URGENT: Red Hat Compromised

Dear colleagues,

Red Hat has confirmed a major security incident involving its private GitHub repositories.
The extortion group Crimson Collective claims to have stolen approx. 570 GB of data from more than 28,000 private repositories, including:

• Consulting and engineering reports with customer infrastructure details.
• Developers’ private repositories and internal code.
• Sensitive artifacts: API keys, CI/CD secrets, VPN profiles, pipeline configs, architectural diagrams.

Main risk: the stolen data may enable targeted attacks against customers and partners (phishing, supply-chain compromise, use of exposed credentials).

Required actions

1. Immediate credential rotation
   • API keys, GitHub tokens, VPN credentials, CI/CD secrets.
   • Revoke any certificates or SSH keys potentially shared with Red Hat.
2. Log review & active monitoring
   • Check for anomalous access to critical systems, pipelines, and cloud environments.
   • Pay attention to logins from unusual IP addresses or timeframes.
3. Pipeline and build environment validation
   • Verify integrity of CI/CD pipelines.
   • Compare current configs against approved baselines.
4. Enforce strong MFA & just-in-time access
   • Mandatory MFA on GitHub and connected systems.
   • Minimize duration and privilege of temporary credentials.
5. Report anomalies immediately
   • Any suspicious activity must be reported to the internal SOC (csirt@cybertech.eu, security@eng.it )

Thank you for your cooperation and vigilance.
The situation is evolving: further updates will be shared as soon as available.

Group Information Security Office
Security@eng.it
Engineering Ingegneria Informatica
Piazzale dell’Agricoltura, 24 – 00148 Roma (RM)
www.eng.it