Identity Is the Target: Single Sign-On Leaks, Session Theft and the Case for Credential-Free Authentication

Identity Is the Target: Single Sign-On Leaks, Session Theft and the Case for Credential-Free Authentication

Week of 2 November 2026 | Compiled by Team Paringa

This week's identity picture: attackers go after the login layer itself, and MFA that still issues something to steal is only a partial answer.

What Happened This Week

🔴 Hacker claims 40,000+ DHS personnel records from an Okta SSO system

TechCrunch reports a hacker using the handle "Department of Peace" claimed to have taken data from the Okta single sign-on system used by Department of Homeland Security employees and contractors. The records cover more than 40,000 people, roughly a fifth of the department's workforce of about 220,000. About 21,000 are Customs and Border Protection staff, about 10,000 are ICE and Homeland Security Investigations, and just under 1,000 are from CISA. TechCrunch verified part of the data against an offline copy of the database and says timestamps suggest it was taken around mid-August. The data was passed to DDoSecrets, which published it.

The data reportedly includes names, job titles and work contact details, along with records of which systems each user can access. Okta said it was aware of the report and that "we have no evidence our data or systems were compromised." DHS said it is aware of a potential breach and is working to address it, but did not say whether the breach was confirmed. How the data was obtained is not public. The incident is a claim, not a confirmed Okta failure, and it may relate to the customer's tenant configuration rather than the platform.

Whatever the root cause, the lesson for identity teams is the concentration of risk. A single sign-on directory is a map of who can reach what. Staff names, roles and access entitlements make highly targeted phishing and social engineering far easier, including against people who hold sensitive roles.

Sources: TechCrunch, This Week in Security

Every identity platform that stores and issues credentials becomes a target worth a patient attacker's time. The strategic question is how much there is to steal. Where authentication relies on shared secrets, tokens and directories full of entitlements, a single breach exposes the lot. Credential-free authentication changes that equation because no credential is issued in the first place. Ask your identity provider what an attacker would actually walk away with.

🟡 Semperis: 87% of ransomware victims saw identity systems targeted (vendor-reported)

CBS News reports on Semperis's 2026 Ransomware Risk Report, a survey of 1,200 IT and security professionals across nine countries. Semperis reports 87% of ransomware victims experienced attacks on their identity systems, 84% said attackers used AI, and 44% said attackers exploited the victim's own AI agents or systems. Semperis's Courtney Guss warned that AI agents requesting extra permissions can create risk, particularly if they compromise identity systems. This is a vendor survey and the figures are uncorroborated. Sources: CBS News

Take the direction rather than the percentage: identity infrastructure is where ransomware operators aim first. Machine and agent identities need the same scrutiny as people, and any static secret they hold is something to rotate or remove.

🟡 Phishing kits keep beating MFA by stealing the session

The FBI warned in May that the Kali365 phishing-as-a-service platform, reported by The Register, captures OAuth tokens through device code phishing, with AI-generated lures and subscriptions from $250 a month. Microsoft's Tanmay Ganacharya said there were "hundreds of compromises occurring daily". Adversary-in-the-middle kits go further: the victim signs in normally, passes MFA, and the attacker replays the captured session cookie. This is older reporting, but BleepingComputer's current coverage continues to flag MFA phishing alongside stolen tokens as a leading entry route. Sources: The Register | BleepingComputer

This is the uncomfortable gap in conventional MFA: the user does everything right and the attacker still ends up with a valid session. Phishing-resistant methods help at the point of login but a stolen session token can undo them. Look for approaches that leave no reusable credential or token to replay.

What Identity Leaders Are Dealing With

The perimeter conversation has moved from "do we have MFA" to "what can an attacker steal after MFA". Session tokens, OAuth grants, device codes and SSO directories all remain valuable and reusable. Phishing kits sold as a service put that capability in the hands of low-skill actors, and AI-written lures remove the old spelling-mistake giveaways.

Boards increasingly ask for evidence that identity risk is shrinking. Counting MFA enrolments does not show that. Reducing the number of credentials, tokens and secrets that exist does.

Three Things Worth Watching Next Week

1. DHS and Okta follow-up — whether the root cause of the claimed leak is disclosed, and whether it was tenant configuration or the platform. 2. Device-code and AiTM guidance — further advisories on blocking device code flow and restricting authentication transfer. 3. Agent identities — more reports of attackers abusing AI agents' permissions as an identity route.

Could not verify: The DHS leak rests on TechCrunch plus a newsletter summary of Wired and BBC; the root cause is unknown. Semperis figures are vendor-reported and uncorroborated. The Kali365 reporting is from May and is context, not new this week.

Questions? hello@paringa.ai

Paringa helps organisations reduce identity risk by removing the credentials attackers rely on, through specialist partners. We turn weekly noise into the few decisions that matter. | 2 November 2026 | © Paringa Ltd