The Cl0p extortion group has posted data it says it stole from Shell and Philips on its dark web leak site. Both companies refused the demands Cl0p first made in August 2026. Cl0p claims about 89GB of Shell data and 13.5GB of Philips data, according to ED and Dark Web Decoded. Dutch broadcaster BNR reviewed the Philips files. They include technical drawings of MRI scanners and other medical equipment, plus information about Philips' IT infrastructure. BNR could not access the Shell files. Researchers tie both companies to Cl0p's summer campaign against PTC Windchill and FlexPLM servers, which exploited CVE-2026-12569. That link comes from the leak-site listings, though, and neither company has confirmed it. The two companies also describe the incidents in ways that only partly match what Cl0p has published. Every source for this brief is secondary reporting or vendor research. Statements from Shell and Philips reach us only through those outlets.
What Happened
Cl0p named Shell and Philips on its leak site in mid-August 2026. They were part of a large batch of alleged victims from the Windchill/FlexPLM campaign. Sources count that batch differently:
- 43 new victims: Immunity's write-up.
- More than 40: Protos Labs, ExtraHop and VicyTech.
- "Roughly 45 other companies" besides Shell, Philips, GE and Fiserv: Tech Insider.
Protos Labs warns that the batch should be read as more than 40 named organisations, not a verified breach count. Only some of the named companies have publicly confirmed a compromise.
After the August deadline passed without payment, Cl0p published download links for both datasets in early October. ED reported the publication on 8 October. The files are on the dark web, so the general public cannot easily reach them. Other threat actors can.
What the companies say:
- Shell told ED it investigated "unauthorised access to a cloud-based IT service" run by a third party and used for non-critical business activities. Shell said the access was blocked and the platform isolated. It reported no operational impact and no exposure of sensitive personal data, and said it had notified the relevant regulators. The statement does not mention PTC Windchill or FlexPLM.
- Philips declined to comment in detail to ED. A spokesperson said only that the data "does not involve personal data or patient data." Earlier, Immunity reported that Philips said it had contained an attempted compromise of one enterprise server, with no impact on customer environments. ExtraHop reports that Philips said it found no evidence that data was taken.
The Philips accounts conflict. Its earlier statements suggest a contained attempt with no data stolen, but BNR has now reviewed engineering and infrastructure files published under Philips' name and sent samples to the company to verify. Philips has not publicly confirmed whether the files are authentic. Until it does, both of these remain possible: Cl0p took more than Philips first found, or the published material is not what Cl0p says it is.
What Was Taken
Philips (claimed: 13.5GB, per ED):
- Drawings, diagrams and blueprints of MRI scanners and other medical equipment. BNR saw these files.
- Information about Philips' IT infrastructure. BNR saw this too, and Dark Web Decoded assesses it as the more immediately dangerous category. A map of how systems are configured and connected saves a future attacker the reconnaissance work.
- No personal or patient data, according to Philips.
Shell (claimed: 89GB, per ED and Dark Web Decoded):
- Construction drawings, photos of facilities, test reports and project plans. All of these are Cl0p's own descriptions. BNR could not access the data to check them.
- No sensitive personal data, according to Shell.
Security Curated suggests the stolen files "typically include legal documents, financial records, and employee information." That is a general description of Cl0p leaks, not an analysis of the Shell dataset, and it conflicts with Shell's own statement. We do not treat it as evidence of what was taken.
Both datasets fit the campaign's overall pattern. This time Cl0p went after engineering intellectual property, such as CAD files, blueprints and project documents, rather than the bulk personal records it took in the MOVEit campaign.
Why It Matters
- Intellectual property is the new extortion target. PLM systems hold a manufacturer's most sensitive engineering data. Leaked medical-device designs are useful to competitors, and they may reveal failure modes in equipment that hospitals rely on.
- Leaked infrastructure documentation leads to more attacks. Once IT topology data is public, any actor can use it to plan the next intrusion.
- No encryption means fewer warning signs. As with MOVEit, GoAnywhere, Accellion and Cleo, Cl0p stole data and threatened to publish it without encrypting anything. That leaves no ransomware outage to alert defenders.
- Victims' early statements may not tell the whole story. Some named companies said they found no evidence of data theft, and now files have been published under their names. Defenders and regulators should not treat an early "contained" statement as final.
- The full scope is still unknown. Protos Labs notes that the start date of exploitation, how long attackers stayed in systems, and the total number of victims are all unresolved. Organisations that ran exposed Windchill or FlexPLM servers in June and July should assume they may be affected until they have checked.
The Attack Technique
This section covers the wider campaign. Shell and Philips have not confirmed that Windchill was their entry point.
- Timeline:
- Early June 2026: Ransom-ISAC assesses that Cl0p affiliates began exploiting CVE-2026-12569 as a zero-day.
- 17 June: PTC disclosed and patched the flaw (fixed in Windchill and FlexPLM releases at or beyond 11.0 M030, per Tech Insider). VicyTech places the advisory in late June.
- 25 June: CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
- Around 20 July: mass exploitation sped up.
- 22 July: Ransom-ISAC warned of continued attacks on unpatched servers.
- 24 July: ReliaQuest confirmed Cl0p exploitation.
- The vulnerability: CVE-2026-12569 gives an attacker remote code execution on Windchill PDMLink and FlexPLM without logging in. It is rated CVSS 9.3 to 9.8 depending on the advisory.
- Sources disagree on the details:
- Immunity calls it a deserialization flaw, and VicyTech calls it improper input validation.
- Immunity and ExtraHop, citing Ransom-ISAC, say it was chained with a separate pre-authentication information-disclosure bug in a FlexPLM WSDL endpoint. VicyTech says no second bug was needed.
- The implant: a custom JSP web shell built around Windchill's own internals. It runs inside a trusted process under Windchill's database identity. It calls the application's own classes to decrypt the keystore, read the database schema, list the file vault, steal credentials and run code in memory.
- Detection clues (per ExtraHop):
- External reconnaissance.
- Unusual requests to JSP files on the login path.
- A campaign-specific HTTP header.
- Rare access to vault tables.
- Unusually large compressed HTTP responses.
- New flaws: On 20 August, PTC disclosed another RCE (CVE-2026-77645) and an SSRF vulnerability in the same product line, according to ExtraHop.
What Organizations Should Do
- Patch every Windchill and FlexPLM instance and take it off the internet. Apply PTC's fixes for CVE-2026-12569 and for the flaws disclosed on 20 August. Put the servers behind a VPN or zero-trust access instead of exposing them directly.
- Look for web shells now, even on servers that are already patched. Protos Labs recommends doing this within 24 hours. Patching does not remove an implant installed while the server was exposed. Check web roots for unexpected JSP files, especially near login servlets, and review web logs from June onward for the campaign's HTTP header.
- Assume credentials and secrets were exposed. The implant decrypted the Windchill keystore. Rotate keystore secrets, service accounts, database credentials and any integration tokens stored in or used by the PLM system.
- Check for data leaving the network. Look for unusual vault-table queries and unusually large compressed HTTP responses from PLM servers. Compare traffic logs against when the server was exposed to estimate what may have left.
- Review third-party and cloud-hosted services. Shell's incident involved a platform run by a third party. List which external providers host engineering or project data for you, and require them to confirm their patch status and whether they have found signs of compromise.
- Treat leaked engineering and IT documents as live threats. If you are named, assume published infrastructure details will be used against you. Change the configurations they describe, and warn product security teams about any device design weaknesses the leak may reveal.
Sources: Cl0p Published Shell and Philips Data on the Dark Web. Here’s What... | Russische cyberbende Clop publiceert gestolen gegevens van Philips... | Clop Windchill/FlexPLM Mass-Extortion Campaign (CVE-2026-12569) Pr... | Cl0p Exploits PTC Windchill CVE-2026-12569: 43 Victims | Shell Investigates Alleged Data Breach by Cl0p Ransomware Security... | Anatomy of an Attack: Cl0p Ransomware Group and the PTC Windchill C... | Cl0p's PTC Windchill Campaign: Anatomy of a Mass-Extortion Playbook... | Cl0p Ransomware Hits Shell, GE, Philips via PTC Bug