Loading story…
Brightspeed, a major U.S. fiber broadband provider operating across 20 states, has reportedly suffered a significant cyberattack attributed to the threat group Crimson Collective. The attackers claim to have gained unauthorized access to Brightspeed's systems, exfiltrating sensitive data including personally identifiable information (PII) of both customers and employees. The group provided samples of the stolen data to cybersecurity researchers as proof of the breach, a tactic increasingly used by threat actors to pressure organizations and bolster their criminal reputation. The incident is notable due to Brightspeed's role as a critical infrastructure provider, serving millions of homes and businesses, and highlights a growing trend of attacks targeting telecommunications and broadband companies.
Brightspeed has acknowledged the breach claims and stated that it is actively investigating the incident, emphasizing its commitment to network security and the protection of customer and employee information. The Crimson Collective alleges that the stolen data includes customer account details, addresses, user account information, payment history, some payment card data, and appointment records, potentially affecting over one million residential users. The group has threatened to release a sample of the data if their demands are not met. This breach follows previous high-profile attacks by Crimson Collective, including incidents involving Red Hat and Nissan, indicating a pattern of targeting large organizations for data theft and extortion.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
The group later claimed it had disconnected some Brightspeed home internet users in addition to stealing customer data. Brightspeed confirmed only that an investigation was ongoing and did not verify the alleged service disruptions.
Crimson Collective posted alleged proof of the breach, including data samples, and offered the full dataset for sale for three bitcoin. The group also threatened to release the data within a week if it was not purchased.
Brightspeed said it was investigating the breach claims, taking the matter seriously, and working to notify affected parties and authorities as more information became available. The company had not confirmed the full scope of the alleged compromise.
The extortion group Crimson Collective claimed it breached Brightspeed and stole data tied to more than 1 million customers. Reported stolen information included PII, account details, payment history, appointment records, and some payment card data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Telecommunications provider **Brightspeed** is investigating claims by the **Crimson Collective** hacking group that it breached the company and disrupted customer connectivity. Reports say the attackers alleged they could disconnect Brightspeed users, raising concerns that the intrusion affected operational systems as well as customer data. Multiple outlets reported that as many as **1 million Brightspeed customers** may have had information exposed in the incident, although the full scope and authenticity of the attackers' claims had not been independently confirmed at the time of reporting. The incident has drawn attention because it combines alleged service disruption with a potentially large-scale data exposure at a major broadband provider.
Jul 12, 2026
Red Hat experienced a significant security incident involving the unauthorized access and exfiltration of data from its private GitHub repositories. The extortion group known as the Crimson Collective claimed responsibility for the breach, stating they stole approximately 570GB of compressed data, which included over 28,000 internal projects and hundreds of Customer Engagement Reports (CERs). These CERs are consultancy documents that often contain highly sensitive information such as architecture diagrams, configuration details, authentication tokens, database connection strings, and network maps, effectively providing blueprints of customer IT environments. The attackers published file listings and shared samples of the stolen data, which were verified by journalists to contain configuration snippets and references to customer systems. The group asserted that the compromised data spanned from 2020 to 2025 and involved major organizations across banking, telecom, government, airlines, and public-sector sectors, with specific mentions of companies like Citi, Verizon, Siemens, Bosch, JPMC, HSBC, and even the U.S. Senate. The Crimson Collective also claimed to have found authentication tokens and other credentials within the repositories and CERs, which they allegedly used to access downstream customer infrastructure. They stated that they attempted to warn affected customers but were ignored. Red Hat confirmed the security incident related to its consulting business but did not verify the full extent of the attackers' claims or the specific details of the breach. The company emphasized that, at the time, there was no evidence the incident impacted other Red Hat services or products, and they expressed confidence in the integrity of their software supply chain. The breach was first disclosed by the attackers on Telegram, where they posted a full file tree, CER list, and screenshots as proof. The incident has raised concerns about the exposure of sensitive customer data and the potential for further attacks leveraging the stolen credentials and infrastructure details. Red Hat has not publicly disclosed how the attackers gained access or whether they received any extortion demands, though the Crimson Collective claimed to have contacted the company and received only a generic response. The breach highlights the risks associated with storing sensitive customer information and credentials in internal repositories and the potential downstream impact on customers when such data is compromised. Security researchers have warned that the exposed information could be used to target Red Hat's clients with tailored attacks, given the detailed nature of the stolen CERs. The incident underscores the importance of robust access controls, credential management, and rapid incident response in protecting both corporate and customer assets.
Jun 29, 2026
Red Hat, a leading enterprise software provider, confirmed a significant cyberattack resulting in unauthorized access to one of its GitLab instances. The breach was initially claimed by a hacking group known as Crimson Collective, who stated they had exfiltrated approximately 570GB of compressed data from Red Hat's internal development repositories. Among the stolen data were around 800 Customer Engagement Reports (CERs), which contain sensitive infrastructure and authentication details for numerous organizations across various sectors. Red Hat clarified that the compromised GitLab instance was used exclusively for Red Hat Consulting engagements, but the exposure of CERs poses a substantial risk to affected customers. Following the breach, Crimson Collective attempted to extort Red Hat, demanding a ransom to prevent the public disclosure of the stolen data. When Red Hat did not respond to these demands, Crimson Collective escalated their efforts by partnering with the ShinyHunters extortion group. ShinyHunters subsequently listed Red Hat on their newly launched data leak site, threatening to release the stolen data publicly if their ransom demands were not met by October 10th. The extortion campaign was further publicized through posts on Telegram, where the threat actors boasted about their alliance and intentions to target corporations. The incident highlights the growing trend of collaboration among cybercriminal groups to maximize pressure on victims and increase the likelihood of ransom payments. The breach also underscores the risks associated with third-party and internal development platforms, as attackers increasingly target these environments for valuable data. Red Hat's confirmation of the breach and the nature of the compromised data has raised concerns among its customers, particularly those whose sensitive information may now be at risk of exposure. The attack is part of a broader pattern of ransomware and extortion operations targeting high-profile technology companies. Security researchers have noted that the professionalization and convergence of cybercrime groups, as seen in this incident, are making such attacks more sophisticated and damaging. The Red Hat breach serves as a warning to organizations to strengthen their security posture around development environments and to prepare for the possibility of multi-stage extortion campaigns. The incident also demonstrates the importance of timely communication and transparency with affected stakeholders in the aftermath of a breach. As the deadline for the public release of the stolen data approaches, Red Hat and its customers face heightened risks of data exposure, reputational damage, and potential regulatory scrutiny. The evolving tactics of groups like Crimson Collective and ShinyHunters signal a challenging threat landscape for enterprises worldwide.
Jun 29, 2026