Red Hat Acknowledges GitLab Hack Resulting in Data Breach

In October 2025, Red Hat confirmed a cybersecurity incident involving its Consulting GitLab instance. While the company emphasized that its core products and supply chain remain secure, a hacker group called Crimson Collective claimed responsibility for stealing 570 GB of data from over 28,000 internal projects.

Timeline of the Red Hat GitLab breach (the 570 GB and 28,000 figures are attacker claims)

This article breaks down what happened, what data may have been exposed, and what the breach means for Red Hat customers and the wider cybersecurity community.

What Happened in the Red Hat GitLab Breach

Red Hat revealed that attackers gained unauthorized access to its Consulting GitLab environment. This system was used internally for collaboration with clients during technical engagements.

Crimson Collective, the group behind the incident, released statements boasting about the breach and claiming access to sensitive files. Red Hat responded by stating that it has no reason to believe Red Hat Enterprise Linux (RHEL), OpenShift, or its software supply chain are affected.

What Data Was Potentially Exposed

According to reports and hacker claims, the stolen data may include:

• Customer Engagement Reports (CERs): technical reports with client infrastructure details.
• System Configurations: deployment and maintenance setups.
• Access Keys and Tokens: potentially valid authentication details.
• Internal Project Files: code snippets, automation scripts, and consulting notes.

While Red Hat has not confirmed the full scope, these data types could create serious security risks if misused.

Who Is Behind the Attack?

The breach was claimed by Crimson Collective, a self-described extortion group that emerged in 2025. Rapid7 has reported the group breaking into AWS environments using leaked access keys. In this incident, it targeted a consulting environment rather than Red Hat’s product supply chain, exploiting the trust companies place in third-party services.

The group alleges it has hundreds of gigabytes of compressed files and threatened to publish or sell them if their demands are not met.

Impact on Customers and Organizations

The Centre for Cybersecurity Belgium (CCB) rated the breach high risk for Belgian organizations that used Red Hat Consulting or shared credentials, tokens or network data with Red Hat, and urged them to rotate those secrets. Organizations working with Red Hat Consulting may face:

• Exposure of sensitive infrastructure data.
• Higher risk of targeted phishing or lateral attacks.
• Reputational damage if customer or government-related systems are exploited.

Some reports suggest that banks, telecoms, and government agencies might be among the affected clients, though Red Hat has not officially confirmed these details.

Banks, government agencies, and telecoms among those possibly impacted

How Red Hat Responded

Red Hat’s response focused on containment and transparency:

• Conducted a forensic investigation of the GitLab instance.
• Notified potentially impacted clients.
• Released a public statement clarifying the scope.
• Said it has no reason to believe its software supply chain is affected.

This open communication helped reduce speculation and positioned Red Hat as proactive in handling the incident.

Lessons Learned from the Red Hat Hack

This breach emphasizes the growing risks associated with consulting environments:

1. Isolate consulting systems from critical production networks.
2. Rotate and monitor credentials shared during consulting projects.
3. Evaluate third-party risk beyond just core vendors.
4. Prioritize transparency when incidents occur.

For many organizations, this serves as a wake-up call that even trusted consulting channels can become high-value targets.

Final Thoughts

The Red Hat Consulting GitLab breach is a reminder that cybersecurity threats don’t always target the core product; sometimes the weakest link lies in consulting and collaboration platforms.

While Red Hat’s quick response and reassurance about its software supply chain provided confidence, the attackers’ claimed theft of data from 28,000 repositories and about 800 customer engagement reports highlights the need for stronger third-party risk management.

Organizations relying on consulting services should re-examine their security practices, ensure proper isolation of environments, and remain vigilant against possible targeted follow-up attacks.

Red Hat’s breach shows no company is immune. DeepStrike is one of the top penetration testing companies and works with enterprises worldwide to secure their systems with human-powered penetration testing. Let’s talk about protecting your business.

Frequently Asked Questions (FAQ)

Q1. What exactly happened in the Red Hat GitLab breach?
Attackers gained unauthorized access to Red Hat’s Consulting GitLab instance, which was used for client collaboration and technical engagements. A hacker group called Crimson Collective claimed responsibility.

Q2. Was Red Hat’s core software, such as RHEL and OpenShift, affected?
Red Hat said it has no reason to believe the incident affects its other services or products, including Red Hat Enterprise Linux (RHEL), OpenShift, and its software supply chain.

Q3. How much data was stolen and from how many projects?
Crimson Collective claimed to have stolen about 570 GB of data from over 28,000 internal projects.

Q4. What type of data may have been exposed?
The stolen data could include Customer Engagement Reports (CERs), system configurations, access keys and tokens, internal project files, automation scripts, and consulting notes.

Q5. Who is Crimson Collective?
Crimson Collective is a self-described extortion group that emerged in 2025. Besides the Red Hat claim, Rapid7 has reported the group targeting AWS cloud environments by abusing leaked access keys.

Q6. What risks do Red Hat customers face after this breach?
Affected organizations may face exposure of sensitive infrastructure data, increased phishing or lateral attack attempts, and reputational risks if compromised systems are linked to them.

Q7. Which industries might be most impacted?
Reports suggest possible exposure for banks, telecoms, and government agencies, though Red Hat has not officially confirmed which clients were affected.

Q8. How did Red Hat respond to the incident?
Red Hat conducted a forensic investigation, notified potentially impacted clients, issued a public statement, and said it had no reason to believe its software supply chain was affected.