Incident brief
Okta's November 3, 2023 root-cause account said an actor accessed files in its customer support system from September 28 to October 17. It identified files associated with 134 customers, fewer than one percent of its customer base. Some support attachments were HTTP archive files that contained session tokens; Okta said tokens were used to hijack legitimate sessions of five customers. These are deliberately separate counts: files associated with customers, and confirmed session hijacks. Conflating them would exaggerate one outcome and obscure the breadth of exposure review.
Why support artifacts mattered
A diagnostic archive can be useful for troubleshooting, but it may preserve sensitive headers, cookies or tokens from a live session. Moving it into a support workflow can move authentication material across an organizational boundary. The case does not mean every HAR file contains a reusable token or every accessed file produced a hijack. It does show why a support portal and its attachments belong in the threat model of an identity provider and of the customers who upload material.
Defensive reading
Before submitting diagnostics, inspect and sanitize captures according to the vendor's guidance; keep a record of what was shared and when. Minimize attachment retention and access, and use a secure path for high-sensitivity material. If a supplier reports exposure, identify whether the organization's case files included live session material, invalidate or rotate relevant sessions as advised, and review identity logs for anomalous use. An incident-response contact for support-system compromise should be as clear as the contact for a production outage.
What remains bounded
This is Okta's own investigation and stated scope, not independent visibility into every customer's logs. The relevant access period does not equal this site's publication history. The case's lesson is specific: operational troubleshooting data can carry authentication power. Security review should cover the entire support exchange, including what engineers upload to obtain help, rather than treating a diagnostic attachment as harmless merely because it is not a password field.