Red Hat Confirms Security Breach After Hackers Claim GitHub Data Theft

Red Hat has confirmed that there was a security incident after a hacker group claimed to have stolen data. In their announcements, the hackers said they stole data from GitHub—but the data, indeed, was stolen from one of Red Hat’s GitLab systems in order to conduct consulting.

What Happened​

The hacker group, Crimson Collective, claimed they stole 570GB of data across 28,000 repositories. They claimed to have about 800 Customer Engagement Reports (CERs) as well—these reports could contain sensitive information, including system information, login tokens, and configurations. In other words, stuff you don’t want to let other people see.

Red Hat acknowledged the breach but did not specifically validate the claims of the hackers. They said they acted quickly—and are confident that this did not impact their products and software supply chain. Which is great news, given the number of companies around the world using Red Hat software.

Why This is Serious​

If the CERs were indeed stolen, that would be a concern for the customers included in the reports. Some of these reports allegedly contain Bank of America, AT&T, Walmart, and U.S. government agencies. Hackers could exploit this information to exploit your organization and conduct follow-up attacks.

Actions of the Hacker(s)​

Not only did the hacker steal data, they also attempted to extort Red Hat. They approached the company with a list of demands but received only a boilerplate security response. It was to show they could prove otherwise, the hacker(s) posted a list of files they claimed to have taken from Red Hat on Telegram.

The hacker even claimed they hacked a Nintendo web page for fun. Classic hacker.

Actions by Red Hat​

Red Hat was professional and stated their priority was protecting customer trust and securing their systems. They did not of course disclose too much information since the investigation was still underway. They did assure users, that most importantly, that their software supply chain was secure.

Thoughts​

This is a good example of the reality that big companies like Red Hat can be the target of an attack. Hackers often target systems which people don't remember exist, such as a development or consulting tool. This is a reality check for any business - check all of your systems.

Final Thoughts​

Red Hat addressed the hackers quickly, however the story is not over. Will there be further disclosure of data? Will customers see any impact? Only time will tell. The one lesson learned from this - hackers are growing bolder, and no one is completely safe.