Red Hat GitLab Breach Exposes Critical Supply Chain Risks

Recent reports confirm a significant security incident at Red Hat, involving a breach of one of its GitLab instances. This incident, attributed to the extortion group Crimson Collective, underscores the increasing risks associated with software supply chains and the potential for sensitive data exposure. This post examines the details of the breach, its possible impact, and actionable steps for organizations to mitigate similar threats. This event highlights the importance of cyber threat intelligence platforms, real-time ransomware intelligence, and proactive measures like dark web monitoring services to protect sensitive data.

Details of the Red Hat GitLab Breach

On October 2, 2025, Red Hat confirmed a security incident involving unauthorized access to a GitLab instance used for its consulting business. The Crimson Collective, an extortion group, claimed to have exfiltrated approximately 570GB of compressed data from 28,000 internal development repositories. While Red Hat has not verified the full extent of the attackers’ claims, they have acknowledged that some data was accessed and copied.

The compromised GitLab instance was specifically used by Red Hat Consulting for collaboration on consulting engagements. This instance contained Consulting Engagement Reports (CERs), which may include project specifications, code snippets, and internal communications. These CERs, according to the attackers, contained authentication tokens, full database URIs, and other private information. The hackers claimed they used the information found in the CERs to gain access to customer infrastructure, potentially creating downstream risks for Red Hat clients.

The Crimson Collective published a directory listing of the allegedly stolen GitLab repositories and a list of CERs spanning from 2020 to 2025 on Telegram. The list included prominent organizations across various sectors, such as Bank of America, T-Mobile, AT&T, Fidelity, Kaiser, Mayo Clinic, Walmart, Costco, the U.S. Navy’s Naval Surface Warfare Center, Federal Aviation Administration, and the House of Representatives.

Red Hat has stated that the breach does not affect other Red Hat services or products, including software downloaded from official channels, and they are confident in the integrity of their software supply chain.

Potential Impact and Risks

The potential impact of the Red Hat GitLab breach is multifaceted:

• Data Exposure: CERs may contain sensitive information about customer networks and platforms. This includes infrastructure details, configuration data, and authentication tokens. Exposure of this data could lead to unauthorized access to customer systems.
• Supply Chain Risks: The incident underscores the risks inherent in software supply chains. Compromising a vendor’s internal systems can create pathways to downstream targets, as seen in this case where attackers claimed to have accessed customer infrastructure.
• Extortion and Reputational Damage: The Crimson Collective is attempting to extort Red Hat, which can lead to reputational damage regardless of whether Red Hat pays the ransom. The involvement of well-known organizations in the data leak can erode trust in Red Hat’s consulting services.
• Legal and Compliance Issues: Exposure of customer data may trigger legal and compliance obligations, requiring Red Hat and its impacted clients to notify affected parties and address potential regulatory concerns.
• Compromised Credentials: The attackers claim to have found authentication tokens and database URIs. If these credentials are valid and reused across multiple systems, the breach could have far-reaching consequences.

Broader Context: Oracle E-Business Suite Extortion and Cisco Firewall Vulnerabilities

The Red Hat GitLab breach is not an isolated incident. Recent reports indicate an increase in cyberattacks targeting various enterprise platforms and software. Two notable examples are the extortion attempts involving Oracle E-Business Suite and the exploitation of vulnerabilities in Cisco firewalls.

Oracle E-Business Suite Extortion Attempts

Cybercriminals, potentially linked to the Clop ransomware group, have been attempting to extort corporate executives by threatening to leak data allegedly stolen through the Oracle E-Business Suite. This widely used business platform manages finance, human resources, and supply chain functions.

Researchers at Mandiant and Google Threat Intelligence Group (GTIG) have reported that the attackers are sending extortion emails to executives at numerous organizations, claiming to have stolen data through the Oracle E-Business Suite. The contact addresses provided in the extortion notes match those publicly listed on Clop’s data leak site. Clop has a history of exploiting vulnerabilities in file transfer tools, such as MOVEit and GoAnywhere, to steal data and demand ransoms.

Cisco Firewall Vulnerabilities

A critical zero-day vulnerability in Cisco Secure Firewall ASA and FTD software, tracked as CVE-2025-20333, is being actively exploited. This vulnerability poses a severe risk to global enterprises, with over 48,800 unpatched systems exposed on the internet as of September 29, 2025. The flaw specifically impacts the VPN web server component, allowing attackers to execute arbitrary code with root privileges, potentially leading to policy manipulation, traffic interception, and backdoor installation.

Cisco has also disclosed a secondary vulnerability, CVE-2025-20362, which allows unauthenticated attackers to access VPN endpoints without proper authentication. Cisco has issued security updates for both vulnerabilities and urges immediate patching, along with a review of VPN authentication and monitoring controls.

US Air Force SharePoint Data Breach

In a separate incident, the United States Air Force (USAF) had to shut down several IT systems following a data breach impacting service personnel. The breach involved personal and healthcare data stored on USAF SharePoint servers. As a result, all USAF SharePoints were blocked Air Force-wide to protect sensitive information. Microsoft Teams and Power BI were also affected due to their reliance on SharePoint files.

WordPress Plugin Vulnerability

A critical vulnerability, CVE-2025-6388, with a CVSS score of 9.8, has been identified in the Spirit Framework WordPress plugin. This flaw allows unauthenticated attackers to bypass authentication, hijack admin accounts, and escalate privileges. The vulnerability affects all versions up to and including 1.2.14. An attacker who knows the username of a valid account can log in without needing the corresponding password. The developers have released Spirit Framework version 1.2.15, which includes a patch to address this vulnerability.

Actionable Steps for Mitigation

Organizations can take several actionable steps to mitigate the risks highlighted by these incidents:

1. Implement Real-Time Ransomware Intelligence: Utilize services that provide up-to-date information on ransomware threats, including indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) used by threat actors.
2. Enhance Vulnerability Management: Prioritize patching critical vulnerabilities, especially those being actively exploited. Implement a vulnerability management program that includes regular scanning, risk assessment, and timely remediation.
3. Strengthen Supply Chain Security: Implement supply chain risk monitoring to assess the security practices of vendors and third-party partners. Include contractual obligations for security and conduct regular audits to ensure compliance.
4. Implement Dark Web Monitoring: Employ dark web monitoring service to detect compromised credentials, leaked data, and discussions about potential attacks targeting your organization.
5. Review and Harden Authentication Mechanisms: Enforce multi-factor authentication (MFA) for all users, especially those with administrative privileges. Regularly review and update password policies to ensure they meet current best practices.
6. Enhance Network Segmentation: Implement network segmentation to limit the lateral movement of attackers within the network. This can help contain the impact of a breach and prevent attackers from accessing sensitive systems.
7. Improve Incident Response Capabilities: Develop and regularly test incident response plans to ensure the organization can effectively respond to and recover from security incidents. Include procedures for data breach notification and communication with stakeholders.
8. Cyber Threat Intelligence Platform: Cyber threat intelligence platforms can help organizations gather, analyze, and disseminate information about potential threats, enabling proactive security measures.
9. Breach Detection: Implement breach detection systems to identify and respond to unauthorized access to sensitive data.
10. Telegram Threat Monitoring: Monitor Telegram channels and other platforms for discussions related to potential threats targeting the organization.
11. Underground Forum Intelligence: Employ PurpleOps Solutions to gain insights into the activities and intentions of cybercriminals.
12. Brand Leak Alerting: Use brand leak alerting services to identify and respond to unauthorized use of the organization’s brand assets.

PurpleOps and Proactive Cybersecurity

At PurpleOps, we understand the challenges organizations face in maintaining a robust cybersecurity posture. Our suite of services is designed to provide comprehensive protection against a wide range of cyber threats, including those targeting supply chains and sensitive data.

Our cyber threat intelligence services offer real-time insights into emerging threats, enabling you to proactively defend against potential attacks. We offer dark web monitoring services to detect compromised credentials and leaked data, providing early warnings of potential breaches. Our supply-chain risk monitoring solutions help you assess and manage the security risks associated with your vendors and third-party partners. We provide PurpleOps Solutions to gain insights into the activities and intentions of cybercriminals, and brand leak alerting services to identify and respond to unauthorized use of the organization’s brand assets. Our real-time ransomware intelligence ensures that you are always one step ahead of ransomware threats.

Additionally, PurpleOps provides live ransomware API for automated threat detection and response, breach detection services to identify and respond to unauthorized access, and telegram threat monitoring to stay informed about potential threats on social media platforms.

For organizations seeking to enhance their security posture, PurpleOps offers a range of services including:

• Cyber Threat Intelligence Platform
• PurpleOps Solutions
• Red Team Operations
• Supply Chain Information Security
• Ransomware Protection Services
• Dark Web Monitoring

Contact us today to learn more about how PurpleOps can help you protect your organization from evolving cyber threats.