Cybercrime group claims to have breached Red Hat ‘s private GitHub repositories

The Crimson Collective, a cybercrime group, claims it stole 570GB from Red Hat’s private GitHub repositories, including 28,000 projects and around 800 Customer Engagement Reports containing sensitive network data. Red Hat confirmed the data breach but did not verify the Crimson Collective’s claims. On 24 September 2025, the threat actors shared on a Telegram channel a full file tree, a CER list and screenshots as proof of the breach.

The file tree references major banks, telecoms, airlines and public-sector organisations, including Citi, Verizon, Siemens, Bosch, JPMC, HSBC, Merrick Bank, Telstra and Telefonica, with mentions of the U.S. Senate. According to Red Hat, protecting systems and data is a top priority and the incident does not affect its other services or products, with the supply chain described as secure.