Cl0p ransomware attacks on global corporations

The Cl0p hacker group has claimed responsibility for stealing large volumes of data from approximately 43 to 50 companies globally. Targeted organizations include major corporations such as Shell, General Electric, Philips, and Fiserv.

Investigations revealed that the attackers exploited a critical improper input validation vulnerability, identified as CVE-2026-12569, within PTC Windchill and FlexPLM software. These product lifecycle management tools are used for engineering project management and manufacturing processes. The group reportedly targeted these environments to steal sensitive information, including blueprints, diagrams, and project plans.

While security patches for the software began releasing in mid-June, experts noted that the exploitation occurred before remediation processes were fully implemented across complex enterprise platforms. Philips confirmed it contained an attempted breach of a corporate server but stated that customer environments were not affected. Fiserv reported finding no evidence of compromised customer data or system impacts, while Shell indicated it was investigating a ‘possible incident’.