Ask HN: Where is the update from Okta on the breach?
It is normal for a provider to not have shared and update over four hours after a suspected security breach is exposed on Twitter?
The lack of any communication from Okta seems odd.
Okta's status page - https://status.okta.com/ Okta's trust page - https://trust.okta.com/ Twitter account - https://twitter.com/okta
Disclosure: I work for a company that uses Okta for SSO but I'm not involved with the administration of the Okta instance.
Okta's CEO has put out a statement - https://twitter.com/toddmckinnon/status/1506184721922859010
What vendor have you seen a public response within 4 hours from for such a thing? And unless they've been investigating this for a while already (which one would hope) they wouldn't really be able to say much of substance.
Are you kidding? Most announce "investigation ongoing, we'll release an RCA as soon as it's available". Radio silence means they don't even know how fucked they are.
They've put out a statement by now.
And yes, "investigation ongoing, more later" would indeed be "not much of substance". Tells you nothing.