ConfirmedArchive

Okta breach screenshots from Lapsus$, via @vxunderground — confirmed

@vxunderground shared redacted Lapsus$ screenshots on March 22, 2022. Okta later said about 2.5% of customers may have been affected.

Leaked on 22 March 2022

Evidence tray card: Okta breach screenshots from Lapsus$, via @vxunderground — confirmed

At 03:44 UTC on March 22, 2022, @vxunderground posted that Lapsus$ claimed to have breached Okta and had released eight screenshots, which it shared with sensitive details edited out. (source: Infosecurity Magazine)

vx-underground @vxunderground
LAPSUS$ extortion group claims to have breached @Okta. They have released 8 photos as proof. The photos we are sharing has been edited so no sensitive information or user identities are displayed. Image 1 - 4 attached below. https://t.co/nR8V56dLu2
666 likes · 259 reposts · counts as of 09 Nov 2026, 07:12 UTC
— vx-underground (@vxunderground) March 22, 2022

not in our leaker index

The Verge reported that day on the risk to the many businesses that use Okta for sign-in. In an updated statement, Okta said that after analysis about 2.5% of customers may have been affected, with data possibly viewed or acted on.

Confirmed. The impact figure is Okta’s own.

Sources

Status definitions · Corrections · Contact