U.S. telecommunications and internet provider Brightspeed is investigating claims of the cyberattack after the Crimson Collective hacking group claimed to have breached the company’s systems and exfiltrated sensitive customer information.

Crimson Collective claimed in late December that it had obtained the personal information of more than 1 million Brightspeed customers. The stolen data allegedly includes names, email addresses, phone numbers, billing and account details and other personally identifiable information.

According to Bleeping Computer today, the group has released a data sample as proof of the breach and is threatening wider disclosure unless the company responds.

“If anyone has someone working at Brightspeed, tell them to read their mails fast! We have in our hands over 1m+ residential user PII’s,” the group said, before adding that a new “sample will be dropped on Monday night time, letting them some time first to answer to us.”

Brightspeed, founded in 2022, operates broadband services across 20 U.S. states and supports both residential and business users.

In a statement, it said, “We take the security of our networks and protection of our customers’ and employees’ information seriously and are rigorous in securing our networks and monitoring threats. We are currently investigating reports of a cybersecurity event. As we learn more, we will keep our customers, employees and authorities informed.”

The Crimson Collective is an extortion-oriented threat actor that first appeared on the scene in late September 2025 and uses a dedicated Telegram channel to announce and promote alleged breaches and stolen data.

A profile of the group from S2W Inc. notes that its modus operandi centers on data exfiltration from cloud environments — particularly Amazon Web Services Inc.-hosted infrastructure — followed by extortion demands broadcast on social platforms.

Crimson Collective first gained significant attention in October when it publicly claimed responsibility for a substantial breach of Red Hat’s private GitLab instance. The group claimed to have stolen about 570 gigabytes of sensitive internal repositories and customer engagement reports spanning thousands of projects.

Photo: Brightspeed