Password management software maker 1Password recently announced that one of its systems had been breached by a hacker. However, the company assured its users that no sensitive data, including user information, was stolen in the incident. In this article, we will delve into the breach and the measures taken by 1Password to protect its systems and user data.
Confirmation of Suspicious Activity
Following an investigation, 1Password confirmed that the suspicious activity in its Okta software was a result of Okta’s support system breach. The attacker was able to obtain a valid session cookie, which granted them access to 1Password’s Okta system with administrator-level privileges. This incident highlighted a vulnerability in Okta’s customer support management system, impacting multiple companies, including 1Password and BeyondTrust, an identity and access management vendor.
Breach of Okta’s Customer Support Management System
BeyondTrust revealed that they, too, had been targeted by the breach of Okta’s customer support management system. Okta clarified that the breach solely affected its support case management system. It emphasized that its production Okta service, which is fully operational and unaffected, remains secure.
Information Stolen in Okta Breach
Okta disclosed that the information stolen from its customer support system involved HTTP Archive (.har) files. As a result, Okta now recommends sanitizing all credentials and cookies/session tokens within a .har file before sharing it with their customer support team. This measure aims to protect user data even in the case of such breaches.
1Password’s initial response
In its incident report, 1Password shared that on September 29, a member of its IT team alerted the security team about an Okta report listing administrative users. The IT team had not initiated this report, raising suspicions about potential unauthorized access. Fortunately, 1Password did not detect any signs indicating that sensitive data had been stolen or compromised during this incident.
Immediate measures taken by 1Password
Upon discovering the suspicious activity, 1Password swiftly implemented additional security measures. They changed all IT team members’ passwords, restricted their multifactor authentication capabilities to a YubiKey, and implemented further lockdown measures on their Okta accounts. These actions were vital in ensuring the prevention of any unauthorized access to sensitive data.
Second attempt by the attacker
The hacker returned on October 2nd and attempted to log into 1Password’s Okta system using a Google IDP they had previously enabled. However, this attempt failed as 1Password had already removed the IDP during their incident response, effectively preventing any further unauthorized access.
The breach incident experienced by password management software maker 1Password serves as a reminder of the ever-present threats in the digital world. While the company confirmed the breach and illicit access to its systems, it successfully prevented the theft of sensitive user data. The immediate actions taken by 1Password, including password changes and multifactor authentication restrictions, demonstrate the importance of strong security measures to protect user information. This incident also highlights the significance of timely detection and response to potential security breaches to mitigate the risks. 1Password and Okta continue to work diligently to fortify their systems, ensuring enhanced security for their users moving forward.