Stopping payroll diversion without disrupting the business

The incident

Valid credentials became a payroll attack path

The pattern was clear and repeatable: failed Okta login attempts, a successful new-device sign-in, a rapid pivot into Workday, and attempted changes to direct deposit or payment election details.

1. Failed Okta logins. One source IP working through multiple accounts.
2. New-device sign-in. A successful login from an unfamiliar device.
3. Workday access. Immediate pivot from identity into HR and payroll.
4. Payment election attempt. Direct deposit changes attempted for monetization.

Okta was the entry point. Workday was the objective.

The attacker did not exploit a misconfiguration. They logged in with valid credentials and moved directly toward monetization.

Speed increased. Documentation fragmented.

Identity teams, application teams, containment owners, and a real-time scribe moved in parallel during escalation.

Leadership needed proof

• Which accounts were compromised?
• Were payroll changes executed?
• When were containment actions taken?
• Could payroll change functionality be safely restored?

Mitiga in action

Detection, visibility, and timeline clarity

Detecting the pattern

Mitiga built an Indicator of Attack for one source IP targeting multiple Okta accounts. Thirty days of activity were backfilled, and the detection moved into production within hours.

Validating the pivot

Mitiga restored Workday log visibility, resolved processing blockers, and brought sign-on and user activity into one investigative view with Okta anomalies.

Reconstructing the timeline

A detailed write-up correlated identity and payroll telemetry, confirmed containment timing, and clarified who did what and when.

“Your write up was instrumental in helping us validate the timelines.”
Post-incident review feedback

Unified response timeline

From backfill to restore

1. Backfill. 30 days of Okta activity.
2. Deploy. IoA in production within hours.
3. Correlate. Okta, Workday and identities in one view.
4. Validate. Containment and ownership sequence.
5. Restore. Payment changes safely re-enabled.

Outcome

The breach attempt didn’t become a business crisis

Mitiga provided panoramic visibility across identity and payroll systems, decoded the attack path into a validated timeline, and enabled decisive containment without disrupting payroll operations.

1. Payroll diversion risk contained. Identity anomalies were correlated to attempted payroll modification activity.
2. Manual stitching eliminated. Okta and Workday telemetry appeared in one investigative view.
3. Sequencing uncertainty reduced. The incident write-up became a forensic anchor for review.
4. Operational confidence restored. Payment-election changes were re-enabled with validated telemetry.