Log in Request a demo

Security News

Okta’s Data Breach Victims: Cloudflare, 1Password, and 170 Others

Okta support system breach explained: how stolen HAR file session tokens led to incidents at 1Password and Cloudflare, plus the IoCs Okta published.

Brandefense logo Updated 3 Min Read
Okta's Data Breach Victims: Cloudflare, 1Passwords and 170 Others

Okta is an identity management provider. Between September 28 and October 17, 2023, attackers used stolen credentials to get into Okta’s customer support case system and took HTTP Archive (HAR) files from customers. Some held session tokens that could be used to hijack sessions. The access led to follow-on incidents at 1Password and Cloudflare. In October 2026 a hacktivist group claimed that a DHS staff directory came from an Okta single sign-on service, which Okta disputes; see our DHS Icepick leak explainer.

Domino Effect Because of Okta

What happened in the Okta breach?

1Password, a widely used password management platform, experienced a security breach on September 29, 2023, when hackers accessed its Okta ID management tenant. This breach was tied to an incident where Okta’s support case system was compromised by threat actors using stolen credentials. These actors utilized the access to procure HTTP Archive (HAR) files from Okta’s customers. HAR files can contain sensitive data, notably authentication cookies and session tokens, which can be used for impersonation. 1Password’s specific breach was due to a compromised session cookie from an IT employee’s HAR file, which was given to Okta for assistance. Subsequent to this access, the attackers undertook a series of unauthorized actions. The breach was flagged by 1Password when an IT team member received a dubious email. Although there was a security breach, 1Password assured that no user data was compromised.

Who else was hit by the Okta breach?

Cloudflare detected malicious activities on their system on October 18th, only two days before Okta revealed the incident. In Cloudflare’s situation, the attackers exploited an authentication token pilfered from Okta’s support mechanism to infiltrate Cloudflare’s Okta instance and obtain administrative rights. In its own incident report, Cloudflare said the token came from a support ticket created by one of its employees and that no customer information or systems were affected. A month later, a different intrusion into Cloudflare’s internal Atlassian tools began with one service token and three service account credentials from the same Okta incident that had not been rotated, as Cloudflare described in its Thanksgiving 2023 incident report.

How did 1Password respond to the Okta breach?

While 1Password has since initiated several protective actions, like modifying its Okta configurations and updating the compromised IT employee’s credentials, there’s a noted discrepancy between 1Password and Okta regarding the chronological sequence of events. According to Okta’s root cause report, 134 Okta customers, or less than 1% of its customers, had files accessed during the breach.

What indicators of compromise did Okta publish?

Here are IoCs from Okta’s official blog post.

IP Addresses

23[.]105.182.19 104[.]251.211.122 202[.]59.10.100 162[.]210.194.35 (BROWSEC VPN) 198[.]16.66.124 (BROWSEC VPN) 198[.]16.66.156 (BROWSEC VPN) 198[.]16.70.28 (BROWSEC VPN) 198[.]16.74.203 (BROWSEC VPN) 198[.]16.74.204 (BROWSEC VPN) 198[.]16.74.205 (BROWSEC VPN) 198[.]98.49.203 (BROWSEC VPN) 2[.]56.164.52 (NEXUS PROXY) 207[.]244.71.82 (BROWSEC VPN) 207[.]244.71.84 (BROWSEC VPN) 207[.]244.89.161 (BROWSEC VPN) 207[.]244.89.162 (BROWSEC VPN) 23[.]106.249.52 (BROWSEC VPN) 23[.]106.56.11 (BROWSEC VPN) 23[.]106.56.21 (BROWSEC VPN) 23[.]106.56.36 (BROWSEC VPN) 23[.]106.56.37 (BROWSEC VPN) 23[.]106.56.38 (BROWSEC VPN) 23[.]106.56.54 (BROWSEC VPN)

User-Agents

Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36 (Legitimate, but older user-agent) Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.83 Safari/537.36 (Legitimate, but older user-agent)

Frequently Asked Questions.

What was the Okta support system breach?

Attackers gained unauthorized access to Okta's customer support case management system. Okta's production service was not compromised.

What is a HAR file and why does it matter?

A HAR file is a recording of web traffic. In this incident the files contained session tokens that could be used for session hijacking.

How did the attackers get into Okta's support system?

Okta says a service account's username and password were saved in an employee's personal Google account. Okta thinks that account or device was most likely compromised.

Which companies were affected by the Okta breach?

The post covers 1Password and Cloudflare. Okta's own report also names BeyondTrust and says 134 customers, less than 1% of its customers, had files accessed.

Sources

  1. 1 Okta: October 2023 security incident summary
  2. 2 Okta: Unauthorized Access to Okta's Support Case Management System, Root Cause and Remediation
Share

In This Article

TermsHacktivism TermsThreat actor TermsSession cookie TermsIndicator of compromise (IoC)

Where To Next.

All Security News Articles
In plain words · Glossary term Hacktivism

Hacktivism is the use of hacking to push a political, social or ideological cause.

Open → Keep reading · Article F5 BIG-IP Security Vulnerability Allows Remote Code Execution: CVE-2023-46747

F5 BIG-IP remote code execution flaw CVE-2023-46747 (CVSS 9.8) lets attackers with network access run system commands.

Open → Keep reading · Article CVE-2023-22515: Atlassian Confluence Zero-Day | Actively Exploited

CVE-2023-22515 lets attackers create admin accounts in Atlassian Confluence 8.0.0 to 8.5.1.

Open →

Knowledge HubKnowledge Hub