Okta

The financing and listing were conventional: $75 million in 2015 from Andreessen Horowitz, Greylock and Sequoia at a $1.2 billion valuation, an initial public offering on Nasdaq in 2017 at $17.00 a share raising $187 million, Sequoia the largest shareholder at 21.2 per cent, and over 100 million registered users reported by January 2019. On 3 May 2021 Okta completed its acquisition of Auth0 in a stock transaction valued at approximately $6.5 billion, announced that March, calling itself the leading independent identity provider trusted by more than 10,000 organisations. atSpoke followed in August 2021 for $90 million, Spera in December 2023, and Axiom Security, an identity-centric privileged access company, in September 2025.

The breaches are why this record is longer than the product list. On 22 March 2022 the Lapsus$ group posted screenshots from Okta's internal systems; Okta concluded that at most 366 customers may have been affected, and that the intrusion began on a computer used by one of its third-party customer support engineers. In December 2022 its source code was taken from its GitHub repository.

Then the support system itself. Okta's chief security officer, David Bradbury, set out the root cause on 3 November 2023: from 28 September to 17 October 2023 a threat actor used a service account stored in the customer support system to view files uploaded by 134 customers, less than one per cent of the base, and used session tokens from five of them to hijack sessions. The service account's username and password had been saved into an employee's personal Google account, which was signed in on the Chrome browser of an Okta-managed laptop. 1Password reported suspicious activity on 29 September and BeyondTrust on 2 October, supplying the decisive IP indicator on 13 October. Okta disabled the account, blocked personal Google profiles in Chrome on managed devices, added monitoring to the support system and bound administrator session tokens to network location. On 29 November 2023 it became known that the incident touched all users of the customer support system.

The lesson is structural rather than a verdict on one company. An identity provider's support desk receives the files that debug login problems, and those files carry the sessions of the customers' own administrators; whoever reads the support desk can become any of them. The protective measures Okta published are exactly the ones every customer of every identity provider now asks about, which is the sense in which the 2023 report did the industry a service. Beside this entry, CyberArk, BeyondTrust and SailPoint tell the privileged and identity governance sides of the same story.