Hidden credentials Historical breach
A support file can carry the power to sign in
- Incident
- September 28–October 17, 2023
- Source report
What was reported
In its November 3, 2023 root-cause report, Okta said attackers accessed support files containing session tokens and used them to hijack five customers’ sessions. A November 29 update also reported theft of support-user names and email addresses across the affected support system. Okta closed the investigation in February 2024 and said its production service was not impacted.
Our perspective
Our reading: classify information by what it enables, not just its filename. A diagnostic file can contain credentials as well as technical details. For Vivendur, this reinforces the importance of selecting the necessary fields and examining embedded secrets before information is made available to a tool.
Explore field-level context decisions