Red Hat Confirms GitLab Breach After Hackers Steal 570 GB of Data
Open-source software giant Red Hat has confirmed a security incident after a ransomware group known as Crimson Collective successfully breached its internal GitLab server. According to the company, the attack resulted in the theft of roughly 570 GB of data from over 28 000 repositories.
Attack and Data Exposure
The threat actors claim they gained access to authentication tokens and private keys, which allowed them to penetrate both internal and some client-facing infrastructure. Preliminary reports suggest that no production or customer services have been compromised, though investigators are still assessing the scope of the leak.Crimson Collective — a group previously linked to attacks on software vendors and DevOps platforms — claims responsibility for the incident and has allegedly offered samples of stolen data on darknet forums.
Company Response and Containment
Red Hat has launched an internal investigation and temporarily restricted external access to the affected GitLab instance. The company is collaborating with cybersecurity partners and law enforcement to contain the breach and prevent further data exfiltration.In an official statement, Red Hat said that the breach “originated from a self-hosted GitLab Community Edition instance used for non-production development.” The main GitLab platform and customer data remain unaffected.
GitLab and Community Impact
GitLab has confirmed that its core cloud service was not impacted by the incident, reiterating that the attack targeted only a privately managed server. Security analysts warn, however, that source-code leaks of this magnitude can pose long-term risks to software integrity and supply-chain security.Developers using Red Hat’s ecosystem have been advised to rotate API keys and access tokens as a precaution while monitoring repositories for unauthorized commits or dependencies.
Conclusion
The Red Hat breach highlights ongoing vulnerabilities in self-hosted DevOps infrastructure and the increasing sophistication of ransomware actors targeting open-source software supply chains. As Red Hat strengthens its defenses, the incident serves as a reminder of the need for continuous security audits and zero-trust policies in developer operations.Editorial Team — CoinBotLab