RedHat Gitlab Breach

In early October 2025, Red Hat confirmed a significant security breach affecting a self-hosted GitLab instance used exclusively by its consulting division. The threat actor, known as the Crimson Collective (later aligning with the Scattered LAPSUS$ Hunters cartel), successfully exfiltrated 570GB of data.

While Red Hat’s core product code (RHEL, OpenShift) was not compromised, the breach exposed thousands of "Customer Engagement Reports" (CERs) containing sensitive architectural blueprints, network diagrams, and hardcoded credentials belonging to Red Hat's enterprise clients.