Skip to main content

Hackers targeted 1Password after Okta breach, but your logins are safe

Security credentials like usernames and passwords are a tempting target for hackers, and even the best password managers can come under threat from time to time. That was the case recently with the popular password manager 1Password, which recently disclosed (via Bleeping Computer) that its Okta support system was breached by malicious hackers.

Fortunately, it doesn’t appear that any customer data was stolen, so if you use 1Password, your login info should be safe for now. However, it’s always good to regularly update your passwords (or use passkeys) just in case they fall into the wrong hands.

A dark mystery hand typing on a laptop computer at night.
Andrew Brookes / Getty Images

In a blog post on its website, 1Password explained the situation. “We detected suspicious activity on our Okta instance related to their Support System incident,” 1Password said. “After a thorough investigation, we concluded that no 1Password user data was accessed.”

After detecting suspicious activity on September 29, 1Password “immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.”

The Okta connection

A person using 1Password on a desktop all-in-one computer while sat at a desk. There are two laptops next to them on the desk.
1Password / AgileBits

The link with Okta is interesting because it reveals a key vulnerability. Okta helps companies manage their users and ensure everyone can log in securely, and it also offers support for this process. As part of that, customers sometimes upload file archives to help diagnose problems, but these archives can contain sensitive data like session tokens and login data.

According to a detailed report from 1Password, a hacker stole a session cookie from a 1Password IT employee, then attempted to access the worker’s dashboard and request a list of admin users. Fortunately, the former action was blocked by Okta, while the second led to an automated email being sent to other 1Password admins, which alerted them to the breach.

While your login info is safe — no user data appears to have been accessed by the hacker — it shows just how easily seemingly secure systems can be breached by bad actors. In response to the incident, 1Password says it has reduced the number of “super admin” users, implemented tighter login rules for admins, and taken other measures.

Despite this episode, you should still pick one of the best password managers to keep your login data safe. After all, using an app to create and store unique passwords for you is far safer than using the same easily guessable login info for every account.

Editors' Recommendations

Alex Blake
In ancient times, people like Alex would have been shunned for their nerdy ways and strange opinions on cheese. Today, he…
This huge password manager exploit may never get fixed
A large monitor displaying a security hacking breach warning.

It’s been a bad few months for password managers -- albeit mostly just for LastPass. But after the revelations that LastPass had suffered a major breach, attention is now turning to open-source manager KeePass.

Accusations have been flying that a new vulnerability allows hackers to surreptitiously steal a user’s entire password database in unencrypted plaintext. That’s an incredibly serious claim, but KeePass’s developers are disputing it.

Read more
Hackers dug deep in the massive LastPass security breach
The LastPass logo appears in front of a menacing hooded figure.

The cybersecurity breach that LastPass owner GoTo reported in November 2022 keeps getting worse as new details are revealed, calling into question the company's transparency on this serious issue.

It has been two months since GoTo shared the alarming news that hackers stole the usernames, passwords, email addresses, phone numbers, IP addresses, and even billing information of LastPass users. In GoTo's latest blog update, the company reported that several of its other products were compromised as well.

Read more
Hackers just stole LastPass data, but your passwords are safe
A physical lock placed on a keyboard to represent a locked keyboard.

The developers behind password management software LastPass have just shared some concerning news: Bad actors were recently able to access “elements of our customers’ information” in a recent security breach.

It’s the second time in just a couple of months that LastPass has suffered a security incident, and it appears the two events are directly linked. That’s because LastPass’s developers say that the unauthorized party was able to access customer data “using information obtained in the August 2022 incident.”

Read more