Help desk resets of Okta super administrator MFA at multiple customers
Okta warned on August 31, 2023 that attackers were calling customers' IT service desks and persuading staff to reset all MFA factors on highly privileged Okta accounts. With super administrator access, they impersonated users, changed authentication policies and added a second identity provider through inbound federation so they could sign in as anyone. The warning came days before MGM Resorts and Caesars Entertainment disclosed their own intrusions.
- Victim
- Multiple: Okta customers (Okta said four were compromised)
- Industry
- Cross-industry
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Aug 31, 2023
- Actor
- Financially motivated
- Initial access
- Help desk social engineering
- Identity control that failed
- Identity lifecycle
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Factor resets for privileged accounts need verification an attacker cannot talk their way through (visual or in-person checks, manager approval), and super administrator roles should be few, phishing-resistant and alerting on any change to identity providers.
Go deeper on SWI
- Teardown: Scattered Spider and the help desk: social engineering the identity reset
- Technique: Help desk social engineering
- Product involved: Okta
Sources
- Cross-tenant impersonation: prevention and detection, Okta Security, Aug 31, 2023
- Okta: 4 customers compromised in social engineering attacks, TechTarget, Sep 1, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Marks & Spencer ransomware attack via impersonation of a third-party user 2025 · Help desk social engineering
- Caesars Entertainment loyalty database theft via IT support vendor 2023 · Help desk social engineering
- MGM Resorts help desk social engineering and ransomware 2023 · Help desk social engineering
- Clorox intrusion after outsourced help desk reset passwords and MFA 2023 · Help desk social engineering
Cite this record
SWI Community Team. (2026). Help desk resets of Okta super administrator MFA at multiple customers. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-okta-customer-help-desk-super-admin-takeover/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.