Hackers obtained valid credentials, but Okta doesn't say how.

Bet there was some good tokens in some of those customer HAR files.