<story><title>Okta: “We made a mistake” delaying the Lapsus$ hack disclosure</title><url>https://www.bleepingcomputer.com/news/security/okta-we-made-a-mistake-delaying-the-lapsus-hack-disclosure/</url></story><parent_chain></parent_chain><comment><author>the_duke</author><text>There are so many red flags here, it&amp;#x27;s not even funny anymore.&lt;p&gt;* a third party has barely restricted, deep access to all customer data&lt;p&gt;* the &amp;quot;SuperUser&amp;quot; app can apparently have logged in users idling around in a VM, waiting for someone to come along and use it without any automatic logout and re-authentication&lt;p&gt;* a single account accessing 300+ customers in a few days doesn&amp;#x27;t trigger any alerts&lt;p&gt;* they detect a compromise, and do absolutely nothing about it for months, except letting the third party order a security audit; they patiently wait for a report; they don&amp;#x27;t even audit the access logs&lt;p&gt;* only a screenshot posted online triggers an audit of access logs and a public response&lt;p&gt;* they still try to blame the third party and the security firm for their own (basically outrageous) inactivity&lt;p&gt;All of this by a company entrusted with the most critical gatekeeping functionality of systems, used by many large enterprises and expected to have top notch security.</text></comment>
<story><title>Okta: “We made a mistake” delaying the Lapsus$ hack disclosure</title><url>https://www.bleepingcomputer.com/news/security/okta-we-made-a-mistake-delaying-the-lapsus-hack-disclosure/</url></story><parent_chain></parent_chain><comment><author>GordonS</author><text>They blatantly &lt;i&gt;lied&lt;/i&gt;. A third-party auth provider, where trust is absolutely &lt;i&gt;crucial&lt;/i&gt;, and they lied about being breached. Repeatedly.&lt;p&gt;And even now, they are not coming out and being honest like &amp;quot;we lied because we were scared about liability, but the person behethis decision has been fired&amp;quot;. It&amp;#x27;s not good enough.&lt;p&gt;Sorry, but they have some serious work to do if they want to regain that trust. I for one, will not be using their services again.</text></comment>