Okta: Stock Plummets After the Firm Discloses a Security Breach in Its Support System

We are maintaining our $85 fair value estimate for no-moat Okta OKTA after the firm faced yet another security incident, stemming from a nefarious actor gaining access to its support case management system. While we await results from Okta’s internal investigation that will provide more details into the scope and timeline of the breach, one of Okta’s customers, BeyondTrust, published a detailed blog post in which the company claims to have alerted Okta regarding this breach more than two weeks ago. Okta’s shares are down around 8% following the company’s disclosure.

While we maintain our fair value estimate as the financial fallout from the breach remains uncertain, we’d encourage investors seeking security exposure to consider moatier security names such as Palo Alto Networks, CrowdStrike, Fortinet, and Zscaler.

According to Okta’s disclosure, an attacker was able to gain access to the firm’s support system and to potentially access sensitive files such as cookies and session tokens that could then be used to impersonate valid users.

BeyondTrust, an identity security vendor that is also an Okta customer, claims that an attacker tried to access an in-house Okta administrator account using a valid session cookie stolen from Okta’s support system on Oct. 2, more than two weeks ago. BeyondTrust was able to block the attacker’s access and alert Okta to a potential breach of its support system the same day. What we find concerning is that it took Okta more than two weeks to act on and disclose this threat, despite having a security-focused customer alerting it of the breach.

While we await more details from Okta, we find it pertinent to mention that security breaches can exact a heavy toll on a security firm that gets compromised. At the same time, we don’t anticipate that the scale of potential damage to Okta will be similar to SolarWinds, a firm that saw its shares lose almost half their value in December 2020 after reporting a major breach.