Okta Breached Credential Detected Then Session Allowed
Okta flagged a password as present in a known breach corpus and still issued a session for the same account within the same hour. Indicates the tenant's sign-on policy is not enforcing the breached-credential signal and the account is likely under attacker control.
Sigma
