UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 8-K

CURRENT REPORT

Pursuant to Section 13 or 15(d)

of the Securities Exchange Act of 1934

Date of Report (date of earliest event reported)

March 21, 2022

Okta, Inc.

(Exact name of registrant as specified in its charter)

100 First Street, Suite 600

San Francisco, California 94105

(Address of principal executive offices)

(888) 722-7871

(Registrant’s telephone number, including area code)

(Former name or former address, if changed since last report)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:

Securities registered pursuant to Section 12(b) of the Act:

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Item 8.01 – Other Events

On March 21, 2022, a cybercrime group published a number of screenshots online that were taken from a computer used by a customer support engineer employed by a third-party vendor that supplies customer support services to Okta, Inc. (the “Company”). The Company has determined that the screenshots are related to an incident experienced by the vendor in January 2022. The vendor engaged a leading forensic firm to perform an investigation of the incident and has since advised the Company that the incident is not ongoing and has been remediated.

Based on the findings of the vendor’s forensic firm, in the January 2022 incident, there was a five-day window of time between January 16-21, 2022 when the cybercrime group had access to the vendor environment, which the Company also has validated with its own analysis. The Company has determined that the maximum potential impact is 366 (approximately 2.5% of) customers whose Okta tenant was accessed by the vendor during the five-day window. The potential impact to the Company’s customers is limited to the access that the vendor support engineers have in connection with their role. These support engineers are unable to create or delete users, download customer databases, or access the Company’s source code repositories. Support engineers are able to facilitate the resetting of passwords and multi-factor authentication factors for users, but are unable to obtain those passwords.

The Company’s service is fully operational. The Company does not consider the incident to be material.

The Company continues to investigate the incident and is in ongoing communication with its customers about the incident.

On March 22, 2022 and March 23, 2022, the Company issued blog posts announcing details relating to the foregoing incident, and will continue to post blog updates as warranted.

Item 9.01 - Financial Statements and Exhibits

(d) Exhibits

SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized on this 25th day of March, 2022.