Okta okta.com Okta data breach: what happened and what to do
In September 2023 a vendor, Rightway Healthcare, was breached, exposing a file with data on 4,961 current and former Okta employees: names, Social Security numbers and health plan numbers. Okta was told on 12 October 2023. Okta's customer data was not in this file.
View all 13,115 breaches- Breach date
- 23 Sept 2023
- Made public
- 1 Nov 2023
- Affected
- 4,961
- Data exposed
- Names, Social security numbers, Health insurance information
- Last updated
What happened
This page covers a breach at an Okta vendor that exposed employee data. It is separate from the October 2023 attack on Okta's customer support system.
Rightway Healthcare, a company that provides health benefits services to Okta, suffered a network breach on 23 September 2023. Okta learned about it on 12 October 2023, when Rightway disclosed the attack. The notice Okta filed with the Maine Attorney General covers 4,961 current and former employees. Okta's own notice letters were also logged by the California Attorney General in November 2023.
The attackers got an eligibility census file, which is a list of people enrolled in the health plan. It included:
- Names
- Social Security numbers
- Health plan numbers
Okta said the data dated from April 2019 through 2020, and that it was not aware of any misuse of it.
For the people involved, the Social Security number is the problem. With a name and that number a criminal can apply for credit or file a fraudulent tax return. A health plan number can be used to submit false insurance claims. The file didn't include passwords or payment cards.
Okta offered 24 months of credit monitoring, identity restoration and fraud detection through Experian. If you received a letter, enroll with the details in the letter itself.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Contact Equifax, Experian and TransUnion and place a free freeze. It blocks new accounts opened with your Social Security number.
- 2
Enroll in the Experian monitoring you were offered
If you received a notice letter, use the enrollment code printed in it. Don't use a code from an email or text.
- 3
Check your health plan statements
Look at explanation of benefits statements for claims you didn't make, and report anything odd to the plan.
- 4
Consider an IRS Identity Protection PIN
A Social Security number can be used to file a fake tax return. The IRS offers a free PIN that blocks it.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one too.
Frequently asked
Was I affected by this Okta data breach?
If you are a current or former Okta employee, check for a notice letter. Customers of Okta weren't part of this vendor breach.
What was exposed?
Names, Social Security numbers and health plan numbers, from an eligibility census file.
How many people were affected?
Okta's notice to the Maine Attorney General lists 4,961 current and former employees.
Should I change my password?
Passwords weren't in the file, so there is nothing to change for this breach. A credit freeze is the better step.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
