Red Hat Consulting GitLab Breach

In mid-September 2025, the Crimson Collective gained unauthorized access to a self-hosted GitLab instance used by Red Hat Consulting. They exfiltrated ~570GB of compressed data from over 28,000 private repositories. The stolen data included sensitive Customer Engagement Reports containing architecture diagrams, network maps, credentials, and client configurations for hundreds of major organizations.

Red Hat Consulting provides enterprise services to many large organizations. This incident highlights risks in consulting repositories that often contain highly sensitive client environment details.

Attackers accessed a dedicated GitLab environment used for client collaboration. No evidence of impact to Red Hat’s core products (RHEL, OpenShift) or public code repositories.

Crimson Collective – extortion-focused group specializing in targeting development and consulting repositories.

Aliases

• Scattered LAPSUS$ Hunters

Attribution sources

• Red Hat official statement
• BleepingComputer
• Dark Reading

Additional victims

• Over 800 client organizations (banks, telecoms, government agencies)

Countries affected

• Global

Data types

• Internal Repositories
• Customer Engagement Reports
• Architecture Diagrams
• Credentials
• Client Configurations

Significant reputational damage and potential downstream risk to Red Hat clients.

Public reaction

Concern over potential exposure of critical infrastructure details.

Political impact

Raised questions about cybersecurity practices of major vendors serving government and critical infrastructure.

Ongoing investigations.

Security improvements

• Isolation and hardening of consulting environments

Significance

One of the largest consulting/supply-chain breaches of 2025, impacting hundreds of major organizations indirectly.

Legacy

Increased scrutiny on how vendors handle client data in professional services repositories.

Publishing organisations

• BleepingComputer
• Dark Reading
• Red Hat

Red Hat isolated the instance and continues investigation; data has been leaked.

Official documents

• Red Hat Security Update

References

1. [1]Red Hat official blog
2. [2]BleepingComputer reports