2022 Foundever / Sitel Group (legacy Sykes) — Lapsus$ path impacting Okta support engineer context
Data compromised
Support-engineering session and configuration visibility impacting Okta tenant risk rather than a classic consumer row dump from Foundever alone
Technical writeup
Customer-experience outsourcer Sykes—post-acquisition part of Sitel Group, now branded Foundever—acknowledged January 2022 unauthorized activity on legacy Sykes infrastructure tied to the Lapsus$ wave that indirectly exposed Okta support workflows when attackers remote-controlled a subcontractor workstation logged into Okta tools. Foundever and Okta each published timelines disputing spreadsheet password claims while confirming containment cooperation.
Root cause
Credential or remote-access compromise on BPO endpoints with follow-on abuse of trusted support sessions (Lapsus$ nexus)