Red Hat Investigates Widespread Breach of Private GitLab Repositories

Red Hat has confirmed a security incident affecting its GitLab instance, after a threat actor claimed to have breached tens of thousands of private repositories. According to The Centre for Cybersecurity Belgium (CCB) an advisory, Crimson Collective claimed access to 28,000 Red Hat private repositories and asserted that CERs contained network information, configuration data, and authentication tokens and keys.

Red Hat said the incident relates to a GitLab instance used solely for Red Hat Consulting on consulting engagements, not GitHub, and that remediation steps have been initiated, with the security and integrity of its systems and data prioritised. The incident adds to concerns over supply chain threats, as the CCB warned Belgian organisations using Red Hat Consulting of “high risk” and potential supply-chain impact, urging token and credential rotation and checks with third-party IT providers.

The article notes that it is unclear how Crimson Collective gained access, and mentions past GitLab and GitLab CVE-related incidents, including CVE-2023-7028 and the follow-on CVEs, without alleging exploitation in the current event. 2 October 2025.