The Russia-linked extortion crew Cl0p (also tracked as Clop) has claimed on its leak site that it stole internal data from nearly 50 organisations worldwide, naming energy major Shell, medical technology manufacturer Philips, General Electric and financial technology firm Fiserv among the victims. The claim was posted on 12 August 2026 and reported by Reuters, with Ukrainska Pravda carrying the account. Cl0p asserts it took roughly 89GB from Shell and 13.5GB from Philips. As of publication the group had released no samples, and no named victim has confirmed that data was actually exfiltrated. Shell, Philips and GE each acknowledged an attempted or contained intrusion and opened investigations; Fiserv says its review to date has found no evidence of compromise at all. This brief treats the volume figures and the victim count as unverified attacker claims, not established fact.
What Happened
On 12 August, Cl0p published a batch listing of nearly 50 companies and asserted possession of large volumes of internal documents from each. Reuters reported the listing; at the time of writing, the only quantitative figures in circulation come from Cl0p itself, which is the weakest possible source for a record or volume count.
The victim responses do not line up neatly, and the honest read is that accounts differ:
- Shell confirmed it was investigating. A spokesperson told Dutch outlet BNR: "We are working with our security teams and relevant experts to investigate the situation." Shell has not confirmed data loss.
- Philips was more specific, saying it "has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data," and that customer environments were not affected. That is a confirmation of an intrusion attempt against a single server, not a confirmation of the 13.5GB figure.
- General Electric said it was aware of the claim and had "initiated our cyber response protocols and are working to assess the potential issue."
- Fiserv effectively pushed back, saying that "based on our comprehensive review to date" there is no evidence any customer, bank, transaction or personal data was compromised, and no impact on its operating environment.
So one victim confirms containment of an attempted compromise, two confirm they are investigating, and one says it has found nothing. Cl0p has a documented history of accurate mass-victim listings, but it also has a history of padding lists and inflating volumes to pressure organisations into negotiating. Both patterns are live possibilities here.
What Was Taken
Nothing has been published. The stolen-data descriptions below are Cl0p's own characterisation of its holdings:
- Shell: roughly 89GB, described by the group as project drawings for energy facilities, photographs of industrial sites, scanned technical inspection reports and project planning material.
- Philips: roughly 13.5GB, described as schematics, drawings and diagrams in PDF format.
If accurate, that profile is notable for what it is not. These are engineering and design artefacts, not consumer PII. Facility drawings, site photography and inspection reports have long-tail value for physical targeting, insider reconnaissance and follow-on intrusion planning against operational technology environments. Product schematics have value for competitors and for counterfeiters. This is intellectual property and site intelligence, which does not trigger the same breach-notification machinery that a payroll database would, and therefore may never be fully accounted for publicly.
For contrast, when Cl0p's activity does reach personnel data the sensitivity is severe. Estée Lauder, breached through Oracle E-Business Suite during the campaign Google and Mandiant attributed to Clop, notified employees that exposed records included names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, bank account details, health information and HR records such as payroll and performance reviews (BleepingComputer and Computer Weekly, 20 July 2026). Estée Lauder has neither confirmed nor denied that Cl0p was the actor in its case.
Why It Matters
Cl0p's operating model has stabilised into something defenders should treat as a recurring calendar event rather than a series of surprises: find a zero-day in a widely deployed enterprise application, exploit it at scale in a short burst, sit on the data for months, then publish a mass victim list to force simultaneous negotiations. The Oracle EBS wave illustrates the timeline problem starkly. Estée Lauder's intrusion occurred on or around 9 August 2025. The company did not determine that personal information had been taken until 19 June 2026, and did not notify until July 2026. That is roughly eleven months between compromise and victim notification.
That lag is the strategic point. Any organisation reading this brief and concluding "we were not named" is reasoning from incomplete data. In the Oracle wave, victims surfaced over many months, and Computer Weekly notes that firms were compromised via their EBS instances over a three-month window. The current 50-company list is a snapshot of what Cl0p chose to publish on 12 August, not the extent of what it holds.
The wider picture is that third-party and upstream compromise is now the dominant path to bulk data. Framework, the modular computer maker, notified all of its customers in August after an upstream breach at business intelligence vendor Metabase, which disclosed that attackers used an unknown zero-day to reach customer databases on its cloud servers (TechCrunch). CareCloud is notifying at least 345,000 to 350,000 people, with TechCrunch citing at least 345,000 from state attorney general listings and SecurityWeek reporting at least 350,000, after intruders accessed an AWS-hosted electronic health record store between 10 and 16 March 2026. Brown Health Medical Group-MA has notified 311,760 individuals (290,357 of them Massachusetts residents) after a December 2025 compromise of a legacy file server. Neither the CareCloud nor the Brown Health incident has been claimed by Cl0p or any other extortion group, and both TechCrunch and SecurityWeek explicitly note the absence of any claim. They are included here as context on the volume of unattributed bulk theft, not as Cl0p activity.
The Attack Technique
The initial access vector for the 12 August listing has not been officially established. Reporting points toward the Ransomware Information Sharing and Analysis Centre (Ransom-ISAC) as a tracking source, and the strongest available candidate is Cl0p's active campaign against PTC product lifecycle management platforms.
BleepingComputer reported on 24 July 2026 that Cl0p is targeting internet-exposed PTC Windchill and FlexPLM instances via CVE-2026-12569, an unsafe deserialisation flaw rated CVSS 9.3 that enables unauthenticated remote code execution. ReliaQuest observed operators deploying JSP webshells for remote command execution and product data exfiltration. ReliaQuest was careful in its attribution, stating that "the actor behind these attacks remains unconfirmed" while noting tradecraft consistent with prior Cl0p campaigns. Ransom-ISAC separately confirmed the Windchill and FlexPLM activity.
The fit is circumstantial but strong. Windchill and FlexPLM are exactly where an engineering organisation stores schematics, drawings, CAD-adjacent PDFs and project documentation, which is precisely the data profile Cl0p describes holding from Shell and Philips. Treat this as the leading hypothesis, not a confirmed link, until a named victim or a vendor advisory ties the two together.
Two behavioural markers are worth loading into detection logic now. Ransom-ISAC's Brandon Parsons of Ascent Solutions told BleepingComputer that Cl0p is sending extortion messages from what appear to be previously compromised third-party email accounts, blasted to hundreds of employees inside a target organisation and carrying the group's current contact details. Parsons noted this matches the pattern seen during the Oracle EBS campaign. The preceding wave ran through CVE-2025-61882 in Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.14, which allowed authentication bypass and remote code execution via the BI Publisher Integration component and was patched by Oracle in October 2025. Computer Weekly notes that early suggestions of ShinyHunters involvement in that exploitation were never substantiated by threat researchers.
What Organizations Should Do
- Patch and inventory PTC Windchill and FlexPLM immediately. Apply PTC's fix for CVE-2026-12569 and treat any internet-exposed PLM instance as presumed-targeted. Pull these platforms behind VPN or a reverse proxy with authentication; there is rarely a business case for exposing a PLM system directly to the internet.
- Hunt for JSP webshells, not just for patch status. Patching closes the door but does not evict an actor who is already inside. Review PLM application server directories for unexpected JSP files, audit web server logs for anomalous POST requests to BI Publisher and Windchill endpoints, and check for outbound bulk transfers from PLM hosts. Given the eleven-month gap in the Estée Lauder case, extend the hunt window back months, not days.
- Confirm Oracle EBS exposure is genuinely closed. If you ran EBS 12.2.3 through 12.2.14 unpatched at any point before Oracle's October 2025 fix, the absence of a leak-site listing is not evidence of the absence of theft. Re-examine that window forensically.
- Prepare for extortion email arriving outside the SOC. Cl0p is mailing hundreds of employees directly from compromised legitimate accounts, which means your first indicator may be a help desk ticket rather than an alert. Brief staff on the pattern, give them a single reporting path, and instruct them not to engage with sender contact details.
- Extend the review to upstream data processors. The Framework and Metabase chain shows a full customer base exposed through a vendor's cloud infrastructure zero-day. Map which third parties hold copies of your data, contractually require breach notification timelines you can actually work with, and reduce what those vendors retain.
- Do not treat engineering data as lower-tier. Facility drawings, site photography and inspection reports typically sit outside PII-driven data classification schemes and therefore outside DLP coverage. Bring design and OT documentation repositories into the same monitoring, access review and egress control regime as HR and finance systems.
- Draft holding statements now. Shell, Philips, GE and Fiserv gave four visibly different responses to the same listing within days. Decide in advance what your organisation says when it is named but has not yet verified a loss, and make sure legal, comms and security agree on the threshold for the word "confirmed."
Sources: Russian hackers breach nearly 50 companies worldwide ... | Estée Lauder discloses data breach via Oracle E-Business flaw | Cosmetics giant Estée Lauder victim of mass Oracle breach | Clop ransomware targets Windchill, FlexPLM in data theft attacks | Computer maker Framework notifies 'all customers' of a data breach... | 311,000 Impacted by Brown Health Medical Group-MA Data Breach - Sec... | CareCloud begins to notify hundreds of thousands after hackers stol... | CareCloud Data Breach Impacts Over 350,000 - SecurityWeek