The OneLogin firm declared that it had found evidence of unauthorised access to its US-based systems.
After a review by the organisation, it was determined that a threat actor had access to a set of AWS keys and had utilised them to access the AWS API through an intermediary host that was hosted by a different, smaller US service provider.
Regarding the weaknesses that hackers used to gain access to the organisation, nothing is known.
OneLogin attested to the encryption of the data, but it also noted that threat actors may still be able to decrypt it.
Source: https://securityaffairs.com/59653/data-breach/onelogin-data-breach.html
"id": "ONE102261123",
"linkid": "onelogin",
"type": "Breach",
"date": "06/2017",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"