Red Hat GitLab Breach: 570GB Data Stolen by Crimson Collective

TL;DR

A security breach in Red Hat's consulting GitLab instance led to the theft of 570GB of data by the "Crimson Collective," impacting around 800 organizations across multiple sectors.

Key Points

Highlight key points with color coding based on sentiment (positive, neutral, negative).

A security breach occurred in a Red Hat GitLab instance managed for consulting purposes, where the cybercrime group "Crimson Collective" accessed and stole 570 gigabytes of data from over 28,000 repositories.

The breach affected approximately 800 organizations across various sectors, including major financial institutions, telecom companies, government agencies, healthcare providers, and corporate entities.

Sensitive information compromised in the breach included Customer Engagement Reports, which contained architecture diagrams, configuration details, authentication tokens, and network maps.

Security experts recommend organizations conduct thorough audits of credentials and dependencies, rotate any shared credentials, and enhance security measures such as enforcing least-privilege policies and maintaining comprehensive audit logging.

Red Hat has engaged security experts and notified law enforcement, emphasizing that the breach was confined to the consulting GitLab environment and did not impact their core products or services.

Key Numbers

Present key numerics and statistics in a minimalist table format.

Metric	Value
The dataset size is significant.	570 gigabytes
The number of repositories involved is substantial.	28000
The number of organizations participating is notable.	800

Entity Relationships

An interactive diagram showing relationships between entities mentioned in this entry. Drag nodes to rearrange them, and hover over lines to see relationship details.

People

Key entities, categorized for clarity: people, organizations, tools, events, regulatory bodies, and industries.

Nick Kucharski

Chief Technology Officer

Commented on the Red Hat GitLab breach, highlighting the challenges in limiting damage once a system is compromised.

Organizations

Key entities, categorized for clarity: people, organizations, tools, events, regulatory bodies, and industries.

Red Hat

Open-source Software Company

Involved in a security breach incident where a cybercrime group accessed and stole data from a GitLab instance.

Crimson Collective

Cybercrime Group

Responsible for a significant security breach of a Red Hat GitLab instance, affecting numerous organizations.

Tools

Key entities, categorized for clarity: people, organizations, tools, events, regulatory bodies, and industries.

GitLab

DevOps Lifecycle Tool

Involved in a security breach where data was stolen from over 28,000 repositories.

Events

Key entities, categorized for clarity: people, organizations, tools, events, regulatory bodies, and industries.

Red Hat GitLab security breach

A significant cybersecurity incident involving data theft from over 28,000 repositories.

Regulatory

Key entities, categorized for clarity: people, organizations, tools, events, regulatory bodies, and industries.

Law enforcement

Engaged by Red Hat to investigate the security breach and potentially pursue legal action against the perpetrators.

Timeline of Events

Chronologically list key events and milestones.

2025-10-01

Crimson Collective claimed data exfiltration

The cybercrime group "Crimson Collective" claimed to have exfiltrated 570 gigabytes of data from more than 28,000 repositories in a Red Hat GitLab instance.

2025-10-02

Red Hat confirmed unauthorized access

Red Hat confirmed unauthorized access to its consulting GitLab system, stating that the breach was limited to this environment. They also engaged security experts and notified law enforcement.

2025-10-02

Red Hat blog post on breach

Red Hat made a blog post confirming the breach and detailing the types of sensitive information stored in the compromised GitLab instance.

2025-10-03

Belgium cybersecurity advisory issued

Belgium's national cybersecurity authority issued an advisory warning of a potential supply chain impact and recommended revoking and rotating all tokens, keys, and credentials shared with Red Hat.

2025-10-04

Red Hat spokesperson statement

Red Hat spokesperson Stephanie Wonderlick stated that there was no reason to believe other Red Hat services or products were impacted and expressed confidence in the integrity of their software supply chain.

Detailed post

Red Hat has confirmed a significant data breach in its consulting GitLab instance, executed by the cybercrime group "Crimson Collective." The breach resulted in the theft of 570 gigabytes of data from over 28,000 repositories, impacting approximately 800 organizations across sectors such as finance, telecommunications, government, healthcare, and corporate entities.

The breach was disclosed when the Crimson Collective claimed responsibility, stating they had accessed and exfiltrated sensitive data. The stolen information includes Customer Engagement Reports with architecture diagrams, configuration details, authentication tokens, and network maps. Notable organizations affected include Bank of America, Verizon, the NSA, and Kaiser Permanente.

Red Hat clarified that the breach was limited to its consulting GitLab environment and did not compromise its core products or services. The company has engaged security experts and notified law enforcement. Security experts recommend organizations audit credentials, rotate shared credentials, and enhance security measures to prevent future incidents. National cybersecurity authorities have issued advisories due to potential supply chain impacts, and Red Hat has committed to providing updates as more information emerges.