The attackers exploited compromised credentials from a third-party contractor to enter Okta's network, initiating the breach. The login was detected from an unusual IP address not previously associated with the contractor.