My guess is that the attack path is probably some externally hired SOC that was working for Okta. Big corporates usually think it's a wise business decision to

My guess is that the attack path is probably some externally hired SOC that was working for Okta. Big corporates usually think it's a wise business decision to hire external cyber security people, with full-blown admin access to everything. Because, technically speaking, Okta advertises with their SOC II / ISO27001 / ISO27017 / ISO27018 compliance certificates [1] and [2]; which means there has to be an incident response system that would've caught this. Well, either that, or the ones that manage the incident response system are the mischiefs themselves. [1] https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ and https://archive.ph/654MX https://archive.ph/654MX [2] https://www.schellman.com/certificate-directory https://www.schellman.com/certificate-directory -> search for Certificate No. "1106074-8"