Shares of Okta Inc. dropped 2.3% today after the company posted better-than-expected quarterly earnings but investors didn’t like the revelation today that a previously disclosed breach had affected more users than originally believed.

San Francisco-based Okta provides two cloud platforms that organizations can use to process login requests to their applications. One platform focuses mainly on processing login requests from employees, while the other is geared towards customer sign-ins. Okta says its software is used by more than 18,800 organizations worldwide.

In late September, the company detected that hackers had breached one of the applications it uses to process customer support tickets. Earlier this month, Okta announced that the breach compromised data belonging to 134 customers, including several major software companies. In at least five cases, the hackers used the stolen records to launch cyberattacks against the affected customers.

In a blog post published this morning, Okta Chief Security Officer David Bradbury revealed that more customer information was stolen than originally believed. The hackers accessed the names and email addresses of most of the customers who use Okta’s Workforce Identity Cloud platform, which helps workers securely log into their companies’ applications.

Public sector customers that use the FedRamp High and DoD IL4 versions of the platform are not affected. Likewise, the hackers didn’t access data belonging to customers of Okta’s Customer Identity Cloud platform. The latter platform is based on technology the company obtained through its $6.5 billion acquisition of rival Auth0 in 2021.

In today’s blog post, Bradbury detailed that the hackers stole the data from Okta’s breached customer support system by generating spreadsheet reports that contained user information. Those reports included not only customer names and email addresses but also certain account data belonging to about 0.6% of the affected users. However, the hackers didn’t access any sensitive personal data or user login credentials.

“While we do not have direct knowledge or evidence that this information is being actively exploited, there is a possibility that the threat actor may use this information to target Okta customers via phishing or social engineering attacks,” Bradbury wrote. “Okta customers sign-in to Okta’s customer support system with the same accounts they use in their own Okta org. Many users of the customer support system are Okta administrators.”

During its initial investigation of the breach, Okta mapped out the scope of the incident by recreating the reports the hackers generated to access customer data. One of the recreated reports had different settings than the ones the hackers used. Okta engineers changed the inaccurate settings earlier this month, which is when they determined the breach had affected more customer data than initially believed.

The release of the new breach details may not have been the only factor that weighed on its stock price today. In conjunction with the disclosure, the company posted third quarter financial results that topped the consensus analyst estimate. However, it detailed that it expects revenue growth to slow next year.

Okta’s sales increased 21% year-over-year, to $584 million in the third quarter, well ahead of the $563.14 million projected by analysts. It cited demand for its Identity Governance offering as one factor behind the better-than-expected growth. Introduced last August, Identity Governance enables companies to centrally regulate which employee can access what internal application and how. 

The company closed the third quarter with adjusted operating income of $85 million after generating no profit 12 months earlier. That translated into adjusted earnings per share of 44 cents, more than the 29 cents analysts had forecasted.

Okta expects to generate between $585 million and $587 million in revenue during the current quarter, or 15% more than the same time 12 months earlier. That puts the company on track to end the fiscal year with sales up 21%. Next year, Okta expects to grow its top line by another 10% to between $2.46 billion and $2.47 billion. 

Photo: Okta