Bet there was some good tokens in some of those customer HAR files.
Removed by mod
From a comment in the article:
Nothing like an authentication provider announcing a major breach at end of day on Friday to get your IT nerves fraying.
Not like they specifically announced it on Friday so that the media response to this is minimal.
This is the best summary I could come up with:
“HAR files can also contain sensitive data, including cookies and session tokens, that malicious actors can use to impersonate valid users,” Bradbury wrote.
The CSO also didn’t say whether access to the compromised support system was protected by two-factor authentication, which best practices call for.
BeyondTrust’s access policy controls stopped the attacker’s “initial activity, but limitations in Okta’s security model allowed them to perform a few confined actions,” the company said without elaborating.
The initial incident response indicated a possible compromise at Okta of either someone on their support team or someone in position to access customer support-related data.
In December 2022, hackers stole Okta source code stored in a company account on GitHub.
Friday’s post contains IP addresses and browser user agents used by the threat actors that others can use to indicate if they have also been affected.
The original article contains 431 words, the summary contains 140 words. Saved 68%. I’m a bot and I’m open source!
Might need to work on the summarizing…
Lol to clarify, “viewed” means they had to download them
