Red Hat Breach Impacts 5,000+ High-Value Enterprise Customers, Data at Risk

Red Hat Consulting’s breach impacted more than 5,000 high-value enterprise customers and put data at risk, with Red Hat confirming the incident and beginning to notify affected clients by 13 September 2025. Early evidence suggests the attackers exfiltrated customer documentation, source code and other sensitive assets, and security researcher Brian Krebs noted that “Miku,” a Telegram handle linked to Thalha Jubair, is tied to Crimson Collective.

Analysis of the leak shows a sprawling file tree, including a 2.2 GB ZIP containing over 32 million files, and an initial leak listing 370,852 directories and 3,438,976 files, with CERs published for seven organisations: AIR, AMEX_GBT, Atos_Group (NHS Scotland), BOC, HSBC and Walmart. The breach’s impact appears to span consultancy reports, proprietary code and internal assets from Red Hat Consulting’s enterprise clients.

Enterprises should urgently rotate certificates and credentials, review security configurations and implement comprehensive remediation plans, while paying attention to the warning not to rely on ransom payments and to monitor for traded copies of stolen data.