Correction: After publishing, Red Hat confirmed that it was a GitLab account breach, not GitHub. An extortion group calling itself the Crimson Collective claims to have breached Red Hat's private GitLab repositories, stealing nearly 570GB of compressed data across 28,000 internal projects. This data allegedly includes approximately 800 Customer Engagement Reports (CERs), which can contain sensitive information about a customer's network and platforms. A CER is a consulting document prepared for clients that often contains infrastructure details, configuration data, authentication tokens, and other information that could be abused to breach customer networks. Red Hat confirmed that it suffered a security incident related to its consulting business, but would not verify any of the attacker's claims regarding the stolen GitLab repositories and customer CERs. "Red Hat is aware of reports regarding a security incident related to our consulting business and we have initiated necessary remediation steps," Red Hat told BleepingComputer. "The security and integrity of our systems and the data entrusted to us are our highest priority. At this time, we have no reason to believe the security issue impacts any of our other Red Hat services or products and are highly confident in the integrity of our software supply chain." While Red Hat did not respond to any further questions about the breach, the hackers told BleepingComputer that the intrusion occurred approximately two weeks ago. The...
Red Hat confirms security incident after hackers claim GitLab breach
Affected Software
Frequently Asked Questions
What has Red Hat confirmed, and what remains unverified?
Red Hat confirmed a security incident related to its consulting business and said it initiated remediation steps. It did not verify the Crimson Collective's claims that private GitLab repositories or customer engagement reports were stolen.
Which customers could be affected if the attackers' claims are accurate?
The alleged stolen data includes roughly 800 Customer Engagement Reports prepared for consulting clients. These reports can contain customer network and platform details, infrastructure information, configuration data, and authentication tokens.
Why would stolen Customer Engagement Reports pose a security risk?
Such reports may provide information that could be abused to breach customer networks, including infrastructure details, configuration data, and authentication tokens. The presence of these reports in the alleged theft has not been confirmed by Red Hat.
Was the claimed breach of GitHub or GitLab?
The article was corrected to state that the claimed breach involved a Red Hat GitLab account, not GitHub.