Loading story…
Telecommunications provider Brightspeed is investigating claims by the Crimson Collective hacking group that it breached the company and disrupted customer connectivity. Reports say the attackers alleged they could disconnect Brightspeed users, raising concerns that the intrusion affected operational systems as well as customer data.
Multiple outlets reported that as many as 1 million Brightspeed customers may have had information exposed in the incident, although the full scope and authenticity of the attackers' claims had not been independently confirmed at the time of reporting. The incident has drawn attention because it combines alleged service disruption with a potentially large-scale data exposure at a major broadband provider.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting said Crimson Collective claimed it had disconnected some Brightspeed customers after the alleged breach. The same reporting also alleged that data relating to roughly 1 million customers may have been exposed.
Brightspeed said it was investigating the cyberattack allegations made by Crimson Collective. The company had not confirmed the full scope of the intrusion at that stage.
The threat group Crimson Collective publicly claimed to have breached Brightspeed and alleged access to company systems and customer data. Reports indicate the claim surfaced in early January 2026 and prompted wider scrutiny of the incident.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcenationalcioreview.com
Open sourceinfosecurity-magazine.com
Open sourcetechradar.com
Open sourcescworld.com
Open sourcecybernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Brightspeed, a major U.S. fiber broadband provider operating across 20 states, has reportedly suffered a significant cyberattack attributed to the threat group Crimson Collective. The attackers claim to have gained unauthorized access to Brightspeed's systems, exfiltrating sensitive data including personally identifiable information (PII) of both customers and employees. The group provided samples of the stolen data to cybersecurity researchers as proof of the breach, a tactic increasingly used by threat actors to pressure organizations and bolster their criminal reputation. The incident is notable due to Brightspeed's role as a critical infrastructure provider, serving millions of homes and businesses, and highlights a growing trend of attacks targeting telecommunications and broadband companies. Brightspeed has acknowledged the breach claims and stated that it is actively investigating the incident, emphasizing its commitment to network security and the protection of customer and employee information. The Crimson Collective alleges that the stolen data includes customer account details, addresses, user account information, payment history, some payment card data, and appointment records, potentially affecting over one million residential users. The group has threatened to release a sample of the data if their demands are not met. This breach follows previous high-profile attacks by Crimson Collective, including incidents involving Red Hat and Nissan, indicating a pattern of targeting large organizations for data theft and extortion.
Jun 29, 2026
British telecommunications company Brsk confirmed unauthorized access to one of its customer database systems, resulting in the exposure of over 230,000 customer records. The stolen data, which was advertised for sale on a cybercrime forum, included full names, email and home addresses, installation details, location data, phone numbers, and indicators of vulnerability status. Brsk stated that no financial information, passwords, or account credentials were compromised, and there is no evidence of misuse so far. The company has notified affected customers, offered them 12 months of free monitoring services, and reported the incident to relevant authorities, including the ICO and police. Separately, Comcast agreed to pay a $1.5 million fine to settle an FCC investigation into a February 2024 vendor data breach that exposed the personal and financial information of nearly 275,000 customers. The breach occurred at Financial Business and Consumer Solutions (FBCS), a former debt collection vendor, and included names, addresses, Social Security numbers, dates of birth, and account numbers. Comcast has committed to enhanced vendor oversight, regular risk assessments, and improved compliance reporting as part of the settlement. Both incidents highlight the ongoing risks to customer data in the telecommunications sector, whether from direct attacks or third-party vendor breaches.
Jun 29, 2026
Mexican IT and cybersecurity provider **Be Prime** disclosed a cyberattack after a threat actor using the alias **`dylanmarly`** posted alleged proof of compromise on a cybercrime forum. The attacker claimed to have accessed Be Prime administrative accounts, **Cisco Meraki Vision** surveillance systems, Meraki API keys, and thousands of network devices, and to have leaked **12.6 GB** of data linked to Be Prime and some of its clients. Public reporting said the intrusion may have involved administrator accounts without multifactor authentication, though Be Prime did not confirm those specific allegations. Be Prime said it activated containment, mitigation, investigation, and remediation measures with support from **Cisco Talos**, and stated that it had found no evidence so far of disruption to its own operations or those of customers. At the same time, the company warned it could pursue legal action against parties spreading what it described as false or out-of-context claims about the incident, a response that drew criticism from researchers and journalists who argued that threatening reporters and whistleblowers could intensify scrutiny of the breach and its potential impact on client data and video surveillance exposure.
Jun 29, 2026