[REVISION HISTORY]

Cl0p ransomware attacks on global corporations

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-08-14 14:07 UTC → 2026-08-15 05:23 UTC · added ~~removed~~

The Cl0p ransomware group has claimed responsibility for targeting approximately 50 major international corporations, including Shell, Philips, General Electric, and Fiserv. The group alleges the theft of significant volumes of sensitive data, such as engineering drawings, blueprints, and project plans. The attacks exploited a critical vulnerability in PTC software, specifically affecting PTC Windchill and FlexPLM systems. The vulnerability, identified as CVE-2026-12569, carries a CVSS score of 9.8 and allows for unauthorized remote code execution. While PTC released patches in June 2026, Cl0p reportedly distributed extortion emails in mid-July. As of mid-August, Cl0p has provided specific claims regarding the volume of exfiltrated data. The group alleges it stole approximately 89 gigabytes of data from Shell, including facility photos and project plans, and roughly 13.5 gigabytes from Philips, including technical diagrams. Corporate responses have varied: Shell acknowledged a “possible incident” and is ~~investigating,~~ investigating the matter alongside security experts, while Philips confirmed it identified and contained an attempted compromise of an ~~internal~~ enterprise server ~~that has since been contained.~~ containing internal data, stating the incident did not affect customer environments. Fiserv and GE have indicated they are aware of the claims and are conducting reviews or implementing response protocols; Fiserv reported finding no evidence of ~~leaked~~ compromised customer or personal data. Independent verification of the stolen data volumes and contents has not yet been established.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.