They only have to report if there is significant risk to the individuals involved. If there are few individuals and the event was indeed contained, they have no reporting requirement.

Doesn't that depends on how well they separate access within the company? If they know that one of their support reps in Costa Rica was "turned", they might not have to declare anything in the EU if they can prove that the rep has zero access to EU customers.

Edit: to be clear, I don't know, it's a genuine question. Does "any breach" count?

It has to be a breach where EU citizens' PII was potentially accessed.

Notification is required only if their impact assessment concludes on a significant risk to users (which they must be able to produce to the data protection authority at any time).

Otherwise, business as usual.

Okta is a company in the United States of America, by law companies under GDPR are already in violation when transferring data to Okta and would have needed to report themselves long before the breach.