Slow Mist Chief Information Security Officer 23pds posted on the This should be an attack case involving Okta-related insiders through social engineering. After gaining permission, the attacker was able to view files uploaded by some Okta customers. Because the Okta support case management system is separate from the production Okta service, other services are not currently affected. But customer support systems also contain sensitive data, including cookies and session tokens, that an attacker can use to impersonate a valid user.
Although Okta did not disclose the scale of the attack, BeyondTrust, Cloudflare, 1PassWord and other companies have confirmed the attack.
In response to this incident, 1PassWord responded that it immediately terminated the activity after detecting the suspicious activity. The investigation found that no user data or other sensitive systems were compromised, and no 1Password user data was accessed. The attack is the latest in a string of security breaches at Okta over the past few years, which has made the company a high-value target for hackers because so many high-value targets use its single sign-on (SSO) service.
At present, a large number of well-known companies in the field of cryptocurrency and other fields also use this service, so please always be vigilant.