What the vendor investigation reported
Okta’s November 2023 report describes unauthorized access to customer-support files between 28 September and 17 October 2023. Some HAR files contained session tokens that were used to hijack customer sessions. The report describes a service-account credential saved into a personal browser profile and identifies compromise of the personal account or device as the most likely exposure path.
Okta also documented an investigation gap: file downloads through a different interface generated different events from those initially reviewed. Its October advisory explained that HAR archives can contain credentials and session data and recommended sanitization. The article’s incident date marks the start of the reported access window; Web3Sec has not independently inspected those systems or determined current customer impact.
A support attachment can cross a privilege boundary
Our analysis: a diagnostic archive may contain the same authority as an authenticated browser session. Sending it to a support system changes who can access that authority, even if the main application never exposes its database. Classify HAR files, memory dumps, screenshots and environment captures by their possible contents, not by the assumption that troubleshooting material is harmless.
Create sanitized captures using test identities where practical. Review request and response headers, cookies, URLs and bodies before sharing an analysis copy. Keep original evidence in a restricted location when an investigation requires it. Invalidate sessions or secrets included in a capture according to their actual exposure, rather than assuming that deleting the support ticket retracts all copies.
Test the audit event, not just the visible workflow
Inventory ways to access an attachment: opening a case, browsing a file list, downloading by direct link, using an API and accessing an exported archive. Use a synthetic file to verify which log event each path creates. Confirm that the investigation query includes all relevant event types and that retention, delays and pagination do not silently omit part of the timeline.
Apply the same reasoning to browser synchronization and service identities. Determine whether managed credentials can enter a personal profile and whether a support account can read more cases than necessary. Remove unnecessary access and verify the denied path with a test account. Distinguish the identity that logs into the support platform from the customer session token contained in its files; both can require separate revocation.
Practice evidence handling and customer containment
Run an exercise with a deliberately invalid dummy token inside a support archive. Ask the support operator to identify sensitive content, route a restricted copy and explain how the receiving system records access. Ask the responder to reconstruct every download through the supported interfaces. Keep all materials synthetic so the exercise does not create another credential leak.
For a real incident, preserve the attachment-access history, identify affected live authority, revoke it and review subsequent account actions. Communicate separately about known file access, suspected token exposure and confirmed account use. Completion is a verified chain from evidence access to customer-session containment, with explicit logging gaps and no unsupported claim that a password change alone ended every active session.
Controls to take away
- Support systems can hold live authorization material.
- Different interfaces may generate different audit events.
- Attachment access and downstream session use need separate investigation.
Take this to your next review
Working checklist
Use this as a starting point, then assign owners and record evidence in your team's own system. Checks here reset when you leave or reload this note.
0 of 5 reviewed
Sources & further reading
Incident facts are attributed to the reports below. Controls and recommendations are our interpretation; this is not an independent forensic investigation.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.