LAPSUS$ access to Okta support via Sitel engineer workstation
Between January 16 and 21, 2022 an attacker had remote access, via RDP, to a workstation of a support engineer at Okta's subprocessor Sitel, which had access to Okta support tools. LAPSUS$ posted screenshots on March 22, 2022, prompting Okta's disclosure; Okta first estimated up to 366 customers potentially affected, then concluded in April that the attacker controlled the workstation for 25 minutes on January 21 and accessed two customer tenants. Okta ended its relationship with Sitel.
- Victim
- Okta
- Industry
- Technology
- Country
- United States
- Intrusion began
- Jan 16, 2022
- First disclosed
- Mar 22, 2022
- Actor
- LAPSUS$ (Extortion group)
- Initial access
- Third-party access
- Identity control that failed
- Authorization
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 2 (Two customer tenants accessed, per Okta's final investigation in April 2022; the initial maximum potential impact was 366 customers.)
- Disclosed cost
- Not disclosed
The identity lesson
Third-party support staff with access to customer tenants need managed devices, least-privilege tooling and contractual incident reporting, since their compromise is your compromise.
Go deeper on SWI
- Product involved: Okta
Sources
- Okta's Investigation of the January 2022 Compromise, Okta, Mar 23, 2022
- Okta Concludes its Investigation Into the January 2022 Compromise, Okta, Apr 19, 2022
- Review of the Attacks Associated with Lapsus$ and Related Threat Groups, Cyber Safety Review Board (CISA), Aug 10, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Nobelium abuse of reseller delegated administrative privileges 2021 · Third-party access
- Commvault Metallic breach exposes Microsoft 365 app secrets 2025 · Third-party access
- Cisco Duo SMS MFA logs stolen from a phished telephony provider 2024 · Third-party access
- DoorDash data access via phished third-party vendor credentials 2022 · Third-party access
Cite this record
SWI Community Team. (2026). LAPSUS$ access to Okta support via Sitel engineer workstation. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-okta-sitel-lapsus/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.