Ask HN: Where is the update from Okta on the breach?

[parimm]

It is normal for a provider to not have shared and update over four hours after a suspected security breach is exposed on Twitter?

The lack of any communication from Okta seems odd.

Okta's status page - https://status.okta.com/ Okta's trust page - https://trust.okta.com/ Twitter account - https://twitter.com/okta

Disclosure: I work for a company that uses Okta for SSO but I'm not involved with the administration of the Okta instance.

[parimm]

Okta's CEO has put out a statement - https://twitter.com/toddmckinnon/status/1506184721922859010

[detaro]

What vendor have you seen a public response within 4 hours from for such a thing? And unless they've been investigating this for a while already (which one would hope) they wouldn't really be able to say much of substance.

[Mandatum]

Are you kidding? Most announce "investigation ongoing, we'll release an RCA as soon as it's available". Radio silence means they don't even know how fucked they are.

[detaro]

They've put out a statement by now.

And yes, "investigation ongoing, more later" would indeed be "not much of substance". Tells you nothing.