Shell Investigates Potential Incident After Clop Claims 89GB Data Theft

Summary

Shell is investigating after Clop claimed it stole 89GB of company data. The alleged theft is linked to CVE-2026-12569 attacks on PTC Windchill and FlexPLM; CISA says the vulnerability is actively exploited.

Key points

Shell says it is investigating a potential security incident; it has not confirmed Clop’s data theft claim.
Clop claimed it stole 89GB of Shell data, including engineering drawings, facility testing reports, photos, and project plans.
Clop also named General Electric and Philips as alleged victims in attacks involving PTC Windchill and FlexPLM.
The attacks are linked to CVE-2026-12569, an improper input validation vulnerability affecting the PLM platforms.
CISA confirmed active exploitation and directed federal agencies to secure affected systems; German authorities also urged customers to patch.
PTC began releasing patches on June 17 and privately advised customers to check for indicators of compromise.
ReliaQuest said attackers deployed JSP webshells to steal data from compromised PLM platforms.

Article Details

Victim Organization: Shell
Incident Type: Potential security incident involving alleged data theft following attacks against Internet-exposed PTC Windchill and FlexPLM instances exploiting CVE-2026-12569.
Data Types Exposed: Engineering drawings
Facility testing reports
Facility photos
Project plans
Affected Data Size: 89 GB, claimed by Clop
Operational Impact: Shell said it was investigating a potential incident with its security teams and relevant experts. No operational disruption was reported.
Ransom Or Extortion: Clop claimed the data theft on its leak site. No ransom demand or payment was reported.
Claim Status: claimed