Brightspeed Fiber Broadband Incident — January 2026
Crimson Collective ransomware group allegedly stole personal data of over 1 million Brightspeed customers via sophisticated phishing in early 2026.
- Customer names
- Service addresses
- Phone numbers
- Account-tier data
The ransomware group Crimson Collective allegedly stole personal data covering more than 1 million Brightspeed Fiber customers via a sophisticated phishing campaign that compromised internal access. Brightspeed has not confirmed the scope publicly, but the threat group has begun publishing samples to support their extortion demands.
Home internet providers hold the kind of metadata that's especially dangerous in a doxxing context: service-address records that geolocate the customer at the home level. For gamers and streamers, address data tied to a public handle is the foundation for swatting-style attacks. Router logs, if exposed, can also surface IP-allocation patterns useful for stalking.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →