Cl0p widens data theft campaign across global firms

Cl0p has claimed a sweeping data-theft campaign affecting nearly 50 companies worldwide, placing Shell, Philips, GE and financial technology group Fiserv among the organisations named on the cybercrime operation’s leak site. Several companies have opened investigations, although the scale of the alleged theft remains unverified.

The campaign appears to mark another large-scale attempt by the Russia-linked extortion group to exploit a weakness in widely deployed enterprise software rather than penetrate victims individually. Security investigators have connected the activity to vulnerabilities affecting PTC Windchill and FlexPLM, platforms used to manage engineering designs, manufacturing information, product development and supply-chain data.

Cl0p claims it obtained about 89GB of information from Shell, potentially including engineering drawings, facility photographs, scans of testing reports and project documentation. Shell has acknowledged a possible security incident and said its security teams and outside specialists are examining what happened. The company has not confirmed that the volume or categories of information claimed by the attackers were stolen.

Philips has confirmed that it detected and contained an attempted compromise involving an enterprise server holding internal information. The health technology company said customer environments were not affected. Cl0p has separately claimed possession of about 13.5GB of Philips material, reportedly including diagrams and blueprints, but the gang’s description of the stolen material has not been independently established.

Fiserv has taken a more guarded position, saying its examination had found no evidence that customer, banking, transaction or personal information had been compromised and no indication that its operating environment was affected. GE has activated cyber-response procedures and is assessing the claim made against it.

Attention has increasingly focused on CVE-2026-12569, a critical vulnerability affecting PTC Windchill and FlexPLM. The flaw can permit unauthenticated remote code execution, potentially allowing an attacker to deploy malicious web shells and extract sensitive information from exposed systems. PTC began releasing security updates in June and urged customers to examine systems for signs of compromise as concern over active exploitation intensified.

US cybersecurity authorities subsequently placed CVE-2026-12569 in the Known Exploited Vulnerabilities catalogue and imposed an accelerated remediation timetable on federal agencies. The urgency reflected the risk posed by internet-facing installations of software that can contain commercially sensitive product designs, manufacturing information, specifications and other intellectual property.

The approach closely follows Cl0p’s established strategy of finding vulnerabilities in widely used corporate platforms and exploiting them across many organisations before launching an extortion campaign. Rather than concentrating resources on a single network, attackers can use one software weakness to reach numerous companies that share the affected technology. Researchers tracking the latest activity have observed web shells being used to maintain access and facilitate information theft.

Cl0p has increasingly become associated with data theft and extortion campaigns in which encryption is not necessarily the principal weapon. After extracting corporate information, operators typically contact victims and threaten publication unless payment is made. Publicly naming companies on a leak site adds pressure while creating reputational and regulatory risks even before the precise extent of a breach is established.

The group previously exploited vulnerabilities affecting several enterprise file-transfer and business applications. Its 2023 campaign against MOVEit Transfer ultimately affected more than 2,700 organisations worldwide. Cl0p later exploited Oracle E-Business Suite vulnerabilities during another major data-theft campaign that began in 2025, with organisations across corporate, aviation, education and other sectors reporting breaches.

The current episode also illustrates the difficulty companies face when cybercriminal claims emerge faster than forensic investigations can establish facts. Appearance on a ransomware leak site does not by itself prove that all data claimed by an attacker was obtained, and the responses from Philips and Fiserv demonstrate that the impact can differ sharply between organisations named in the same campaign.