Brightspeed Investigates Data Breach After Crimson Collective Claims Theft of 1M+ Customer Records Brightspeed, a major U.S. fiber broadband provider serving rural and suburban communities across 20 states, is probing claims of a security breach after the extortion group Crimson Collective alleged it stole sensitive data from over 1 million customers. The company confirmed it is investigating the incident, stating it takes network security and customer data protection seriously while pledging to update stakeholders as details emerge. In a Sunday Telegram post, the threat actors claimed the stolen data includes personally identifiable information (PII), such as names, emails, phone numbers, addresses, payment histories, partial payment card details, and order records tied to user accounts. The group warned Brightspeed employees to check their emails, adding that a sample of the data would be released Monday night if no response was received. Crimson Collective has a history of high-profile attacks, including a October breach of Red Hat’s GitLab instance, where it exfiltrated 570GB of data from 28,000 internal development repositories, impacting the company’s consulting division. The group later partnered with Scattered Lapsus$ Hunters, leveraging the ShinyHunters data leak site to pressure Red Hat into negotiations. The fallout from that breach extended to Nissan, which confirmed in December that 21,000 Japanese customers’ personal data was compromised as a result. Beyond Red Hat, Crimson Collective has targeted AWS cloud environments, exploiting exposed credentials and creating rogue IAM (Identity and Access Management) accounts to escalate privileges and exfiltrate data. The group’s tactics highlight a growing trend of cloud-focused extortion campaigns against enterprise infrastructure. Brightspeed’s investigation remains ongoing.