Cybersecurity
Oct 17, 2025
Oct 6, 2025
•
4 min read
Over the past few days, several high-profile cybersecurity incidents have made headlines, reinforcing just how fragile the digital perimeter remains. Here’s a look at some of the biggest breaches and warnings that grabbed attention over the past few days.
Red Hat Confirms Massive GitLab Data Theft
Red Hat disclosed that one of its internal GitLab instances (used by its Consulting arm) was breached by an extortion group calling itself Crimson Collective. The attackers claim to have exfiltrated ~570 GB of internal data, spanning over 28,000 repositories including customer engagement reports, project files, technical specifications, and infrastructure documents.
Although Red Hat states that no direct compromise of its core product infrastructure or widely-used sensitive customer data has been confirmed, the breadth of internal knowledge stolen presents significant risk for supply-chain attacks, targeted phishing, and intelligence gathering. The company has isolated the affected instance, is coordinating with customers, and is urging revocation of exposed credentials, increased monitoring, and security hardening.
Discord Support Provider Breach Impacts Users
Discord revealed that a third-party customer support vendor was compromised, exposing data from users who had engaged with Discord support or Trust & Safety channels. Exposed data included names, usernames, email addresses, and the last four digits of credit cards. A limited number of scanned government ID images (submitted for age verification appeals) were also accessed. Crucially, the attacker did not gain direct access to Discord’s primary systems or user passwords. In response, Discord revoked the third-party’s access, notified affected users, is cooperating with law enforcement, and is reviewing security controls for external support providers.
Read the whole story from The Verge.
Oracle & Salesforce Clients Targeted by Extortion Campaigns
Oracle confirmed that its customers using the E-Business Suite have been targeted in a widespread extortion campaign involving “dangerous emails,” echoing previous warnings from Google’s threat-intelligence teams. Attackers have sent alarming messages to CEOs and CIOs, claiming to have stolen or viewed sensitive data. The culprit is linked to the Cl0p ransomware group, which apparently exploited known vulnerabilities (or unpatched systems) to gain leverage. Ransom demands reportedly span from millions up to $50 million depending on the target. Google has also warned that multiple U.S. executives across diverse industries are being approached in a “high-volume” campaign. Oracle is urging customers to patch vulnerable systems immediately, review access controls, and assume threat actors are already scrutinizing system logs.
Asahi Breweries Hit by Operational Cyberattack
In Japan, Asahi Group faced a disruptive cyberattack that temporarily shut down production and order processing across its six domestic plants. The outage affected shipping, customer support, and internal logistics systems. Though production has resumed, full recovery timelines remain unclear, and the company continues to evaluate damage to other facilities. The incident led to localized shortages of popular products like Asahi Super Dry and Nikka Whisky.
Read more about the impact from Reuters.
Key Takeaways & Strategic Recommendations
These incidents collectively reinforce several enduring lessons — and offer forward-looking priorities for organizations aiming to harden defenses:
-
Treat internal and third-party systems as high-value targets
Development platforms, consulting services, customer support tools, and vendor systems can all yield deep insight. Use network segmentation, zero trust access, and strict least-privilege policies. -
Patch swiftly, especially for widely exploited platforms
Many attackers rely on known vulnerabilities. The Oracle/Cl0p campaign is a reminder that delayed patching often becomes a liability. -
Assume extortion is part of the attacker’s toolbox
Even if data exfiltration is partial (or access doesn’t allow full system takeover), adversaries may threaten public exposure. Prepare legal, PR, and negotiation plans in advance. -
Monitor vendor relationships and enforce vendor security SLAs
Require regular audits, enforce penetration testing, demand proof of compliance with encryption and access controls, and limit vendor reach into your core environment. -
Adopt proactive threat detection and recovery strategies
Use anomaly detection, data leak monitors, multi-factor authentication, and robust backup/restore processes. In the event of a breach, quick response and isolation remain vital. -
Elevate cyber resilience into board-level discussions
As the costs and risks of breach–or even perceived breach–grow, executives and boards must be part of the decision-making loop on cybersecurity investments.
Keep your learning going and unlock complimentary access to the Gartner® research: Implement Zero-Trust Network Access Through a Life Cycle Approach.
