The Okta HAR Hijacking
In late 2023, the world’s most trusted identity provider experienced the kind of breach it was designed to prevent. Attackers quietly infiltrated Okta’s customer support system, stole session tokens hidden inside HAR files and used them to impersonate users across some of the most secure organizations on earth.
For two full weeks, the intruders operated in silence. No alerts. No red flags. No detection.
When the truth came out, it wasn't just a security incident, it was a crisis of trust in the infrastructure that underpins modern authentication.
How did a company synonymous with identity become a cautionary tale? What does this breach reveal about session tokens as the new crown jewels, third-party risk, and the blind spots that even top-tier security teams can miss? And what lessons does every CISO need to take from the Okta compromise before history repeats itself?
In this episode of The CISO Signal: True Cybercrime Podcast, host Jeremy Ladner is joined by Oren Zenescu, CISO at Plarium, to break down every layer of the Okta breach, from the silent entry and token theft to the fallout across the cybersecurity community and what it means for the future of identity security.
💡 In this episode, we discuss:
🔹 How attackers harvested HAR files and hijacked live session tokens
🔹 Why session tokens are becoming the primary target for modern attackers
🔹 The two-week detection delay and what it says about support system security
🔹 What the Okta breach means for zero trust, vendor reliance, and third-party risk
🔹 Lessons CISOs must take from Okta’s incident history Lapsus$, source code theft, and beyond
🎙 Featured Guest
Oren Zenescu | Global CISO at Plarium
Member of Team8 CISO Village, with 15+ years of enterprise security leadership across finance, gaming, and global tech.
Follow The CISO Signal
🌐 Website: thecisosignal.transistor.fm
🔗 LinkedIn: linkedin.com/company/the-ciso-signal
Subscribe & share to stay ahead of the world’s most sophisticated cyber threats.
#CyberSecurity #OktaBreach #IdentitySecurity #TokenHijacking #ZeroTrust #CISO #IncidentResponse #SupplyChainSecurity #CyberCrime #TheCisoSignal
For two full weeks, the intruders operated in silence. No alerts. No red flags. No detection.
When the truth came out, it wasn't just a security incident, it was a crisis of trust in the infrastructure that underpins modern authentication.
How did a company synonymous with identity become a cautionary tale? What does this breach reveal about session tokens as the new crown jewels, third-party risk, and the blind spots that even top-tier security teams can miss? And what lessons does every CISO need to take from the Okta compromise before history repeats itself?
In this episode of The CISO Signal: True Cybercrime Podcast, host Jeremy Ladner is joined by Oren Zenescu, CISO at Plarium, to break down every layer of the Okta breach, from the silent entry and token theft to the fallout across the cybersecurity community and what it means for the future of identity security.
💡 In this episode, we discuss:
🔹 How attackers harvested HAR files and hijacked live session tokens
🔹 Why session tokens are becoming the primary target for modern attackers
🔹 The two-week detection delay and what it says about support system security
🔹 What the Okta breach means for zero trust, vendor reliance, and third-party risk
🔹 Lessons CISOs must take from Okta’s incident history Lapsus$, source code theft, and beyond
🎙 Featured Guest
Oren Zenescu | Global CISO at Plarium
Member of Team8 CISO Village, with 15+ years of enterprise security leadership across finance, gaming, and global tech.
Follow The CISO Signal
🌐 Website: thecisosignal.transistor.fm
🔗 LinkedIn: linkedin.com/company/the-ciso-signal
Subscribe & share to stay ahead of the world’s most sophisticated cyber threats.
#CyberSecurity #OktaBreach #IdentitySecurity #TokenHijacking #ZeroTrust #CISO #IncidentResponse #SupplyChainSecurity #CyberCrime #TheCisoSignal
