What happened
Shares of cloud-based cybersecurity company Okta (OKTA +1.76%) tumbled 2.5% in Thursday afternoon trading (3:25 p.m. EDT) as the news about the company's hack, that first emerged on Tuesday, got even worse today.
As you'll recall, the basic story goes something like this: Sometime back in January, bad actors from the Lapsus ransomware group (aka Lapsus$) -- believed to be based in Brazil or some other Latin American country -- was able to compromise the account of a third-party, customer-support engineer. At the time, Reuters reported that "the scope of the hack is unknown," but Okta reassured customers that "there is no evidence of ongoing malicious activity beyond the activity detected in January."
Image source: Getty Images.
So what
So far, so good. But, as The Wall Street Journal reported today, all may not be quite as good as Okta described. "As many as 366 customers" may be affected by Okta's breach, reports the Journal, "or 2.5% of the more than 15,000 businesses and institutions it services worldwide."
The Journal further identified the "third party customer-support engineer" as being "from a unit of a subcontractor, Miami-based Sitel Group." Okta notes that said engineer didn't have "godlike access" to its systems so as to permit the hackers "to create or delete user accounts, download customer databases or access source-code repositories."
But as the newspaper also pointed out, "Lapsus$ disputed some of Okta's findings," saying it did in fact have access "to internal communications" at Okta and the ability to "complete compromise of many clients' systems."
Now what
So it appears that we have a sort of "he said, she said" situation in which Okta (quite naturally) wants to downplay the effect of this breach, while Lapsus$ (just as naturally) wants to boast about how great its hack was, stoking fear among Okta's customers and among future victims of its attacks to increase the chance they'll pay ransom when hacked.
Until some impartial judge advises on how truly serious (or insignificant) this hack actually was, investors remain largely in the dark. And seeing how the market abhors uncertainty, it makes a lot of sense that investors have continued selling off Okta stock -- for a fourth straight day.
