Red Hat Confirms Breach of GitLab Instance, Customer Network Blueprints Stolen

Red Hat, IBM’s enterprise Linux subsidiary, has confirmed that its managed repository hosted on the GitLab platform was compromised in a cyberattack, with attackers exfiltrating 570 GB of compressed data from 28,000 internal repositories, including around 800 Customer Engagement Reports (CERs).

These CERs are consulting documents prepared for corporate clients and often contain sensitive information such as infrastructure details, configuration data, and authentication tokens that could be used to compromise client networks. Red Hat has acknowledged the breach but declined to confirm or deny the attackers’ identity or the veracity of their CER data claims, stating that the incident is being investigated and remediation measures have been taken.

According to the attackers, their original plan was to extort Red Hat in exchange for not leaking the stolen data, but Red Hat’s response reportedly diverged from their expectations, and after a ransom email the hackers received a generic automated reply guiding them to the vulnerability disclosure process. The company emphasised that the incident was limited to its consulting division and that no other Red Hat products, supply chains, or software security components were affected.