Loading story…
Red Hat experienced a significant security incident involving the unauthorized access and exfiltration of data from its private GitHub repositories. The extortion group known as the Crimson Collective claimed responsibility for the breach, stating they stole approximately 570GB of compressed data, which included over 28,000 internal projects and hundreds of Customer Engagement Reports (CERs). These CERs are consultancy documents that often contain highly sensitive information such as architecture diagrams, configuration details, authentication tokens, database connection strings, and network maps, effectively providing blueprints of customer IT environments. The attackers published file listings and shared samples of the stolen data, which were verified by journalists to contain configuration snippets and references to customer systems. The group asserted that the compromised data spanned from 2020 to 2025 and involved major organizations across banking, telecom, government, airlines, and public-sector sectors, with specific mentions of companies like Citi, Verizon, Siemens, Bosch, JPMC, HSBC, and even the U.S. Senate. The Crimson Collective also claimed to have found authentication tokens and other credentials within the repositories and CERs, which they allegedly used to access downstream customer infrastructure. They stated that they attempted to warn affected customers but were ignored. Red Hat confirmed the security incident related to its consulting business but did not verify the full extent of the attackers' claims or the specific details of the breach. The company emphasized that, at the time, there was no evidence the incident impacted other Red Hat services or products, and they expressed confidence in the integrity of their software supply chain. The breach was first disclosed by the attackers on Telegram, where they posted a full file tree, CER list, and screenshots as proof. The incident has raised concerns about the exposure of sensitive customer data and the potential for further attacks leveraging the stolen credentials and infrastructure details. Red Hat has not publicly disclosed how the attackers gained access or whether they received any extortion demands, though the Crimson Collective claimed to have contacted the company and received only a generic response. The breach highlights the risks associated with storing sensitive customer information and credentials in internal repositories and the potential downstream impact on customers when such data is compromised. Security researchers have warned that the exposed information could be used to target Red Hat's clients with tailored attacks, given the detailed nature of the stolen CERs. The incident underscores the importance of robust access controls, credential management, and rapid incident response in protecting both corporate and customer assets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Rapid7 published research describing Crimson Collective as a cloud-focused threat group targeting AWS environments using stolen long-term access keys, privilege escalation, snapshot abuse, and SES-based extortion notes. The report connected the group to the Red Hat incident and provided new technical details on its operations.
New reports said the Red Hat attackers were collaborating with a group referred to as 'Scattered Lapsus$ Hunters' to intensify extortion pressure. Coverage described the effort as an escalation of the campaign beyond the initial breach claim.
Additional reporting said the stolen consulting data related to more than 5,000 enterprise customers and included sample engagement reports and exposed certificates. These disclosures expanded the apparent scope and potential downstream impact of the breach.
GitLab stated that the incident involved Red Hat's self-managed GitLab Community Edition instance, not GitLab-managed infrastructure. This clarified that the breach was limited to Red Hat's own deployment.
As the investigation progressed, Red Hat involved authorities and began directly notifying impacted consulting customers. Customers were advised to rotate credentials and review their environments for possible exposure.
Red Hat acknowledged unauthorized access to the GitLab instance, said some data was copied, and began containment and remediation measures such as isolating the affected system and revoking access. The company stated there was no evidence its software supply chain, products, or other services were impacted.
On or before the first public reports, Crimson Collective publicly claimed it had exfiltrated roughly 570GB of data from about 28,000 Red Hat internal repositories, including around 800 customer engagement records. The group said the material contained credentials, infrastructure details, and consulting data tied to major enterprises and government entities.
After stealing data, the extortion group Crimson Collective contacted Red Hat and demanded payment. Red Hat did not comply with the demand.
Attackers gained unauthorized access to a self-hosted GitLab instance used by Red Hat Consulting and copied data from internal repositories. Multiple reports say the intrusion occurred about two weeks before public disclosure.
24 references tracked. Mallory keeps watching after this page renders.
finra.org
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open source404media.co
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat confirmed a significant security incident after hackers from a group calling themselves "Crimson Collective" breached the company's GitLab instance. The attackers reportedly exfiltrated nearly 570GB of data, including approximately 800 Customer Engagement Reports spanning from 2020 to 2025. These reports are believed to contain sensitive information such as infrastructure details, authentication tokens, database URIs, and other credentials that could potentially allow unauthorized access to customer networks. In addition to the reports, the attackers claim to have stolen 28,000 private repositories, which included credentials, CI/CD secrets, pipeline configurations, VPN profiles, and infrastructure blueprints. The breach has raised concerns about the exposure of confidential customer and internal Red Hat data, as well as the potential for downstream attacks leveraging the stolen information. Analysis of the leaked data suggests that the attackers obtained a wide array of sensitive materials that could be used for further exploitation or sold on underground forums. The incident highlights the risks associated with source code management platforms and the importance of securing CI/CD pipelines and repository access. Red Hat has acknowledged the breach and is conducting an internal investigation to assess the full scope and impact. The company is working with affected customers to mitigate risks and has likely initiated incident response protocols, including credential rotation and infrastructure reviews. Security experts warn that the exposure of such a large volume of sensitive data could have long-term repercussions for both Red Hat and its customers, especially if the information is weaponized by other threat actors. The breach underscores the need for robust access controls, regular security audits, and rapid response capabilities in managing source code and customer data. Industry observers are closely monitoring the situation for signs of further exploitation or public release of the stolen data. The incident serves as a stark reminder of the evolving threat landscape and the persistent targeting of technology vendors by sophisticated cybercriminal groups. Organizations are advised to review their own security postures, especially regarding third-party software providers and supply chain dependencies, in light of this breach.
Jul 12, 2026
Red Hat, a leading enterprise software provider, confirmed a significant cyberattack resulting in unauthorized access to one of its GitLab instances. The breach was initially claimed by a hacking group known as Crimson Collective, who stated they had exfiltrated approximately 570GB of compressed data from Red Hat's internal development repositories. Among the stolen data were around 800 Customer Engagement Reports (CERs), which contain sensitive infrastructure and authentication details for numerous organizations across various sectors. Red Hat clarified that the compromised GitLab instance was used exclusively for Red Hat Consulting engagements, but the exposure of CERs poses a substantial risk to affected customers. Following the breach, Crimson Collective attempted to extort Red Hat, demanding a ransom to prevent the public disclosure of the stolen data. When Red Hat did not respond to these demands, Crimson Collective escalated their efforts by partnering with the ShinyHunters extortion group. ShinyHunters subsequently listed Red Hat on their newly launched data leak site, threatening to release the stolen data publicly if their ransom demands were not met by October 10th. The extortion campaign was further publicized through posts on Telegram, where the threat actors boasted about their alliance and intentions to target corporations. The incident highlights the growing trend of collaboration among cybercriminal groups to maximize pressure on victims and increase the likelihood of ransom payments. The breach also underscores the risks associated with third-party and internal development platforms, as attackers increasingly target these environments for valuable data. Red Hat's confirmation of the breach and the nature of the compromised data has raised concerns among its customers, particularly those whose sensitive information may now be at risk of exposure. The attack is part of a broader pattern of ransomware and extortion operations targeting high-profile technology companies. Security researchers have noted that the professionalization and convergence of cybercrime groups, as seen in this incident, are making such attacks more sophisticated and damaging. The Red Hat breach serves as a warning to organizations to strengthen their security posture around development environments and to prepare for the possibility of multi-stage extortion campaigns. The incident also demonstrates the importance of timely communication and transparency with affected stakeholders in the aftermath of a breach. As the deadline for the public release of the stolen data approaches, Red Hat and its customers face heightened risks of data exposure, reputational damage, and potential regulatory scrutiny. The evolving tactics of groups like Crimson Collective and ShinyHunters signal a challenging threat landscape for enterprises worldwide.
Jun 29, 2026
Craneware, a U.K.-based healthcare software company whose products are used by more than 2,000 U.S. hospitals and nearly 10,000 clinics and retail pharmacies, disclosed that attackers breached a subset of its internal data environment and exfiltrated employee, customer, and business partner information. The company said unauthorized individuals viewed and copied a significant volume of file names tied largely to non-sensitive or publicly available regulatory data, but confirmed that some sensitive corporate records were also taken. The company said the intrusion has been contained and that the attackers no longer have access, with no disruption reported to Craneware operations or the hospital services it supports. Craneware said it activated its incident response plan, brought in external cybersecurity and forensic investigators, and notified the FBI and the U.K. Information Commissioner’s Office, while continuing to determine the full scope of the breach and whether any additional impacted data sets are involved.
Jul 22, 2026