Reported by 4 outlets
Shell investigates 'potential incident' after Clop data theft claims
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.36 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Clop is running a mass data-theft campaign against internet-exposed PTC Windchill and FlexPLM instances, exploiting CVE-2026-12569, an improper input validation flaw. In its latest leak-site drop the gang listed 43 new victims at once, including Shell, General Electric, and Philips, and claims 89GB taken from Shell: engineering drawings, scans of facility testing reports, photos of facilities, and project plans. For GE and Philips it advertises backups, system files, projects, drawings, diagrams, and blueprints. Shell says only that it is aware of a potential incident and has activated its response procedures, with no reported disruption to refinery, drilling, or production networks. Philips has gone furthest, confirming a compromise of a specific enterprise server that it says is contained with no customer impact, while GE is still assessing. The CVE sits on CISA's KEV catalog, and the batch-of-43 listing pattern points to automated exploitation at scale rather than hand-picked targets.
The real exposure here is not "energy companies," it is every organization running Windchill or FlexPLM on the public internet, and the damage model is not PII or payment cards. PLM repositories hold the drawings, test results, and facility layouts that describe how plants and products are actually built, so a successful theft is a competitive and physical-security loss for an oil major that operates tens of thousands of sites serving 20 million customers a day. Treat the 89GB figure with skepticism: Philips' own statement describes an attempted, contained compromise while Clop lists it as a victorious victim, which shows the gang counts partial or failed access in its totals and that listing size is a ransom-pressure number, not a forensic one. The cadence supports that reading; a day before the Shell listing, Clop claimed 8TB from Zebra, complete with the target's revenue, wording built for negotiation leverage rather than verification.
Assume exploitation until proven otherwise. Inventory internet-facing Windchill and FlexPLM servers and pull them behind VPN or allowlists if a fix for CVE-2026-12569 is not yet deployed, and apply the vendor patch as the permanent fix. Hunt on the PLM tier: review web and application access logs for anomalous input-validation failures followed by bulk document retrieval, diff which engineering-document repositories were touched, and check egress logs for large outbound transfers in the weeks before August 13, when this listing wave began. Check whether your organization appears in Clop's leak-site batches; early identification beats a reporter's call.
Two developments would move this assessment. Confirmed exfiltration from Shell or GE matching the advertised archive would validate the campaign's real yield and justify incident-response spend at every exposed PLM operator, while more Philips-style "attempted and contained" findings would deflate the 43-victim total to noise. Second, watch for published exploit details or a surge of Windchill/FlexPLM scanning after the patch ships: that combination typically means the remaining unpatched, internet-facing population gets swept within days, which is the window in which exposure removal matters more than forensics.
Timeline
-
original reporting
Shell investigates 'potential incident' after Clop data theft claims
bleepingcomputer.com · 60d ago · August 14th, 2026
Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data. Shell is a British multinational energy conglomerate and one of the world's top three oil and gas companies, after Chevron and ExxonMobil. It has 85,000 employees in more than 70 countries and operates a massive network of tens of thousands of service and recharge stations that serve over 20 million customers daily. According to a recent post on Clop's dark web data leak site, the allegedly stolen files include engineering drawings, scans of facility testing reports, photos of the facilities, and project plans. "We are aware of a potential incident. We are working with our security teams and relevant experts to investigate," a Shell spokesperson told BleepingComputer when asked to confirm Clop's data theft claims. While the company has yet to share more information, the Clop gang listed it on its leak site as one of 43 new victims likely targeted in data theft attacks against Internet-exposed PTC Windchill and FlexPLM instances exploiting a critical improper input validation vulnerability tracked as CVE-2026-12569 . As part of the same attacks, Clop also claimed it stole sensitive data, including backups, system files, projects, drawings, diagrams, and blueprints, from the networks of tech conglomerates General Electric and Philips. GE and Philips spokespersons were not immediately available for comment when BleepingComputer contacted t
-
update from malware.news
Clop Ransomware Targets Zebra.com in Major Data Breach
malware.news · 60d ago · August 15th, 2026
Summary On August 13, 2026 , the notorious ransomware group Clop announced a cyberattack on ZEBRA.COM ( zebra.com ), resulting in the exfiltration of 8TB of sensitive data. The compromised data includes critical databases and CAD files, significantly impacting the company, which boasts revenues of $5.6 billion. Incident Report Field Details Target ZEBRA.COM Domain zebra.com Country USA Attacking Group Clop Date Reported August 13, 2026 Threat Actor Statement “Data exfiltrated included the following: Database, Project – files, CAD – files Total size: 8Tb Revenue: $5,600,000,000” Recommended Security Actions Ransomware attacks are increasingly targeting both enterprise and mid-sized organizations across all sectors. The following steps are critical to reduce impact and prevent future incidents: Monitor continuously: Use DeXpose’s dark web and infostealer monitoring platform to detect breached credentials, leaked databases, and threat actor chatter in near real-time—before damage spreads internally. Conduct a compromise assessment: Immediately initiate a full incident review to determine how attackers infiltrated your network, what data may have been exfiltrated, and whether any persistence mechanisms rem
-
update from cyberpress.org
Shell Investigates Data Breach After Cl0p Ransomware Group Claims 89 GB Data Theft
cyberpress.org · 58d ago · August 17th, 2026
The threat group added Shell to its dark-web leak portal, alleging that the stolen material contains engineering drawings, facility photographs, project roadmaps, testing reports, and other internal documents. Shell has not independently confirmed that its systems were compromised, nor has the company verified the authenticity, age, or scope of the data advertised by the cybercriminal group. Shell Investigates Data Breach Shell said it has activated internal cyber incident-response procedures and is working with security specialists to assess the claims. The company has not reported any interruption to refinery operations, drilling activities, production networks, or core IT services. However, the alleged theft of technical and project-related documents could carry substantial security and commercial consequences, even if no systems were encrypted and business operations remain unaffected. Cl0p’s leak-site postings are designed to create pressure during ransom negotiations. In data-extortion attacks, threat actors gain access to a corporate environment, identify valuable repositories, and transfer sensitive information to infrastructure they control. They then demand payment in
-
update from gbhackers.com
Shell Investigates Data Breach After Cl0p Ransomware Claims Theft of 89GB Corporate Data
gbhackers.com · 57d ago · August 17th, 2026
This alleged breach was published on Cl0p’s dark web leak portal, prompting scrutiny from security researchers and enterprise defenders as Shell’s forensic teams assess the authenticity of the files and […] The post Shell Investigates Data Breach After Cl0p Ransomware Claims Theft of 89GB Corporate Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from bleepingcomputer.com
Philips and GE investigating Clop ransomware data theft claims
bleepingcomputer.com · 57d ago · August 17th, 2026
"Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data," Philips said in a statement shared with Reuters .