{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T03:54:42.456Z",
  "tag": {
    "id": "crimson-collective",
    "label": "Crimson Collective",
    "isStack": false,
    "url": "https://pwn.watch/t/crimson-collective",
    "feed": "https://pwn.watch/t/crimson-collective/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "red-hat-consulting-gitlab-breach-october-2025",
      "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025",
      "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Red Hat Consulting self-managed GitLab",
      "tags": [
        "devtools",
        "red-hat",
        "gitlab",
        "crimson-collective",
        "shinyhunters",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-10-01",
      "closedAt": "2025-10-10",
      "updatedAt": "2025-10-10",
      "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-10",
      "title": "FINRA alert to member firms",
      "body": null,
      "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-02",
      "title": "Red Hat confirms the incident",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-01",
      "title": "Crimson Collective claims the Red Hat GitLab theft",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    }
  ]
}