Okta's source code stolen after GitHub repositories hacked
By Ax Sharma
December 21, 2022 01:15 am 0
okta
Okta, a leading provider of authentication services and indistinguishability and Access management (IAM) solutions, says that its private GitHub repositories were hacked this month.
According to a 'confidential' email notification sent by Okta and seen by BleepingComputer, the certificate incident involves terror actors stealing Okta's source code.
Source code stolen, customer data not impacted
BleepingComputer has obtained a 'confidential' certificate incident notification that Okta has been emailing to its 'security contacts' as of a few hours ago. We have confirmed that multiple sources, including IT admins, have been receiving this email notification.
Earlier this month, GitHub alerted Okta of suspicious access to Okta's code repositories, states the notification.
Upon investigation, we experience concluded that such access was used to copy Okta code repositories, writes David Bradbury, the company's foreman surety Officer (CSO) in the email.
Despite stealing Okta's source code, attackers did not gain unauthorized access to the Okta service or customer data, says the company. Okta's HIPAA, FedRAMP or DoD customers stay unaffected as the company does not rely on the confidentiality of its source code as a means to secure its services. As such, no customer activity is needed.
Okta security incident email sent december 2022
Okta emails its 'security contacts' a security notification (BleepingComputer)
At the time of authorship our report, the incident appears to live relevant to Okta Workforce indistinguishability cloud (WIC) code repositories, but not Auth0 customer Identity cloud product, given the email wording.
An excerpt from the residuum of the notification, reviewed by BleepingComputer, is published below:
As soon as Okta learned of the possible suspicious access, we promptly placed temporary restrictions on access to Okta GitHub repositories and suspended all GitHub integrations with third-party applications.
We have since reviewed all recent access to Okta software repositories hosted by GitHub to understand the scope of the exposure, reviewed all recent commits to Okta software repositories hosted with GitHub to validate the unity of our code, and rotated GitHub credentials. We have also notified law enforcement.
Additionally, we experience taken steps to see that this encrypt cannot live used to access company or customer environments. Okta does not foreknow any disruption to our business or our ability to service our customers as a result of this event.
Note: The security event pertains to Okta Workforce Identity cloud (WIC) code repositories. It does not pertain to any Auth0 (Customer Identity Cloud) products.
We have decided to share this information consistent with our committal to transparency and partnership with our customers.
While ending its 'confidential' email that pledges a 'commitment to transparency,' Okta says it will publish a statement today on its blog.
BleepingComputer reached out to Okta with questions in advance of publishing but a reply was not immediately available.