One million customers on alert as extortion group claims massive Brightspeed data haul

Brightspeed, a major US fibre broadband provider, is investigating claims by the Crimson Collective extortion group that it stole data belonging to more than 1 million residential customers, including extensive personally identifiable information and billing details. The group posted on its Telegram channel on 4 January 2026, listing in detail the types of data purportedly exfiltrated, from master records and payment history to payment methods and appointment records.

The group also claimed it would drop a sample of the data, which it did, providing entries from several database tables; the messaging also claimed a large number of customers had been disconnected, though this was uncorroborated by public reporting. Brightspeed told BleepingComputer that it is “currently investigating reports of a cybersecurity event” and that it will keep customers, employees and authorities informed as it learns more.

According to the article, some customer complaints circulated online, but it remains unclear whether these were caused by the Crimson Collective’s actions.