The week in breach news Oct 8, 2025

On October 2, Red Hat confirmed that its consulting GitLab instance had been compromised, allegedly affecting data from more than 800 organizations across sectors such as banking, telecom and government.

A day earlier, on October 1, the cybercrime group known as Crimson Collective publicly disclosed the breach, claiming to have stolen 570GB of compressed data from more than 28,000 repositories. The stolen data reportedly includes Customer Engagement Reports (CERs) tied to major organizations, including Bank of America, JPMorgan Chase, Verizon, AT&T, the U.S. Navy, the U.S. Senate and the National Security Agency. Red Hat has since confirmed that unauthorized access occurred in a GitLab instance used for internal Red Hat Consulting activities.

While the company stated that the incident is confined to its consulting GitLab environment, the cybercrime group continues to share samples of the allegedly stolen repositories, claiming the breach is much larger than Red Hat's initial assessment.

Canadian airline WestJet stated that a cybersecurity breach discovered earlier this year exposed personal information belonging to some passengers.

The airline said it detected suspicious activity on June 13 and later found that a "sophisticated, criminal third party" had gained unauthorized access to its systems. In a notice to U.S. residents, WestJet revealed that the compromised data included passenger names, contact details, travel documents and information provided during the reservation process. However, the airline emphasized that its internal safeguards prevented attackers from accessing customers' credit and debit card numbers, expiry dates, CVV codes or passwords.

The aviation industry's increasing reliance on complex digital systems and massive amounts of passenger data has made it a prime target for cybercriminals. Earlier in September, a ransomware attack on Collins Aerospace disrupted airport operations across Europe, crippling check-in and baggage systems at major travel hubs.

Veradigm, a Chicago-based healthcare technology company formerly known as Allscripts, has begun notifying individuals of a security incident that may have affected at least 65,000 people across California, South Carolina and Texas.

On July 1, 2025, Veradigm discovered that an unauthorized third party had accessed one of its storage locations in December 2024. An investigation revealed that the breach stemmed from a data security incident at one of its customers, where stolen credentials were used to gain access to Veradigm's storage account. The exposed data may include names, dates of birth, Social Security numbers, driver's license numbers, medical records, health insurance details and payment information.

The company said in a statement that it has implemented additional security measures and taken steps to prevent similar incidents in the future.

Motility Software Solutions, a software provider for specialty automotive dealerships, has revealed a ransomware attack that exposed the personally identifiable information (PII) of about 766,000 individuals.

The Florida-based company, formerly known as Systems 2000, provides software to more than 7,000 dealerships across the U.S. According to a filing with the Maine Attorney General's office, the breach occurred on August 11 and was discovered on August 19. The attack involved malware that encrypted parts of the company's internal systems, limiting employee access to key operational tools.

Motility began notifying affected individuals on September 29, 2025. The company said the compromised PII may include names, dates of birth, contact details, postal addresses, Social Security numbers and driving license numbers.

Asahi Group Holdings, Ltd., one of Japan's largest beverage companies, has confirmed that it was the victim of a ransomware attack. The company shared the update on October 3, about a week after disclosing the cyberattack, which forced it to suspend some domestic operations.

During its ongoing investigation, Asahi discovered a potential unauthorized transfer of data from its systems. The company has not yet determined the nature or scope of the compromised information, nor has it disclosed whether the attackers issued a ransom demand.