Brightspeed

On January 4, 2026, the Crimson Collective extortion group posted to Telegram claiming they had breached Brightspeed—a multistate fiber broadband provider—and stolen data on more than one million residential customers. They listed the records for sale at three bitcoin.

Brightspeed said it was "investigating" for months. On April 27, the company officially confirmed the breach. The gap between attacker claim and company confirmation became nearly four months of uncertainty for a million customers.

Customer personally identifiable information. Physical addresses. Phone numbers. Email addresses. Payment histories. Service order records including appointment and installation details. Limited payment card data.

For an internet service provider, the data reveals who lives where, what services they use, when they're typically home (based on service appointments), and their payment relationships. It's a comprehensive customer profile built through the ISP relationship.

Over one million Brightspeed customers across their multi-state service area. Residential internet subscribers who chose Brightspeed for connectivity now face phishing, fraud, and identity theft risks. Service appointment data reveals when people are home—useful for social engineering and physical security threats.

Customers reported intermittent outages and inability to access account management tools after the breach. The impact extended beyond data theft to service disruption affecting a million users' daily internet connectivity.

Brightspeed said it was investigating. They didn't confirm production systems compromise immediately. The careful, measured response is standard corporate communications during incident response.

But four months of "investigating" while Crimson Collective had already posted the data erodes customer trust. The legal system didn't wait—class action lawsuits were filed January 7, three days after the claim. Lawyers moved faster than the company could confirm.

Security researchers noted Crimson Collective historically targets misconfigured cloud environments and systems lacking multi-factor authentication. Infostealers reportedly played a role—compromised credentials from employee devices may have provided initial access.

The attack surface extended beyond corporate systems to every endpoint touching corporate resources. Understanding data exposure requires understanding not just what databases exist, but how access to those databases is managed across the full credential landscape.

Multiple class action lawsuits filed within days of Crimson Collective's claim. Notification requirements across multiple states where Brightspeed operates. Customer communications about breach impact and protective measures.

Crimson Collective—which first appeared in late September 2025—added Brightspeed to their victim list alongside attempted extortions of Red Hat and others. The group continues operating while affected customers wait for the full scope of their exposure.