INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Philips and GE investigating Clop ransomware data theft claims

| 2026-08-17 11:25 CRITICAL LOW RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
On August 17, 2026, high-profile companies across the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors were targeted by a Clop ransomware gang in attacks exploiting a critical improper input validation vulnerability (CVE-2026-12569) against Internet-exposed PTC Windchill and PTC FlexPLM instances. More than 30,000 customers globally use these platforms, including over 1,500 brand and retail customers using FlexPLM. The U.S. Department of State now offers a $10 million reward for any information linking the cybercrime gang's attacks to a foreign government. Philips and GE are investigating claims that their systems were breached by Clop, with Philips containing an attempted cybersecurity compromise but stating it had no impact on customer environments; Shell is also investigating after claiming it stole 89GB of data from its compromised system.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-12569 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-12569CVE-2026-12569
Target & Sectors
DACH DACH defensedefense governmentgovernment automotiveautomotive retailretail aerospaceaerospace
Incident Timeline
‎August 2025
The U.S. Department of State now offers a $10 million reward for any information linking the Clop ransomware gang's attacks to a foreign government, announced in August 2025.
financial $10 reward
The U.S. Department of State now offers a $10 million reward for any information linking the cybercrime gang's attacks to a foreign government.
‎2026/08/17
The Clop ransomware gang has claimed to have stolen 89GB of data from Shell, prompting the oil giant and other companies including Philips and GE to investigate potential security incidents.
victims 30,000 customers
The company says more than 30,000 customers globally use its products, including over 1,500 brand and retail customers using FlexPLM.
victims 1,500 customers
The company says more than 30,000 customers globally use its products, including over 1,500 brand and retail customers using FlexPLM.
victims 2,770 organizations
…erprise platforms in data theft attacks, breaching Accellion FTA , GoAnywhere MFT , SolarWinds Serv-U FTP , Cleo , and MOVEit Transfer file-sharing servers in previous campaigns, with the latter affecting over 2,770 organizations worldwide .
victims 43 new victims
…he three companies have yet to share more information, the Clop gang has listed them on its leak site as part of a batch of 43 new victims likely targeted in data theft attacks exploiting a critical improper input validation vulnerability (tracked…
data_breach 89 GB
This comes after oil giant Shell also said on Friday that it is investigating a potential security incident after the Clop hacking group claimed it stole 89GB of data.
Tactical Metrics
Metrics
victims
30,000
Customers
The company says more than 30,000 customers globally use its products, including over 1,500 brand and retail customers using FlexPLM.
Metrics
victims
1,500
Customers
The company says more than 30,000 customers globally use its products, including over 1,500 brand and retail customers using FlexPLM.
Metrics
financial
10,000,000
Reward
The U.S. Department of State now offers a $10 million reward for any information linking the cybercrime gang's attacks to a foreign government.
Metrics
victims
2,770
Organizations
…erprise platforms in data theft attacks, breaching Accellion FTA , GoAnywhere MFT , SolarWinds Serv-U FTP , Cleo , and MOVEit Transfer file-sharing servers in previous campaigns, with the latter affecting over 2,770 organizations worldwide .
Metrics
victims
43
New Victims
…he three companies have yet to share more information, the Clop gang has listed them on its leak site as part of a batch of 43 new victims likely targeted in data theft attacks exploiting a critical improper input validation vulnerability (tracked…
Metrics
data_breach
89
Gb
This comes after oil giant Shell also said on Friday that it is investigating a potential security incident after the Clop hacking group claimed it stole 89GB of data.
Intelligence Sources
BleepingComputer 2026-08-17