In September 2025, an extortion group calling itself the Crimson Collective broke into a GitLab instance used by Red Hat's consulting business and copied its contents. Red Hat confirmed the incident on 2 October 2025. The attackers claimed about 570 GB of compressed data from roughly 28,000 repositories, including around 800 Customer Engagement Reports, and said the material contained authentication tokens and full database connection strings for customer environments. The breach did not touch Red Hat's products or software supply chain, according to Red Hat. Its real risk sat downstream: credentials for client systems, written into consulting documents and code, stored in one collaboration platform.
Key takeaways
- Red Hat confirmed that "an unauthorized third party had accessed and copied some data" from a GitLab instance used for Red Hat Consulting collaboration. It says its products and software supply chain were not affected.
- The Crimson Collective claimed 570 GB from about 28,000 repositories and about 800 Customer Engagement Reports, and said it found authentication tokens and full database URIs.
- Belgium's Centre for Cybersecurity rated the incident high risk and told organisations to revoke and rotate all tokens, keys and credentials shared with Red Hat.
- The group then joined forces with Scattered Lapsus$ Hunters and published samples on a ShinyHunters leak site. Rapid7 separately observed the Crimson Collective breaking into AWS accounts with leaked long-term access keys.
- Lesson: credentials shared with consultants and suppliers are your non-human identities. They need an inventory, an expiry date and a revocation plan when the supplier is breached.
At a glance
| Organisation | Red Hat (Red Hat Consulting) and its consulting customers |
|---|---|
| When | Intrusion mid-September 2025 (13 September according to the extortionists); claimed 1 October; confirmed by Red Hat 2 October 2025 |
| Attacker | Crimson Collective, later working with Scattered Lapsus$ Hunters (ShinyHunters) |
| Entry point | A self-managed GitLab instance used for internal Red Hat Consulting collaboration; the initial access method has not been disclosed |
| Identities abused | Authentication tokens, keys and database connection strings for customer environments, stored in consulting repositories and Customer Engagement Reports |
| Impact | About 570 GB of compressed data from about 28,000 repositories claimed stolen; customer reports leaked as samples; regulators and national CERTs warned affected customers |
| Category | NHI (secrets and tokens exposed through a supplier) |
What happened
On 1 October 2025, the Crimson Collective announced on Telegram that it had stolen private repositories from Red Hat. BleepingComputer reported the group's claims: nearly 570 GB of compressed data from 28,000 internal development repositories, and around 800 Customer Engagement Reports (CERs). CERs are consulting documents that can describe a client's infrastructure and configuration. The group said it had found authentication tokens, full database URIs and other private information in the data, and that it had broken in about two weeks earlier. It also said it had tried to contact Red Hat with an extortion demand and received only a templated response telling it to file a vulnerability report.
The group posted a list of organisations that it said appeared in the reports. BleepingComputer listed names including Bank of America, T-Mobile, AT&T, Fidelity, Kaiser, Mayo Clinic, Walmart, Costco, the US Navy's Naval Surface Warfare Center, the Federal Aviation Administration and the House of Representatives. These are the attackers' claims, not confirmed victims.
Red Hat published a statement on 2 October. It said it had "detected unauthorized access to a GitLab instance used for internal Red Hat Consulting collaboration in select engagements" and that "an unauthorized third party had accessed and copied some data from this instance." It said it had removed the attacker's access, isolated the instance and contacted the authorities. According to Red Hat, the instance held consulting engagement data that may include "project specifications, example code snippets, internal communications about consulting services, and limited forms of business contact information." It said it had "no reason to believe this security issue impacts any of our other Red Hat services or products, including our software supply chain", that it would notify affected consulting customers directly, and that the incident was unrelated to a separate Red Hat OpenShift AI vulnerability, CVE-2025-10725, announced the day before.
Red Hat's description did not mention credentials. Others focused on them. The Centre for Cybersecurity Belgium (CCB) rated the breach high risk, said the exposed reports contained "authentication tokens and keys" and noted: "Attackers claim they already used stolen tokens to access customer systems." It told organisations that used Red Hat Consulting to revoke and rotate all tokens, keys and credentials shared with Red Hat. The US regulator FINRA issued a cybersecurity alert saying "a material number of member firms' vendors" were affected and that exposed data "could be abused to breach member firm customer networks."
The extortion then escalated. On 4 October, the Crimson Collective announced a partnership with Scattered Lapsus$ Hunters. ShinyHunters listed Red Hat on a new data leak site with a 10 October deadline and published sample CERs that BleepingComputer said related to organisations including Walmart, HSBC, the Bank of Canada, Atos Group, American Express and Société Française du Radiotéléphone. The Register reported that the criminals promised to "refrain from attacking Red Hat's customers directly" if paid.
A week after the Red Hat claims, Rapid7 published research on the Crimson Collective's wider activity. It observed the group gaining initial access to AWS environments with leaked long-term access keys found using the open-source scanner TruffleHog, then creating IAM users, attaching the AdministratorAccess policy, snapshotting databases and exfiltrating data before sending extortion demands. That pattern is exactly what exposed tokens and connection strings in consulting material would enable.
Timeline
| Date | Event |
|---|---|
| 13 September 2025 | Date of the breach according to the extortionists, as reported by The Register. |
| Mid to late September 2025 | The group says it contacted Red Hat with an extortion demand and received a templated reply. |
| 1 October 2025 | Crimson Collective publicly claims the theft of Red Hat's private repositories. |
| 2 October 2025 | Red Hat confirms unauthorised access to a Red Hat Consulting GitLab instance. |
| 4 October 2025 | Crimson Collective announces a partnership with Scattered Lapsus$ Hunters. |
| 6 October 2025 | Red Hat appears on a ShinyHunters leak site with sample Customer Engagement Reports and a 10 October deadline. |
| 7 October 2025 | Rapid7 publishes research on the Crimson Collective's use of leaked AWS keys. |
| October 2025 | The CCB and FINRA issue warnings to organisations that used Red Hat Consulting. |
How it happened: the identity attack path
- Credentials handed to a supplier. Consulting work needs access to client systems. Over time, tokens, keys and database connection strings for those systems ended up in repositories and engagement reports, according to the attackers and the CCB.
- A single collaboration platform holding them. Those files sat in one self-managed GitLab instance used across many engagements, so one compromise exposed many clients at once.
- Access to the GitLab instance. The attackers got into the instance and copied its contents. How they got in has not been made public.
- Harvesting secrets from the data. The group said it searched the stolen code and reports and found authentication tokens and full database URIs. Rapid7 has documented the same group using TruffleHog to find live credentials.
- Using the secrets against customers. The CCB reported that the attackers claim to have already used stolen tokens to access customer systems. Rapid7's AWS findings show what the group does with a working key: create its own identities, take administrator rights and take data.
- Extortion at two levels. The group pressured Red Hat and threatened its customers, then brought in Scattered Lapsus$ Hunters to publish samples.
Impact
- Data claimed: about 570 GB of compressed data from about 28,000 repositories and about 800 Customer Engagement Reports, according to the Crimson Collective.
- Data confirmed by Red Hat: project specifications, example code snippets, internal communications about consulting services and limited business contact information.
- Customers: consulting clients across finance, telecoms, retail, healthcare and government were named by the attackers; FINRA said a material number of its member firms' vendors were affected.
- Credentials: tokens, keys and connection strings for client environments were exposed, according to the attackers and the CCB, forcing affected customers to rotate them.
- Red Hat products: no impact on products, hosted services or the software supply chain, according to Red Hat.
What this means for NHI governance
This was not a breach of Red Hat's software. It was a breach of the secrets that Red Hat's customers had shared with, or created for, a trusted supplier. Each token, key and connection string written into a report or a repository was a non-human identity belonging to a customer, living outside that customer's control, with no expiry date that anyone was tracking.
Most organisations cannot answer a simple question: which of our credentials are held by our suppliers? The answer is usually spread across consulting deliverables, shared runbooks, tickets, chat messages and code. When the CCB told customers to rotate everything shared with Red Hat, many would have had to reconstruct that list from scratch.
The incident also shows why secrets in code and documents are so valuable to extortion groups. A consulting archive is a directory of other organisations' access. Groups like the Crimson Collective use the same scanners defenders use to find live keys, then turn them into new cloud identities of their own. The same pattern appears on our timeline in the Salesloft Drift OAuth token theft, where one supplier's tokens opened many customers' data.
Recommendations
- Inventory credentials held by third parties. For every consultant, integrator and SaaS supplier, record which tokens, keys and accounts they hold, who owns them and when they expire. Our NHI Lifecycle Management Guide covers ownership and offboarding.
- Never share long-lived secrets in documents or code. Give suppliers time-bound, scoped access through a vault or access broker, and revoke it when the engagement ends. See The Secret Sprawl Challenge.
- Rotate on supplier breach. Have a playbook to revoke and rotate everything a supplier could hold within hours of a breach notice. Our guide to the challenges of rotating NHIs explains why this is hard without automation.
- Scan collaboration platforms for secrets. Run secret scanning across GitLab, GitHub, wikis and ticketing systems, including self-managed instances, and treat findings as incidents.
- Prefer short-lived and workload-bound credentials. Replace static cloud keys and database passwords with federated, short-lived credentials where possible, as described in our Cloud Workload Identity Guide.
- Monitor for new identities and privilege changes. Alert on new IAM users, new admin policy attachments and database snapshots, the moves Rapid7 saw this group make.
Frequently asked questions
What was the Red Hat GitLab breach?
In September 2025, the Crimson Collective broke into a GitLab instance used by Red Hat Consulting and copied its data. Red Hat confirmed it on 2 October 2025. The group claimed about 570 GB from about 28,000 repositories, including customer engagement reports.
Were Red Hat products or RHEL affected?
Red Hat says no. It said it had no reason to believe the incident affected its other services or products, including its software supply chain.
What should Red Hat Consulting customers do?
The Centre for Cybersecurity Belgium advised revoking and rotating all tokens, keys and credentials shared with Red Hat, checking with Red Hat about specific exposure and increasing monitoring of authentication events, API calls and system access.
Related NHI Mgmt Group resources
17,000 secrets exposed in public GitLab repositories · Misconfigured Git servers leaking secrets · Salesloft Drift OAuth token theft · The story behind the Deloitte 2025 breach · NHI breaches timeline
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target service accounts, API keys, tokens, connection strings and secrets held by suppliers. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.
References
- Red Hat: Security update: Incident related to Red Hat Consulting GitLab instance (2 October 2025)
- Red Hat Customer Portal: Security update: Incident related to Red Hat Consulting GitLab instance (October 2025)
- Centre for Cybersecurity Belgium: Hackers (The Crimson Collective) use leaked authentication tokens to access customer systems (October 2025)
- FINRA: Cybersecurity Alert, Red Hat Security Incident (October 2025)
- BleepingComputer: Red Hat confirms security incident after hackers breach GitLab instance (2 October 2025)
- BleepingComputer: Red Hat data breach escalates as ShinyHunters joins extortion (6 October 2025)
- The Register: Red Hat breach escalates as Crimson Collective recruits help (7 October 2025)
- Rapid7: Crimson Collective: A New Threat Group Observed Operating in the Cloud (7 October 2025)
