Lapsus$ accessed Okta’s network via compromised Sitel/Sykes contractor support workstation starting Jan 16 2022. Attacker used RDP lateral movement, accessed DomAdmins-LastPass.xlsx via Office 365, used Mimikatz, Sysinternals tools. Gained potential access to 366 Okta customers. Okta’s public disclosure was delayed ~2 months until Lapsus$ posted screenshots March 22 2022. Impacted customers included Cloudflare and Twilio.