Okta Sitel Sub-Processor: Lapsus$ Reaches an Identity Provider via a Contractor

Incident summary

Okta is an identity provider that brokers single sign-on, MFA, and lifecycle management for thousands of enterprise customers. Per Okta's March 25, 2022 investigation summary, on January 20, 2022 Okta Security detected that a new MFA factor had been added to a Sitel customer support engineer's Okta account. Sitel, through its 2021 acquisition of Sykes Enterprises, provides Okta with contracted customer support engineers.

Mandiant's third-party forensic investigation found that the threat actor had RDP access to the Sitel support engineer's workstation between January 16 and 21, 2022, a five-day window. The actor used the engineer's Okta SuperUser-equivalent access to view information related to approximately 366 Okta customer tenants, or roughly 2.5 percent of Okta's customer base at the time.

Lapsus$ disclosed the breach publicly on March 21-22, 2022 by posting screenshots of the Okta administrator interface on its Telegram channel. Okta's customer disclosure followed shortly after, drawing significant criticism that customers learned of the incident from social media before receiving direct notification from Okta. The two-month delay between detection and customer notification became a defining controversy of the incident.

Attack technique

MITRE ATT&CK maps the operation to T1199 (Trusted Relationship) for abuse of the Okta sub-processor relationship, T1078 (Valid Accounts) for the engineer's credential, T1021.001 (Remote Services: RDP) for the workstation access, and T1213 (Data from Information Repositories) for review of customer tenant data through the Okta admin interface.

Sitel disclosed in a statement reported by Recorded Future on March 28, 2022 that the breach occurred in legacy network infrastructure inherited from the 2021 Sykes acquisition. This pattern, where acquired infrastructure imports unaddressed risk, recurs across multiple identity-vendor incidents and matches the pattern in the 2024 Change Healthcare breach where Optum's acquisition of Change Healthcare imported the no-MFA Citrix portal.

The Okta SuperUser application that the support engineer had access to permits limited administrative actions on customer tenants, including password resets and MFA factor management. Per Okta's investigation, the actor did not modify customer configurations, did not download bulk customer data, and did not access customer Okta tenants directly. The actor reviewed customer tenant data through the engineer's authenticated browser session.

Impact and consequences

Okta initially disclosed in CSO David Bradbury's public statement that the maximum potential impact was 366 customers. The disclosure cadence drew criticism. Cloudflare CEO Matthew Prince publicly called Okta's response 'frankly unacceptable' on March 22, 2022. Cloudflare and other Okta customers proactively reset Okta-issued credentials and audited tenant logs without waiting for direct Okta notification.

Okta's stock price fell approximately 11 percent on March 22, 2022. The reputation impact contributed to a multi-quarter shift in the identity vendor competitive landscape, with prospective customers conducting more rigorous vendor security questionnaires of identity providers, and existing customers reviewing alternatives. Okta announced a new Auth0 Customer Identity Cloud security framework in response.

Lapsus$ continued operations against multiple Fortune 500 targets including Microsoft, NVIDIA, Samsung, Vodafone, Globant, and Uber through 2022. UK police arrested seven suspects in March 2022 in Oxford, and the City of London Police announced charges against multiple Lapsus$-linked individuals later in 2022 and 2023. The UK convictions in August 2023 provided public-record detail on the group's operations.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Sub-processor risk needs the same controls as direct vendor risk. Sitel as an Okta sub-processor had effective access into customer tenants. Vendor risk management programs that examine direct vendors but not sub-processors miss the actual access boundary. Map sub-processors and apply equivalent security control evidence to each.

Acquired infrastructure inherits risk on day one. Sitel's compromise occurred in legacy Sykes infrastructure from a 2021 acquisition. Cybersecurity due diligence in M&A and time-bound integration runbooks that bring acquired environments to corporate baseline within a defined window close this recurring gap.

Identity provider sub-processor access should be just-in-time, not standing. Okta support engineers had standing access to customer tenant administrative functions through SuperUser. Just-in-time elevation, customer-side approval workflows, and ephemeral access tokens reduce the value of a single compromised support engineer credential.

Disclosure cadence is part of the security control. Okta's two-month gap between detection and customer notification became the defining controversy of the incident and damaged customer relationships beyond the technical impact. Mature incident response playbooks include customer communication SLAs, with the disclosure timeline calibrated to customer detection-and-response needs.

Customers cannot rely solely on vendor-side detection. Cloudflare, BeyondTrust, and others detected vendor-side identity provider issues from the customer side because they monitored their own Okta admin sessions. Customer-side identity event monitoring is a control that survives even when the vendor self-monitoring fails.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /cybersecurity/careers/incident-responder
• /cybersecurity/careers/grc-analyst
• /cybersecurity/careers/security-architect

Related Decipher Files

• Okta Support: How HAR File Session Tokens Reached 1Password and Cloudflare
• Uber MFA Fatigue: How Push-Bombing Broke a Contractor's Account

Frequently asked questions