Brightspeed’s Investigation into Alleged Breach Exposed

Brightspeed Investigates Security Breach and Data Theft Claims by Crimson Collective

Brightspeed, a leading fiber broadband provider in the U.S., is currently looking into allegations of a security breach and data theft made by the Crimson Collective extortion group.

Established in 2022, Brightspeed operates in 20 states, serving rural and suburban communities with telecommunications and internet services.

“We prioritize the security of our networks and the protection of our customers’ and employees’ information. We are actively investigating reports of a cybersecurity incident,” stated Brightspeed to BleepingComputer. “We will provide updates to our customers, employees, and relevant authorities as we gather more information.”

Crimson Collective Claims Theft of Sensitive Data from Brightspeed

In a recent update on their Telegram channel, the Crimson Collective stated that they have acquired sensitive information from over 1 million Brightspeed customers.

The stolen data reportedly includes customer/account details, personally identifiable information (PII), address information, user account details linked to session/user IDs, payment history, payment card information, and appointment/order records containing customer PII.

The threat actors warned of releasing a sample of the data on Monday night, urging Brightspeed to respond promptly.

The Crimson Collective has a history of cyberattacks, including a breach on Red Hat’s GitLab instances, resulting in the theft of significant data affecting the company’s consulting division.

Furthermore, the group collaborated with the Scattered Lapsus$ Hunters hacker collective, utilizing the ShinyHunters data leak site to extort Red Hat following the breach.

Nissan also confirmed a data breach impacting approximately 21,000 Japanese customers due to their association with the Red Hat incident.

Recently, Crimson Collective targeted AWS cloud environments, leveraging exposed credentials to steal data and extort companies by creating rogue IAM accounts.