Okta: “We made a mistake” delaying the Lapsus$ hack disclosure
There are so many red flags here, it's not even funny anymore.<p>* a third party has barely restricted, deep access to all customer data<p>* the "SuperUser" app can apparently have logged in users idling around in a VM, waiting for someone to come along and use it without any automatic logout and re-authentication<p>* a single account accessing 300+ customers in a few days doesn't trigger any alerts<p>* they detect a compromise, and do absolutely nothing about it for months, except letting the third party order a security audit; they patiently wait for a report; they don't even audit the access logs<p>* only a screenshot posted online triggers an audit of access logs and a public response<p>* they still try to blame the third party and the security firm for their own (basically outrageous) inactivity<p>All of this by a company entrusted with the most critical gatekeeping functionality of systems, used by many large enterprises and expected to have top notch security.