at all.

bastard_op• 3 years ago

A friend of mine jokingly told me they got a "confidential" report from Okta today that apt actors were up in them for 3 weeks. I wonder who all else got this, said friend is at a high-profile enterprise/retail account for them.

graypegg• 3 years ago

If this is directly related to negligence at Okta or not (which seems like it’s not in this case) doesn’t really matter when “Okta” and “Data Breach” seem to show up close together in headlines a lot.

Rough task for people tasked with holding together the “brand”

libraryatnight• 3 years ago

It'd be more forgivable if they weren't so bad at listening to their customers when they report things, technical or security related.

The best thing Okta has going for them right now is that a lot of these companies are so bloated and slow that changing platforms takes a long time to pull off even the initial agreement that they'll be changing, so they have plenty of time to let things settle even if you're mad at them because switching everything to a new idp is "just not something the business can prioritize right now"

They probably look like hot garbage to customers shopping around but I'd venture with most existing clients over a certain size they'll just ask them for a statement they can email out then the Okta sales guys will treat a few directors to happy hour and a ball game, delaying the long process of being dumped from even starting.

bee_rider6• 3 years ago

“The types of personal information contained in the impacted eligibility census file included your Name, Social Security Number, and health or medical insurance plan number,” a letter sent to affected Okta employees stated. “We have no evidence to suggest that your personal information has been misused against you.”

That seems like a pretty ridiculous statement. Is it supposed to be reassuring or something? Like, obviously Okta has no way of knowing whether or not their employees PII, having been leaked, will be exploited, and when it does get exploited, it almost certainly will be the employees who find out about it, not Okta.

constantly• 3 years ago

Sounds like the statement is referencing the past not the future. I think it’s a reasonable thing for them to say: this was stolen, and that sucks, but perhaps a little reassuringly we haven’t detected this being misused. idk.

bee_rider6• 3 years ago

To the extent that it is reassuring, it is misleading, right? Unless they have some way of being reasonably sure that the fact that they haven’t detected misuse implies that it hasn’t happened.

ryanisnan5• 3 years ago

What a misleading and click-baity title choice by Ars Technica.

This had nothing to do with Okta's platform, as implied. A third-party Vendor Okta used for health insurance information was breached, and personal information on Okta employees was stolen.

I'm disappointed in Ars Technica, and Dan Goodin.

edit: Updated to be more specific about what part of Okta this had nothing to do with.

ta1243• 3 years ago

Okta (or any company) can't outsource its responsibility when it outsources to a supplier.

If Okta printed all that personal data and left it in a box on the street they would be liable.

ryanisnan5• 3 years ago

Ok, but that's not what the article says. It says Okta was breached. Okta was not breached.

paulddraper• 3 years ago

Re-read the above comment.

Okta the company had a breach.

Okta the platform did not.

Employee data vs customer data

api• 3 years ago

Maybe someone is short selling.

eli• 3 years ago

The truth is usually less exciting.

OJFord• 3 years ago

Someone(s) almost certainly (are), not necessarily relatedly (to the article, to the breaches, yeah absolutely), what a pointlessly vague thing to say.

lofatdairy• 3 years ago

The concept of journalists trading on the news they break is coincidentally making waves right now with this new startup called Hunterbrook[^1]. I assume that outright misleading headlines won't be something they'd risk, but it's an interesting concept, since, yeah normally this is something you'd accuse someone of, and not expect that to be the whole point.

[^1]: https://www.ft.com/content/3c861c6c-87be-459d-b62f-b44bf2d75...

coldcode2• 3 years ago

https://www.rightwayhealthcare.com is the company mentioned in the article. Okta is shown as a customer on the website, and the company's marketing says "Our members love using Rightway". There is zero mention of security on their website that I see, but the website is entirely marketing and self-congratulatory. I would expect that other Rightway customers were likely also affected, but they had no comment mentioned in this article so how wide the breach was is unknown. Okta is a well-known company so that's why this article focused on them, which is not the real story, but I guess like you said clickbait.

coldcode2• 3 years ago

Okta is promoting Rightway as a benefit of Okta: https://rewards.okta.com/us/healthcare/medical/rightway-heal...

urda• 3 years ago

Honestly Ars has really fallen in the past few years.

chriscjcj• 3 years ago

ARS commenters seem to have created a very specific kind of echo chamber and they guard it passionately, fiercely rebuking any and all dissenting opinions into oblivion. Sadly, ARS writers seem motivated to cater these folks' predilections. Sometimes it seems like they write articles with little purpose other than to provide grist for their beloved mob's mill. Perhaps these journalists are rewarded for 'high audience engagement.'

So glad HN hasn't devolved into that. Gratitude to the mods here.

dang• 3 years ago

Thanks. I've belatedly changed the title above.

dr_faustus2• 3 years ago

I don’t know why people are all pretending like this is irrelevant to Okta's security.

An employee list like that is a goldmine for all sorts of social engineering and phishing attacks.

nakon• 3 years ago

It’s not that it isn’t relevant, it’s the clickbait-y headline and insinuation that Okta itself was compromised again. Any major company using third-party vendors would be in the same position (and for all we know, this healthcare company provided services to multiple other companies). Fault Okta for not doing enough vendor due diligence, sure, but don’t use clickbait to imply Okta itself was breached.

ryanisnan5• 3 years ago

The real takeaway for Okta in 2023, if they didn't know it already, is they are dealing with nation state threat actors, and if they think they are over-investing in security, they probably aren't.

dr_faustus2• 3 years ago

Be it as it may, it does not really matter, whether it came from a Okta database or of any other company. It further compromises Okta's security which is pretty bad because being secure is basically their primary service proposition.

BeefWellington2• 3 years ago

Firstly, the title literally does what you're asking:

Okta hit by another breach, this one stealing employee data from 3rd-party vendor

You have to read the whole thing.

Secondly, let's assume you were right and the title was simple "Okta hit by another breach" and there were no other words.

Do you not view it as problematic that the company has in two months had a major compromise of its own services via phishing, as well as that of a company supplying health-related services to its own employees? Do you not view that as potentially hazardous and concerning?

They chose this company. Effectively, they vetted this company and believed them to be doing things in a way that was secure for their employees. If that vetting process is terrible, then it speaks to how organization-wide the issues there are.

vinni2• 3 years ago

For a moment I got scared. But then I got angry at the clickbaity title.

ezekiel68• 3 years ago

A whole lotta nothing. Unless you are an Okta employee.

Terretta3• 3 years ago

Or unless you're someone who depends on Okta employees' security to keep yourself secure.

Which has been a problem, and this enables being more of a problem.

frostyj• 3 years ago

Reading the article, it says Okta and its employees are the actual victims here.. couldn't be more misleading..

Terretta3• 3 years ago

Connecting a few dots why, while the headline seems misleading, it might matter.

1. Okta employee PII and foreign key to employee health info (a particularly sensitive class of PII) may be exposed.

“On October 12, 2023, Rightway informed Okta that an unauthorized actor gained access to an eligibility census file maintained by Rightway in its provision of services ...”

https://www.documentcloud.org/documents/24110001-okta-indivi...

The file contained the following information on current and former Okta employees and their dependents:

- Full names

- Social Security Numbers (SSNs)

- Health or Medical Insurance plan number

2. Okta and its customer pool are known to be under an aggressive series of phishing and social engineering attacks.

3. This type of information makes those attacks more effective.

So while this particular breach starts as a Rightway problem, the nature of what was taken puts Okta itself at additional risk, as attackers build their social engineering / phishing dossier while looking for ways to get into Okta and/or get to Okta's customers in bulk.

ryanisnan5• 3 years ago

Thanks for this. Posts like this are why I like Hacker News. This is a valid problem for Okta, and I think accurately frames the problem.

Real-talk, if you were calling the shots at Okta, what would you do here?

Enforce hardware-key MFA everywhere, for every vendor service? Impose a no-professional-social-media policy for all employees? This probably is too late to do any good, but it's pretty clear phishing is a hot vector right now.

Terretta3• 3 years ago

Good question.

From their incident report yesterday it looks as though Okta started by blaming the victims, taking half a month to realize Okta itself was the problem. Then they clamped down on Chrome's automatic exfil of company credentials.

https://sec.okta.com/harfiles

That feels narrow.

What seems evident, but not addressed, is their initial reaction of victim customer blaming, the identification of suspicious behavior by multiple different customers before seeing it themselves, and the previous latitude for Chrome, likely trace back to lax culture and behavior, particularly around insider threat: not behaving as if they really believe "the problem is us".

So, address the specific faults as Okta did, but attribute those to a 'root cause' need for a stronger 'security mindset' with active insider threat modeling across all employees and roles, and insider focused detective controls.

Something like, "We spend all our time helping less secure customers level up their security and it's easy to feel good about how much more secure we are than most. But we ourselves don't have to be just better than our customers which probably seems easy. We have to be better than the threats who want to use us against our customers, and that's incredibly hard. Clearly we can do better."

Then double down on security mindset training (for customers to be secure, we have to be secure), and as part of that do comprehensive insider threat modeling and tabletop exercises across roles (even janitors or receptionists), with internal incentives to identify frictionless 'detection and response' controls opportunities across processes and systems.

In parallel I'd pick a new red team pen test firm (more than one, with different strengths and different cultural backgrounds outside US, e.g. Eastern Europe, Israel, Asia), adding a bonus above the standard fixed bid for every avenue identified.

But for the biggest backlog of things to fix, I'd have them do a round inside, with privilege. No room for the idea "if they're inside we already lost" since they will get inside. If I don't know to prevent things like what the insider pentests find, could I at least have seen those types of things?

We need to hear less whack-a-mole prevention in breached firms' writeups, more recognition of insider vantage threat, with visibility and detection.

- - -

TL;DR: Think through: (1) How do we become more worthy of trust. (2) How do we make trust irrelevant?

Okta hit by third-party breach, stealing employee data

Related Stories