[Security](https://leakly.com/security/)

[Confirmed][Archive]

# Okta breach screenshots from Lapsus$, via @vxunderground — confirmed

@vxunderground shared redacted Lapsus$ screenshots on March 22, 2022. Okta later said about 2.5% of customers may have been affected.

Leaked on 22 March 2022

![Evidence tray card: Okta breach screenshots from Lapsus$, via @vxunderground — confirmed](https://leakly.com/assets/og/okta-lapsus-screenshots.png)

At 03:44 UTC on March 22, 2022, @vxunderground posted that Lapsus$ claimed to have breached [Okta](https://www.okta.com/blog/company-and-culture/updated-okta-statement-on-lapsus/) and had released eight screenshots, which it shared with sensitive details edited out. (source: [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/okta-25-customers-impacted-lapsus/))

> **vx-underground** @vxunderground
>
> LAPSUS$ extortion group claims to have breached @Okta. They have released 8 photos as proof.
> The photos we are sharing has been edited so no sensitive information or user identities are displayed.
> Image 1 - 4 attached below. https://t.co/nR8V56dLu2
>
> 666 likes · 259 reposts · counts as of 09 Nov 2026, 07:12 UTC
>
> — vx-underground (@vxunderground) [March 22, 2022](https://twitter.com/vxunderground/status/1506114493067186183)

not in our leaker index

[The Verge](https://www.theverge.com/2022/3/22/22990637/okta-breach-single-sign-on-lapsus-hacker-group) reported that day on the risk to the many businesses that use Okta for sign-in. In an updated statement, Okta said that after analysis about 2.5% of customers may have been affected, with data possibly viewed or acted on.

Confirmed. The impact figure is Okta’s own.

[Confirmed]

## What happened later

Confirmed: Okta acknowledged potential impact on about 2.5% of customers.

## Sources

* [Original X post by @vxunderground](https://x.com/vxunderground/status/1506114493067186183)
* [The Verge — Okta hack puts thousands of businesses on high alert](https://www.theverge.com/2022/3/22/22990637/okta-breach-single-sign-on-lapsus-hacker-group)
* [Okta — Updated Okta Statement on LAPSUS$](https://www.okta.com/blog/company-and-culture/updated-okta-statement-on-lapsus/)
* [Infosecurity Magazine — Okta Confirms 2.5% of Customers Impacted by Lapsus Breach](https://www.infosecurity-magazine.com/news/okta-25-customers-impacted-lapsus/)

[Status definitions](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)