“Maiffret said BeyondTrust followed up with Okta on Oct. 3 and said they were fairly confident Okta had suffered an intrusion, and that he reiterated that conclusion in a phone call with Okta on October 11 and again on Oct. 13.”
BeyondTrust caught the attacker on Oct. 2, 30 minutes after its engineer uploaded a HAR file to Okta support at Okta’s request. Okta insisted the breach wasn’t on its side until Oct. 17. The customer did the detection, the reporting and three rounds of follow-up. Okta’s advice afterwards is to scrub session tokens from the files its own support staff asks you to send. An identity vendor needed two weeks to believe its customer.