Okta asks for a HAR file of your okta session. By default this includes okta session tokens. The attacker who compromised oktas support systems (again) then use

Okta asks for a HAR file of your okta session. By default this includes okta session tokens. The attacker who compromised oktas support systems (again) then used this session token to access customer's okta accounts as the first step in trying to gain access to the customer's systems.