Connect with us

Hi, what are you looking for?


Application Security

Okta Source Code Stolen by Hackers

Identity and access management solutions provider Okta this week informed customers that some of the company’s source code was stolen recently from its GitHub repositories.

Identity and access management solutions provider Okta this week informed customers that some of the company’s source code was stolen recently from its GitHub repositories.

Okta was informed about the breach in early December by GitHub. An investigation showed that hackers accessed Okta’s repositories and copied code associated with Workforce Identity Cloud (WIC).

The good news is that the source code should not contain any information that can pose a security risk for Okta products. In addition, the company says there is no evidence of unauthorized access to the Okta service or customer data, and Auth0 (Customer Identity Cloud) products are not impacted.

“As soon as Okta learned of the possible suspicious access, we promptly placed temporary restrictions on access to Okta GitHub repositories and suspended all GitHub integrations with third-party applications,” Okta said in a blog post.

The company has reviewed recent code changes to ensure that the attackers have not made any malicious modifications, and rotated GitHub credentials.

This is not the only security incident disclosed by Okta this year. The company was targeted by the notorious Lapsus$ hackers in early 2022. The group gained access to the account of a customer support engineer at a third-party service provider, which gave them access to some of the company’s resources. However, the company’s final report on the incident said the impact was smaller than initially believed.

Okta was also hit by the Twilio breach, which was part of a major cybercrime campaign targeting more than 130 organizations. Okta confirmed in August that customer data, including phone numbers and SMS messages containing OTPs, were compromised.

Advertisement. Scroll to continue reading.

There have been several security incidents involving source code this year. In April, GitHub revealed that the private repositories of dozens of organizations were downloaded using stolen OAuth tokens issued to Heroku and Travis CI. GitHub said the attack was highly targeted.

Related: Okta Impersonation Technique Could be Utilized by Attackers

Related: GitHub Account Renaming Could Have Led to Supply Chain Attacks

Related: GitHub Announces Free Secret Scanning, Mandatory 2FA

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...