Red Hat Confirms GitLab Instance Hack, Data Theft

Red Hat on Thursday confirmed that one of its GitLab instances was hacked after a threat actor claimed to have stolen sensitive data belonging to the company and its customers, according to SecurityWeek. The hackers, calling themselves Crimson Collective, claimed to have stolen 570 Gb of compressed data from 28,000 private repositories, including source code, credentials, secrets and configurations, as well as customer engagement reports.

They also claimed to have used the compromised information to access Red Hat customers’ infrastructure, though Red Hat said the incident involved an internal Red Hat Consulting collaboration in select engagements and has not confirmed wider access to customer environments. SOCRadar reported that as many as 800 Red Hat customers’ data was obtained, including IBM, Siemens, Verizon, Bosch and some US government organisations such as the Energy Department, NIST and the NSA.

Red Hat said it promptly launched an investigation, removed the unauthorized access, isolated the instance and notified the authorities, while emphasising that the compromised GitLab instance did not typically store sensitive personal information and that there is no evidence of such data being exposed. The company also noted that the data breach is not related to a recently disclosed OpenShift AI service vulnerability.