Red Hat data breach (2025): the consulting GitLab instance and the customer engagement reports
Red Hat’s 2025 incident is the consulting-firm risk in its purest form: not product code, but the working notes, architecture and engagement reports a services team keeps about its clients. This page records what Red Hat confirmed, what the Crimson Collective group claimed, and what consulting clients should check.
Short answer
Was Red Hat hacked?
Yes. On 2 October 2025 Red Hat confirmed that an unauthorised third party had “accessed and copied some data” from a GitLab instance used for internal Red Hat Consulting collaboration in some engagements. Red Hat said the data may include project specifications, example code snippets, internal communications about consulting services and limited business contact information.
Red Hat said it had no reason to believe other Red Hat services or products, including its software supply chain and downloads from official channels, were affected. The Crimson Collective group claimed about 570GB of compressed data from roughly 28,000 repositories, including around 800 Customer Engagement Reports covering 2020–2025. Red Hat has not verified those numbers.
Timeline at a glance
Late Sep 2025Intrusion, per the attackers (“about two weeks” before their claim). (BleepingComputer)Unverified claim
1–2 Oct 2025Crimson Collective claims ~570GB, ~28,000 repos and ~800 customer engagement reports. (BleepingComputer)Unverified claim
2 Oct 2025Red Hat confirms data copied from a Red Hat Consulting GitLab instance; products and supply chain unaffected. (Red Hat)Confirmed
3 Oct 2025Belgium’s national cyber authority warns of potential supply-chain impact. (The Register)Reported
Oct 2025FINRA issues a cybersecurity alert to member firms about the Red Hat incident. (FINRA)Confirmed
Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Red Hat incident timeline, in detail
Confirmed = acknowledged by Red Hat, a regulator filing or a court. Reported = credible reporting Red Hat has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Sep – Oct 2025ConfirmedConsulting data / self-hosted dev tooling
Data copied from a Red Hat Consulting GitLab instance
What happened. Red Hat detected unauthorised access to a GitLab instance used for internal Red Hat Consulting collaboration in select engagements, removed the intruder’s access, isolated the instance, contacted authorities and added hardening. Its investigation found the third party had accessed and copied some data. The instance was a self-managed GitLab server; GitLab’s own service was not compromised.
Impact. Per Red Hat: consulting engagement data that may include project specifications, example code snippets, internal communications about consulting services and limited business contact information. Red Hat said consulting customers would be contacted directly if affected and that there was no evidence other customers were affected.
Crimson Collective claims 570GB and ~800 Customer Engagement Reports
What happened. The group said it took nearly 570GB of compressed data from about 28,000 internal repositories, including around 800 Customer Engagement Reports (CERs) dated 2020–2025, and published a listing naming banks, telecoms, healthcare providers, retailers and US government bodies among the subjects. CERs can contain network designs, configuration detail and, the group claimed, credentials.
Impact. If accurate, a map of many clients’ infrastructure. Red Hat has not verified the volume, the repository count or the client list.
Scope of data: Red Hat describes project specifications, code snippets, internal communications and limited business contact information. The attackers describe repositories and customer engagement reports with infrastructure detail. Red Hat has not confirmed or denied the CER claim in detail.
Number of clients: most reporting cites about 800 engagement reports; a few outlets cite much larger client counts that trace back to no primary source.
The pattern across the record
Consulting artefacts are a target in their own right
Engagement reports and architecture notes describe clients’ networks in detail. A consulting team’s collaboration server can be more useful to an attacker than the vendor’s product code.
Self-hosted developer tools sit outside the usual controls
A team-run GitLab instance often has weaker identity, logging and secret-scanning than corporate systems, and accumulates tokens and credentials in repositories over years.
What it means for Red Hat consulting clients — and what to do
If Red Hat Consulting ever worked on your environment, assume documents about it may have been on that server until Red Hat tells you otherwise.
1.Ask Red Hat directly whether your engagement was in scope
Red Hat said it would notify affected consulting customers. Ask for the list of files tied to your organisation.
2.Rotate anything that may be in an engagement document
Tokens, service-account passwords, VPN details and API keys shared during an engagement should be rotated, and the old ones revoked only after the new ones are confirmed working.
Yes. Red Hat confirmed on 2 October 2025 that an unauthorised party accessed and copied data from a GitLab instance used by Red Hat Consulting. It said its products, other services and software supply chain were not affected.
What data was taken in the Red Hat breach?+
Red Hat says the instance held consulting engagement data such as project specifications, example code snippets, internal communications and limited business contact information. The Crimson Collective group claims about 570GB including around 800 customer engagement reports; Red Hat has not verified that claim.
Is Red Hat Enterprise Linux or OpenShift affected?+
Red Hat said it had no reason to believe the incident affects its other services or products, including downloads from official channels. A separate OpenShift AI vulnerability disclosed the same week (CVE-2025-10725) is unrelated.
Who is Crimson Collective?+
An extortion group that claimed the Red Hat theft in October 2025 and published a list of organisations it said appeared in the stolen engagement reports. Its claims have not been independently verified.
What should Red Hat consulting customers do?+
Ask Red Hat whether your engagement was in scope, rotate any credentials or tokens that could appear in engagement documents, and review network details shared during the engagement as potentially exposed.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Red Hat. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout