Okta
Okta confirmed that an attacker had accessed a third-party support engineer's laptop and could interact with limited customer-support data.
-19.5% OKTA vs -4.1% SPY
This site shows how share prices moved after an incident became public. It does not prove that the incident caused the move. Company news, sector moves and the wider market can affect every result. Educational only — not investment advice.
Disclosure timing
When could the market react?
The baseline is the last adjusted close before the news was public. The reaction session is the first close afterward.
- 01Baseline sessionMar 21, 2022
Normalized to 100 for both OKTA and SPY.
- 02Public disclosureMar 22, 2022, 5:15 AM EDT
Documented publication time.
- 03First reaction closeMar 22, 2022
-1.8% company total return versus +1.2% for SPY; -2.9 pp market-relative return.
Time windows
Company vs SPY
Each row uses the last trading session on or before its target date. “Market-relative” is the company return minus the SPY return, in percentage points.
| Window | Endpoint | OKTA | SPY | Market-relative | Signal |
|---|---|---|---|---|---|
| First reaction | Mar 22, 2022 | -1.8% | +1.2% | -2.9 pp | Below SPY |
| +7 days | Mar 29, 2022 | -7.4% | +3.9% | -11.3 pp | Below SPY |
| +1 month | Apr 22, 2022 | -19.5% | -4.1% | -15.4 pp | Below SPY |
| +3 months | Jun 22, 2022 | -49.2% | -15.4% | -33.8 pp | Below SPY |
| +6 months | Sep 22, 2022 | -67.4% | -15.1% | -52.3 pp | Below SPY |
| +12 months | Mar 22, 2023 | -51.4% | -10.3% | -41.2 pp | Below SPY |
Compare with current catalog aggregates
| Window | This case | Catalog median | Catalog mean | n |
|---|---|---|---|---|
| First reaction | -2.9 pp | -0.8 pp | -1.5 pp | 30 |
| +7 days | -11.3 pp | -2.0 pp | -4.0 pp | 30 |
| +1 month | -15.4 pp | -6.6 pp | -6.8 pp | 30 |
| +3 months | -33.8 pp | -5.1 pp | -6.6 pp | 30 |
| +6 months | -52.3 pp | -5.6 pp | -7.5 pp | 30 |
| +12 months | -41.2 pp | -3.7 pp | -10.1 pp | 30 |
Normalized total return
OKTA compared with SPY
Baseline session = 100. Adjusted close reflects splits and reinvested distributions.
Okta had -51.4% company total return versus -10.3% for SPY; -41.2 pp market-relative return. The chart shows normalized adjusted-close performance for up to 24 months.
View tabular chart fallback
| Date | OKTA | SPY |
|---|---|---|
| Mar 21, 2022 | 100.0 | 100.0 |
| Apr 20, 2022 | 85.4 | 100.1 |
| May 19, 2022 | 49.0 | 87.6 |
| Jun 21, 2022 | 49.7 | 84.8 |
| Jul 21, 2022 | 61.6 | 90.1 |
| Aug 19, 2022 | 56.8 | 95.4 |
| Sep 20, 2022 | 34.5 | 87.2 |
| Oct 19, 2022 | 31.8 | 83.6 |
| Nov 17, 2022 | 29.0 | 89.5 |
| Dec 19, 2022 | 38.6 | 86.6 |
| Jan 20, 2023 | 40.6 | 90.2 |
| Feb 21, 2023 | 42.6 | 91.0 |
| Mar 22, 2023 | 48.6 | 89.7 |
| Apr 21, 2023 | 44.8 | 94.3 |
| May 22, 2023 | 50.4 | 95.8 |
| Jun 22, 2023 | 41.9 | 100.3 |
| Jul 24, 2023 | 41.6 | 104.3 |
| Aug 22, 2023 | 42.1 | 100.6 |
| Sep 21, 2023 | 47.9 | 99.4 |
| Oct 20, 2023 | 44.6 | 97.1 |
| Nov 20, 2023 | 42.5 | 104.7 |
| Dec 20, 2023 | 50.3 | 108.4 |
| Jan 23, 2024 | 50.9 | 112.2 |
| Feb 22, 2024 | 48.6 | 117.5 |
| Mar 22, 2024 | 62.6 | 121.0 |
Price recovery
Not recovered within 24 months
Here, recovery only means that adjusted close reached the baseline again. It does not mean every effect of the incident ended.
- State
- Not recovered within 24 months
- Initial trough
- -18.5% on Mar 25, 2022
- Recovery close
- Not applicable / not observed
- Calendar days
- —
- Observation cap
- 24 months after disclosure
Hypothetical $1,000
What would $1,000 have looked like?
Compare $1,000 in OKTA with $1,000 in SPY, bought and measured on the same dates.
Entry Mar 25, 2022 Exit Sep 23, 2022
Uses fractional shares and adjusted close. Leaves out taxes, fees and slippage. The holding period starts on the purchase date. This is a historical illustration, not an investment strategy.
Case note
Okta responded to screenshots published by LAPSUS$ and connected them to a January compromise involving a support engineer employed by a subprocesser. The company initially described a five-day window and limited support privileges, then refined its assessment.
The first timestamped issuer update was published before the US session, making March 21 the baseline and March 22 the reaction session. The issuer role is responsible vendor rather than direct data victim.
Evidence
Sources and case review
We qualify each case before checking its price results. These links support the disclosure date, listing, incident and business impact.
- primary Mar 22, 2022Official Okta statement on LAPSUS$ claims Okta Supports: Disclosure, Timing, Impact, Description
- primary Mar 7, 2022Okta fiscal 2022 Form 10-K Okta / U.S. SEC Supports: Listing
- Listing evidenceChecked Jul 20, 2026Okta official statement on LAPSUS$ claims Okta Okta's issuer statement and SEC history confirm its Nasdaq listing and event disclosure.
Why it is included. Okta was the responsible identity-service vendor, the compromise involved a support subcontractor with customer access, and the potential cross-customer reach met the systemic threshold. Reviewed Jul 20, 2026.