Okta Agent MGM Breach: Attacker Claims Explained

Okta’s support system was compromised in August 2022, and the attackers behind the MGM Resorts breach claim they used a social engineering attack that tricked an Okta employee into resetting MFA for a high-privilege account. This article explains the claim, the actual Okta incident, and how the two are connected.

Background: The MGM Resorts Breach

In September 2023, MGM Resorts International suffered a major cyberattack that disrupted hotel operations, casino systems, and reservations for days. The attackers, a group known as Scattered Spider (also tracked as UNC3944), used social engineering to trick MGM’s IT help desk into resetting credentials for an employee, then gained access to Okta SSO and ultimately to cloud infrastructure. The group demanded a ransom and later claimed to have encrypted data, though the full extent of the data theft remains unclear.

The Okta Agent Claim

In the aftermath, a person claiming to be part of the Scattered Spider group told TechCrunch that they had used a “vishing� (voice phishing) attack against Okta’s support team in August 2022, tricking an Okta employee into resetting MFA for a privileged account. The claim was that this earlier Okta compromise gave them a foothold that later helped in the MGM attack. Okta acknowledged the August 2022 incident but disputed the connection to MGM, saying the two events were unrelated and that the MGM breach was not caused by an Okta compromise.

What Actually Happened at Okta in August 2022

Okta disclosed in September 2022 that a security breach had occurred in August 2022, when a support engineer’s laptop was compromised by a threat actor who used a remote access tool to gain access to Okta’s internal systems. The attacker was able to view and potentially manipulate data for some Okta customers, but Okta stated that no corrective actions (like password resets) were taken by the attacker. The incident was limited to Okta’s support environment, not the main Okta service.

How the Two Events Are Connected (or Not)

The attacker’s claim suggests that the Okta support compromise was a stepping stone to the MGM attack. However, Okta’s official position is that the MGM breach was not a result of an Okta compromise. Security researchers generally agree that the MGM attack was executed through social engineering against MGM’s own IT help desk, not through Okta’s systems. The Okta incident in 2022 may have been a separate, opportunistic attack, and the connection to MGM is speculative.

Common Misconceptions

Many people assume that if an attacker compromises Okta, they automatically compromise all Okta customers. That is not true. Okta is a multi-tenant identity provider, and a compromise of a support engineer’s access does not grant access to every customer tenant. In the 2022 incident, Okta limited the damage by revoking access and auditing logs. The MGM attack was a classic social engineering attack against MGM’s own staff, not a technical breach of Okta’s infrastructure.

Lessons for Security Teams

This incident highlights the importance of:

• Training help desk staff to verify identity through multiple channels, not just a phone call.
• Implementing strict MFA reset procedures that require manager approval or secondary verification.
• Monitoring for unusual support ticket activity, especially password or MFA resets.
• Using threat intelligence to stay aware of social engineering tactics like vishing.

Frequently Asked Questions

Did the Okta agent actually help the MGM attackers?

There is no public evidence that the Okta agent who was tricked in August 2022 had any role in the MGM attack. Okta has denied any connection, and the MGM attack is widely attributed to social engineering against MGM’s own help desk.

Was Okta’s system hacked or was it an employee error?

It was a social engineering attack: the attacker tricked an Okta support engineer into granting access to a remote control tool. The engineer was not malicious, but was deceived. Okta’s internal systems were accessed, but the attacker did not perform any actions that affected customer data.

What is vishing?

Vishing is voice phishing: using phone calls to trick people into revealing sensitive information or performing actions like resetting passwords. In this case, the attacker called Okta support pretending to be a legitimate user.

Should I be worried about using Okta as a customer?

Okta’s core service was not compromised in the 2022 incident. The attack was limited to the support environment, and Okta has since implemented additional security measures. However, any identity provider is a target, so it’s wise to enable multi-factor authentication and monitor your own logs.

How can I protect my company from similar social engineering attacks?

Implement strict verification procedures for any account changes, use phishing-resistant MFA like hardware keys, and train employees to recognize vishing attempts. Also, consider using a “break glass� process for emergency access that requires multiple approvals.

Related

• Fix WordPress Could Not Remove Old Plugin Errors
• How to Turn Off Zoom on Apple Watch
• MW4 Revenge Trophy Guide: Assassin’s Achievement