“The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop.”
Okta knew about a suspicious login in January. Its customers found out in March, from screenshots LAPSUS$ posted. The morning statement said the service “has not been breached.” By evening it was 2.5% of customers potentially affected. An identity provider that sits on two months of bad news is not one you should trust with your logins.