cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

GE, Philips, and Shell Investigate Clop Data-Theft Claims Tied to PTC Flaw

· Original article ↗

Summary

GE and Shell are investigating Clop data-theft claims; Philips confirmed a contained compromise of an internal enterprise server with no customer impact. The claims are linked to exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM.

Key points

  • GE is assessing Clop’s claim that it breached the company and stole data; the claim has not been confirmed by GE.
  • Philips confirmed an attempted compromise of a specific internal enterprise server, said it was contained, and reported no impact to customer environments.
  • Shell is investigating a potential incident after Clop claimed it stole 89GB of data.
  • Clop listed the companies among 43 alleged victims and claimed to have taken sensitive files, including backups, plans, photos, drawings, and blueprints.
  • The attacks are linked to exploitation of CVE-2026-12569 in internet-exposed PTC Windchill and FlexPLM instances. ReliaQuest and Ransom-ISAC reported Clop attacks using JSP webshells to steal data.
  • PTC began releasing patches on June 17. CISA confirmed active exploitation and directed federal agencies to secure affected instances after adding the flaw to its known exploited vulnerabilities catalog.

Article Details

Victim Organization
General Electric (GE), Philips, and Shell
Victim Domain
Unknown
Incident Type
Alleged data theft following exploitation of CVE-2026-12569 in internet-exposed PTC Windchill and PTC FlexPLM instances. Philips confirmed a contained compromise of an internal enterprise server; GE and Shell were investigating potential incidents.
Data Types Exposed
  • Backups
  • Project plans
  • Facility photos
  • Drawings
  • Diagrams
  • Blueprints
Affected Records
Unknown
Affected Data Size
Clop claimed 89 GB stolen from Shell; no volume was disclosed for GE or Philips.
Operational Impact
Philips said the compromise of a specific internal enterprise server was contained and did not affect customer environments. GE and Shell were assessing potential incidents.
Ransom Or Extortion
Clop listed the companies on its leak site and claimed data theft. No ransom demand was reported.
Claim Status
claimed

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe attacks are linked to exploitation of CVE-2026-12569 against internet-exposed PTC Windchill and PTC FlexPLM instances.T1505.003 · Web ShellReliaQuest and Ransom-ISAC confirmed that attackers deployed JSP webshells on compromised PLM platforms.

CVE

CVE-2026-12569The attacks are linked to exploitation of CVE-2026-12569 against PTC Windchill and PTC FlexPLM, which Clop has used to target enterprise platforms and steal sensitive files.

Threat Actors

ClopClop listed GE, Philips, and Shell among alleged victims and claimed data theft. The article links attacks against Windchill and FlexPLM to the group, while GE and Shell were still investigating and Philips confirmed a contained compromise without confirming Clop's responsibility.

Malware

ClopGeneral Electric and Philips are investigating claims that the Clop gang breached their systems and stole internal data, while Shell is also reviewing a separate alleged incident.

Vendors

PTCThe attacks are linked to exploitation of CVE-2026-12569 against PTC Windchill and PTC FlexPLM, which Clop has used to target enterprise platforms and steal sensitive files.

Products

FlexPLMThe attacks are linked to exploitation of CVE-2026-12569 against PTC Windchill and PTC FlexPLM, which Clop has used to target enterprise platforms and steal sensitive files.PTC WindchillThe attacks are linked to exploitation of CVE-2026-12569 against PTC Windchill and PTC FlexPLM, which Clop has used to target enterprise platforms and steal sensitive files.

Related Articles