campaign · 1642723200000

LAPSUS$ Extortion Campaign and Okta Breach

The LAPSUS$ extortion group compromised multiple major technology companies, including a high-profile breach of Okta via a third-party support provider.

What happened

Between January and March 2022, the LAPSUS$ group breached Okta (via a Sitel support engineer), Microsoft, Nvidia, Samsung, and others. They used social engineering, SIM swapping, and MFA fatigue to bypass authentication. At Okta, they had access to a support engineer's laptop for five days, potentially affecting customer support operations. The group extorted victims by threatening to leak stolen source code and sensitive data.

Technical mechanism

The attackers utilized low-tech but highly effective methods including SIM swapping, MFA fatigue (notification spamming), purchasing stolen credentials, and social engineering help desks to reset passwords.

Why it matters

Demonstrated the severe risk of social engineering, MFA fatigue, and third-party vendor compromises, leading to a dedicated Cyber Safety Review Board (CSRB) review.

Impact

Source code for major products (like Bing and Samsung Galaxy) was stolen and leaked. The Okta breach caused widespread concern among its thousands of enterprise customers, though Okta stated only a small number were actively affected.

Response

Victim organizations contained the breaches and forced credential resets. Law enforcement in the UK and Brazil arrested several teenage members of the group. The US Cyber Safety Review Board (CSRB) conducted a comprehensive review of the attacks.

Defensive lessons

  • Migrate away from SMS and voice-based MFA to FIDO2-compliant hardware tokens.
  • Implement strict third-party and BPO risk management.
  • Educate employees on social engineering and MFA fatigue attacks.

Evidence register

  1. Okta — Official Okta Statement on LAPSUS$ Claims (verified)
  2. Cyber Safety Review Board (CSRB) / CISA — CSRB Review: Attacks Associated with LAPSUS$ and Related Threat Groups (verified)