Full Report
An extortion group calling itself the Crimson Collective claims to have breached Red Hat's private GitHub repositories, stealing nearly 570GB of compressed data across 28,000 internal projects. [...]
Analysis Summary
# Incident Report: Red Hat Consulting Data Breach Claimed by Crimson Collective
## Executive Summary
The Crimson Collective hacking group claimed to have breached Red Hat's private GitHub repositories, stealing approximately 570GB of data from 28,000 internal projects, including sensitive Customer Engagement Reports (CERs). Red Hat confirmed a security incident related to its consulting business but did not verify the scope of the public claims. The attackers allege they found authentication tokens within the stolen data, potentially leading to compromise of downstream customer systems.
## Incident Details
- Discovery Date: Around October 2, 2025 (based on reporting date and attacker claim of intrusion occurring "approximately two weeks ago")
- Incident Date: Approximately two weeks prior to October 2, 2025
- Affected Organization: Red Hat (specifically its consulting business segment)
- Sector: Technology/Software Services
- Geography: Not explicitly disclosed, but likely global due to Red Hat's nature.
## Timeline of Events
### Initial Access
- Date/Time: Approximately two weeks before October 2, 2025
- Vector: Unknown exact initial vector, but access was gained to private GitHub repositories. Attackers found authentication tokens, full database URIs, and other private information.
- Details: The tokens and credentials found were allegedly used to gain access to downstream customer infrastructure.
### Lateral Movement
- Details: Attackers allegedly used stolen tokens and data to compromise "downstream customer infrastructure." Internal network movement within Red Hat's repositories is implied to facilitate data collection.
### Data Exfiltration/Impact
- Details: Exfiltration of approximately 570GB of compressed data across 28,000 internal projects, including sensitive Customer Engagement Reports (CERs) spanning 2020-2025.
### Detection & Response
- Details: Red Hat became aware of the reports and confirmed it initiated "necessary remediation steps." The attackers claim their extortion attempt was met with a templated reply directing them to submit a vulnerability report, which was then ticketed internally through legal and security staff.
## Attack Methodology
- Initial Access: Exploitation of credentials/secrets (authentication tokens) found within private code repositories.
- Persistence: Not detailed, but access to subsequent customer environments was claimed.
- Privilege Escalation: Not detailed.
- Defense Evasion: Not detailed.
- Credential Access: Direct discovery of authentication tokens and private information within code/documents.
- Discovery: Implied reconnaissance within the GitHub environment to locate valuable data (CERs).
- Lateral Movement: Allegedly moved from Red Hat infrastructure to downstream customer infrastructure using stolen credentials.
- Collection: Gathering of 28,000 internal projects and approximately 800 CERs containing infrastructure details, configuration data, and tokens.
- Exfiltration: Theft of 570GB of compressed data.
- Impact: Potential compromise of clients whose infrastructure details were contained within the CERs.
## Impact Assessment
- Financial: Not disclosed.
- Data Breach: Approximately 570GB of compressed data, including 800 Customer Engagement Reports (CERs) containing detailed customer network information, configuration data, and authentication tokens belonging to major organizations (e.g., Bank of America, T-Mobile, Mayo Clinic).
- Operational: Red Hat stated they have no reason to believe the issue impacts software supply chain or other services, suggesting internal impacts were localized or swiftly contained.
- Reputational: Significant, due to the implication that sensitive internal consulting data could compromise numerous high-profile clients.
## Indicators of Compromise
- Network indicators: None provided (URLs/IPs defanged).
- File indicators: Directory listing and list of CERs published publicly (details not retained here).
- Behavioral indicators: Attempted communication via extortion followed by public disclosure on Telegram.
## Response Actions
- Containment: Red Hat "initiated necessary remediation steps."
- Eradication: Not detailed, but implies rotation/revocation of compromised tokens/credentials found in the repositories.
- Recovery: Not detailed, but the integrity of Red Hat software supply chain was affirmed.
## Lessons Learned
- Sensitive configuration data, authentication tokens, and detailed customer infrastructure information (CERs) should never be stored in environments where repository secrets are accessible, even if the repository is considered 'private.'
- Incident response protocols must handle immediate extortion attempts effectively, as lack of actionable response may lead to public disclosure.
## Recommendations
- Implement stringent secret scanning across all code repositories (private and public) to automatically detect and revoke exposed tokens and credentials.
- Review and restrict access controls to highly sensitive documentation repositories like those containing Customer Engagement Reports.
- Develop a clear, documented escalation and response playbook for initial extortion attempts to ensure a timely, tailored response rather than relying on templated vulnerability submissions.