Okta customer support system breach and HAR-file session token theft
From September 28 to October 17, 2023 an attacker used a service account credential, saved to an employee's personal Google profile on an Okta laptop, to access Okta's customer support case system. Files there included HAR files with live session tokens, which the attacker used to hijack sessions at five customers; 1Password, BeyondTrust and Cloudflare each detected and contained the activity. Okta disclosed on October 20, 2023 and on November 29 said the attacker had also downloaded names and emails of all support system users.
- Victim
- Okta
- Industry
- Technology
- Country
- United States
- Intrusion began
- Sep 28, 2023
- First disclosed
- Oct 20, 2023
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Session and tokens
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- 134 (Customers whose support case files were accessed, per Okta. A report taken by the attacker listed names and email addresses of all customer support system users.)
- Disclosed cost
- Not disclosed
The identity lesson
Support uploads become credentials when they carry session tokens. Sanitizing HAR files, binding admin sessions to devices and keeping service account secrets out of personal browser profiles would each have broken the chain.
Go deeper on SWI
- Teardown: Okta's 2023 support-system breach: when your IdP gets phished
- Technique: Session cookie theft
- Product involved: Okta
Sources
- Tracking unauthorized access to Okta's support system, Okta Security, Oct 20, 2023
- Unauthorized access to Okta's support case management system: root cause and remediation, Okta Security, Nov 3, 2023
- How Cloudflare mitigated yet another Okta compromise, Cloudflare, Oct 20, 2023
- Hackers stole access tokens from Okta's support unit, KrebsOnSecurity, Oct 20, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- LastPass customer vault backup theft via engineer credentials and trusted device cookie 2022 · Stolen credentials
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- TeamViewer corporate IT intrusion via a compromised employee account 2024 · Stolen credentials
- Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Okta customer support system breach and HAR-file session token theft. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-okta-support-system-har-session-tokens/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.