Attackers compromised customer support files containing cookies and session tokens, which could result in malicious impersonation of valid Okta users.