Identity management firm Okta has said it found no evidence of ongoing malicious activity after a group called Lapsus$ posted pictures claiming to have hacked the company.
Lapsus$ posted screenshots on its Telegram channel late Monday claiming it had access to a number of Okta’s systems. The hacking group said it did not access or steal any databases from Okta, but instead was focused on accessing its customers.
Okta said Tuesday that it had “detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors” in January.
“The matter was investigated and contained by the subprocessor. We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January,” the company added.
Shares of Okta were down around 7% in pre-market trade in the U.S.
Okta is an authentication and identity management software company that is used by more than 15,000 organizations. Any data breach of Okta has raised concerns that hackers could get access to other organizations using Okta’s products.
“Thousands of companies use Okta to secure and manage their identities. Through private keys retrieved within Okta, the cyber gang may have access to corporate networks and applications,” Ekram Ahmed, a spokesperson at cybersecurity firm Check Point, said in a statement.
He said Okta customers should “exercise extreme vigilance and cyber safety practices.”
Matthew Prince, the CEO of Cloudflare, an internet infrastructure company whose details Lapsus$ included in one of its screenshots, said there was “no evidence” his company had been compromised.
“Thankfully, we have multiple layers of security beyond Okta, and would never consider them to be a standalone option,” he added.
Lapsus$ has claimed responsibility for a number of data breaches of high-profile companies in the last few months, including at Samsung and chip giant Nvidia.
