Cybercrooks breach Red Hat's private GitLab repos - what we know about affected customers

""We recently detected unauthorized access to a GitLab instance used for internal Red Hat Consulting collaboration in select engagements. We promptly launched a thorough investigation, removed the unauthorized party's access, isolated the instance, and contacted the appropriate authorities. Our investigation, which is ongoing, found that an unauthorized third party had accessed and copied some data from this instance.""

"The hackers claim to have swiped almost 570GB of data from 28,000 internal development repositories. This data allegedly includes approximately 800 Customer Engagement Reports (CERs). Red Hat CERs are detailed documents from Red Hat's consulting services that contain sensitive information about client environments, such as architecture diagrams, network configurations, and authentication tokens. Armed with this data, the group claims it can break into the downstream customer infrastructure."

"The group made the claim late Thursday on Telegram, posting screenshots allegedly showing directory listings from internal Red Hat projects. Red Hat has confirmed the breach."

A cybercrime group calling itself Crimson Collective claims to have breached Red Hat's private GitLab repositories and exfiltrated confidential data. The group alleges nearly 570GB of data taken from 28,000 internal development repositories, including about 800 Customer Engagement Reports containing architecture diagrams, network configurations, and authentication tokens. Red Hat detected unauthorized access to a GitLab instance used for internal consulting collaboration, confirmed that some data was accessed and copied, and launched an investigation while isolating the instance and notifying authorities. The exposure raises concerns that attackers could use consulting data to target downstream customer environments.

Read at ZDNET