Skip to main content

Microsoft hacker LAPSUS$ just claimed yet another victim

LAPSUS$, the group behind the unprecedented Nvidia hack, has successfully infiltrated another company, digital security authentication firm Okta.

A cybersecurity incident was confirmed to have occurred in January, with the investigation from a forensics firm revealing that a hacker did indeed gain access to an Okta support engineer’s laptop for a full five days.

A person inputs code into a system.
Image used with permission by copyright holder

The consequences for the latest victims of LAPSUS$ can’t be understated: Okta’s service is used by some of the world’s biggest companies, including FedEx and T-Mobile. Government agencies such as the Federal Communications Commission also rely on its authentication technology.

Recommended Videos

In a statement, Okta stressed that only a minor percentage of its customers were affected.

“After a thorough analysis of these claims, we have concluded that a small percentage of customers – approximately 2.5% – have potentially been impacted and whose data may have been viewed or acted upon.”

Okta’s latest comments come after LAPSUS$ released several photos on its Telegram channel containing sensitive information pertaining to the breach.

Okta’s response to the incident prompted a stern reaction from some, including Dan Starner, an infrastructure software engineer at Salesforce. As initially reported by VentureBeat, Starner tweeted:

I said last night this was very, very bad.

Today I trusted @okta and thought it was okay.

Now I know it’s very, very bad and that I don’t trust @okta anymore. Security is hard and breaches happen, but lying by omission is worse than telling us our data may be compromised. https://t.co/TjaXt08RKc

— Dan Starner (@danstarner.bsky.social) (@dan_starner) March 23, 2022

Bill Demirkapi, an independent security researcher, also offered his thoughts on the situation, as reported by Reuters:

“In my opinion, it looks like they’re trying to downplay the attack as much as possible, going as far as directly contradicting themselves in their own statements.”

LAPSUS$ said on its Telegram channel that its “focus was ONLY on Okta customers,” as opposed to the company itself. It also added that “the potential impact to Okta customers is NOT limited.”

“I’m pretty certain resetting passwords and [Multifactor authentication] would result in complete compromise of many clients systems,” the hacking group stated.

This is our 3rd attempt at sharing the 5th – 8th photo. LAPSUS$ displayed a lot of sensitive information and/or user information, so much so we end up missing to censor some.

Photos 5 – 8 attached below. pic.twitter.com/KGlI3TlCqT

— vx-underground (@vxunderground) March 22, 2022

Elsewhere, Okta spokesperson Chris Hollis stressed in an earlier statement to The Verge that the attack was confined to the activity initially detected in January. However, LAPSUS$ asserted that it had access to the “Superuser/Admin” account for two months. To that end, the group said Okta was apparently storing Amazon Web Services (AWS) keys within Slack channels.

Okta is not the only high-profile company LAPSUS$ has targeted this week. Software giant Microsoft also confirmed that a malicious threat actor managed to gain “limited access” to its systems. As a result, the source codes for both Cortana and search engine Bing were reportedly leaked.

Previously, LAPSUS$ leaked the source code for Nvidia’s proprietary DLSS code, which was a part of a larger 1TB hack.

Zak Islam
Former Digital Trends Contributor
Zak Islam was a freelance writer at Digital Trends covering the latest news in the technology world, particularly the…
Microsoft just released its ‘unified gateway to Windows’ for Mac
The Surface Pro 11 on a white table in front of a window.

Microsoft has launched a new Windows App for Mac that unifies the remote access Windows experience. There are even versions for iOS, iPadOS, and web browsers, with an Android version in public preview mode.

Windows App: Your gateway to Windows on any device

Read more
The Microsoft AI CEO just dropped a huge hint about GPT-5
A photo of Mustafa Suleyman.

The timeline on GPT-5 continues to be a moving target, but a recent interview with Microsoft AI CEO Mustafa Suleyman sheds some light on what GPT-5 and even what its successor will be like.

Mustafa Suleyman on Defining Intelligence

Read more
Sorry, Microsoft — I don’t want Copilot+ reading my DMs yet
Microsoft introducing the Recall feature in Windows 11.

Microsoft is kicking off a new era of PCs -- the Copilot+ era. It's a new category of device designed and built around AI, and the key selling point of a Copilot+ PC is the new Recall feature. I'm not quite on board with it yet, however.

Recall is a collection of several small language models that run on your device all the time. These models track everything you do, from messages and emails you send to where you navigate within Windows 11. And, as the name suggests, Copilot can recall this information whenever you need it, using it as bedrock context for how you interact with your PC.

Read more