Clop steals engineering data from Shell, GE and Philips through PTC Windchill

August 14, 2026. Shell confirmed it is investigating a security incident after the Clop ransomware gang claimed it stole 89GB of data. Back on June 17, 2026, PTC had already shipped a fix for CVE-2026-12569, a critical remote-code-execution flaw in Windchill and FlexPLM. In between, the campaign racked up roughly 50 claimed victims, including General Electric and Philips.

The lesson is blunt for industrial companies: your PLM — the system that centralizes drawings, bills of materials and product lifecycles — is now a double-extortion target on the same footing as a mail server. And Clop has been farming this category for three years.

A critical flaw, a June patch — and a campaign that followed

CVE-2026-12569 is a critical remote code execution vulnerability caused by the deserialization of untrusted data, affecting PTC Windchill PDMLink and PTC FlexPLM. PTC began releasing patches on June 17, 2026, alongside a private advisory (reference CS473270) urging customers to hunt for indicators of compromise.

The official timeline shows how well-founded the urgency was:

• June 25, 2026: CISA adds the flaw to its KEV catalog and orders federal agencies to secure their instances within three days;
• June 26, 2026: PTC warns customers of “heightened threat activity”;
• Germany’s BSI (the Federal Office for Information Security) warns its own customers in the middle of the night, so severe was the assessed risk;
• August 2026: Clop publishes a fresh batch of victims on its leak site — 43 at once — including Shell, GE and Philips.

Both Ransom‑ISAC and ReliaQuest confirmed the campaign: attackers drop JSP webshells into Windchill’s login directory, giving them command-level access to a server sitting at the heart of the engineering network.

Why PLM is a prime target

Windchill and FlexPLM sit in the PLM (Product Lifecycle Management) category: they drive the design, bill of materials, quality and supply chain of a product, from drawing to manufacturing. PTC claims more than 30,000 customers worldwide, including over 1,500 brand and retail customers on FlexPLM alone.

That is exactly the content Clop is claiming. For Shell, the gang lists engineering drawings, scans of facility testing reports, photos of facilities and project plans. For GE and Philips, it cites backups, system files, drawings and diagrams.

Two factors make these instances easy to find. First, Windchill and FlexPLM are often internet-exposed to allow data synchronization with supply-chain partners. Second, the exploitation chain is documented: a pre-auth information disclosure through the FlexPLM WSDL, combined with a flaw in the Windchill login servlet, leads to unauthenticated remote code execution.

The result: an attacker with no credentials gets a shell on the machine holding the company’s most sensitive intellectual property.

The Clop playbook, again

This campaign is a straight continuation of Clop’s modus operandi since 2023: exploit a zero-day in a widely deployed file-transfer or file-management product, wait for victims to expose themselves, then run double extortion — steal the data and threaten to publish it rather than encrypt systems.

The gang has worked through GoAnywhere MFT and MOVEit Transfer in 2023, then Cleo in late 2024. The change here is the target: not a file-transfer tool but a PLM system — the design repository itself. For a manufacturer, a leaked production drawing is often worth more than a leaked employee directory.

The gang’s genealogy is telling. Clop made its name in December 2020 by exploiting Accellion FTA, an enterprise file-transfer product, then moved to GoAnywhere MFT in January 2023 and MOVEit Transfer in May 2023 — a campaign that hit thousands of organizations and their downstream customers. The pivot to Cleo in late 2024 confirmed the pattern. Every episode follows the same script: a zero-day, a quiet wave of victims, then a mass publication on the leak site.

What makes this campaign different is the nature of the data. A file-transfer tool stores exchanges — often sensitive, but scattered. A PLM stores the design: part geometry, bills of materials, test procedures, manufacturing tolerances. That is exactly what a competitor or a state wants to read, and what a company cannot regenerate. Double extortion works at full force here: even without encrypting systems, the threat of publishing production plans is enough to apply pressure.

One detail matters: this is the second critical Windchill flaw in three months. The cadence of vulnerabilities on this product is accelerating, and Clop has shown it watches that calendar closely. For manufacturers covered by NIS2 or the US CIRCIA, a compromise of this kind also triggers notification obligations — and often the duty to inform supply-chain partners whose data flowed through the platform.

Check your instances now

If your organization runs Windchill or FlexPLM, the priority is to confirm exposure and hunt for webshells. Two simple checks:

# 1. Find JSP files dropped recently in the Windchill tree
find /opt/ptc/Windchill -name '*.jsp' -mtime -60 -printf '%TY-%Tm-%Td %p\n' 2>/dev/null

# 2. Confirm the installed version (the fix is branch-specific)
grep -R "wt.version" /opt/ptc/Windchill/version.properties 2>/dev/null

JSP webshells typically land in the login directory (codebase). Any recent .jsp file you cannot account for is an alarm bell. The fix must be applied on the exact branch of your deployment — PTC ships updates per version, not as a single patch.

Start with exposure discovery, not patching. Query Shodan or Censys for your public footprint: any Windchill or FlexPLM instance answering on the open internet is a live target. Then patch the exact branch you run — a generic “latest” upgrade may not match your deployment.

Beyond patching, three measures cut the structural exposure:

• Take Windchill/FlexPLM off the internet. If external synchronization is essential, route it through VPN access or an authentication gateway, never direct exposure.
• Segment the engineering network. A PLM server has no business being reachable from the office network, let alone from outside.
• Watch egress. Webshells exfiltrate over HTTP/HTTPS: abnormal outbound volume from a PLM server is the most reliable symptom of an active compromise.

Verdict

A fix for CVE-2026-12569 has existed since June 17, 2026. Most victims claimed in August are organizations that did not remediate an exposed instance in time — or did not know it was exposed.

If you run Windchill or FlexPLM, the first action is not to patch: it is to find out whether the instance is reachable from the internet, then hunt for webshells. Patch next, then close the exposure.

If you use these products through a third party — supplier, partner, customer — ask your counterparties to confirm their version and exposure. A compromised PLM at a partner is a door into your shared design data.

If you do not run PTC, take the method seriously: Clop has shifted its targeting from transfer tools to design repositories. The next target of this kind will be another widely exposed niche product. An inventory of your exposed services is now worth more than any single patch.

References

• BleepingComputer — Shell investigates potential incident after Clop data theft claims, August 14, 2026
• BleepingComputer — Clop ransomware targets Windchill, FlexPLM in data theft attacks
• NVD — CVE-2026-12569
• PTC Trust Center — Remote Code Execution Vulnerability in Windchill/FlexPLM
• Ransom‑ISAC — Cl0p Exploitation of PTC Windchill & FlexPLM
• CISA — Known Exploited Vulnerabilities Catalog