Tell HN: Okta October Security Incident – Contact Information (email) Exposure
Hello,
On Wednesday, November 29 we published a blog post with an update on the October security incident. As described in the blog post, the threat actor accessed reports in the Okta customer support system containing user contact information. This email is part of our outreach to the individuals affected by this information exposure.
We are contacting you today to notify you that your contact information - name, and certain other contact information such as phone number, work address and/or email address was among the information downloaded by the threat actor. This contact information does not include user credentials or sensitive personal information.
Your contact information was in Okta’s customer support system because of prior interaction with Okta. For example, holding an Okta certification (e.g., an Okta Certified Professional certificate), participating in a product trial, receiving promotional communication, being a former customer, or similar.
As we shared in our November 29 blog post, we do not have direct knowledge or evidence that this information is being actively exploited. We aim to share this information with you as a precaution as phishing and social engineering attacks are common and there is the possibility that this information may be used for such purposes.
As a security best practice, Okta strongly recommends that you enable multi-factor authentication (MFA) across all your online accounts as a key protection against these types of attacks. If you have further questions or concerns, please call 800-456-3166 toll-free Monday through Friday 8:00am CST to 8:00pm CST (excluding major U.S. holidays). Be prepared to provide your engagement number Bxxxxxx.
We apologize for the frustration this situation has caused.
Thank you,
Okta Team