Cl0p Claims Mass Data Theft From Nearly 50 Companies, Including Shell, Philips, Fiserv and GE

What Cl0p Claims It Stole From Shell, Philips, Fiserv and GE

The ransomware and data-extortion group known as Cl0p has posted a claim that it stole large volumes of data from nearly 50 companies worldwide, naming Philips, Shell, Fiserv and GE among the affected organisations. The claim appeared on the group's website and has not been independently verified: Reuters said it could not confirm the type or amount of data allegedly taken, and the hackers did not respond to a request for comment.

Responses from the named companies differ. Philips said it identified and blocked an attempted compromise of a business server linked to internal data and said the incident did not affect customer environments. Shell said it is aware of a recent “possible incident” and is working with security teams and relevant specialists to investigate. Fiserv said its comprehensive review to date found no evidence of compromised customer, bank, transaction or personal data, and no impact on its operating environment. GE said it had activated cyber incident response protocols and was assessing a possible issue.

The suspected technical route is still not confirmed. On 22 July, Ransom-ISAC issued a warning that the group was exploiting vulnerabilities in PTC Windchill and FlexPLM, software used to support engineering and manufacturing processes. PTC, based in Boston, has published security advisories since 18 June urging users to install a patch for a vulnerability and detailing an unnamed attacker targeting its products.

Brandon Parsons, manager of cyber threat intelligence at Ascent Solutions and author of the Ransom-ISAC warning, said some companies began receiving notifications from Cl0p on 19 or 20 July. He described the group as “professional data extortionists” that focus on a specific zero-day vulnerability rather than a specific company, then exploit it across many targets. In this context, zero-day refers to previously unknown software flaws for which manufacturers had not yet released patches.

Why the PTC Windchill and FlexPLM Flaws Turned One Vulnerability Into a Global Campaign

Cl0p's Operating Pattern: Zero-Days Over Targets

Parsons' assessment points to a structural shift in how extortion groups operate. Instead of selecting a company and working to breach it, Cl0p appears to identify a vulnerable software product, develop or acquire an exploit, and then scan for every exposed customer. That explains why one claim can span nearly 50 organisations across unrelated sectors.

This is interpretation rather than confirmed fact: the link between Cl0p and the PTC Windchill/FlexPLM vulnerabilities comes from a Ransom-ISAC warning and PTC advisories, but the named companies have not confirmed that these specific flaws were the entry point.

Four Companies, Four Different Levels of Confirmation

The public responses reveal different stages of investigation. Philips used the strongest language, saying it identified and stopped an attempted compromise of a specific business server. Shell acknowledged a possible incident without confirming a breach. Fiserv said it found no evidence of compromise after a “comprehensive review”, while GE said it had activated incident-response protocols and was still assessing. For outsiders, that creates a wide range of possible outcomes: from a blocked intrusion at Philips to a more serious, still-unfolding investigation at GE.

Why PTC Windchill and FlexPLM Matter

Windchill and FlexPLM are not consumer apps; they support engineering, product lifecycle and manufacturing workflows. If such systems are compromised, the most sensitive data is often proprietary design, production and supply-chain information rather than payment cards. That is why the commercial and competitive stakes could be higher than in a typical customer-data breach, even though no company has confirmed what may have been taken.

What Security Teams Should Do After a Cl0p Notification

For security teams at companies running PTC Windchill or FlexPLM, the immediate steps are specific because the timeline and tooling are already public.

• Confirm patch status against PTC's advisories. PTC has issued security warnings since 18 June asking users to install a patch for a vulnerability under active attack; if your instance still runs an unpatched version, prioritise the update before further scanning.
• Look for Cl0p notification timing. Parsons reported that some companies began receiving Cl0p communications on 19 or 20 July. If your organisation received contact around that window, treat it as a live extortion matter and preserve the message, sender details and any claimed data samples.
• Review Windchill and FlexPLM logs for anomalous access. Because Ransom-ISAC linked the campaign to these two products on 22 July, check for unexplained administrative or file-export activity in engineering and manufacturing environments, not only in customer-facing systems.
• Do not assume a denial from another company protects your data. Fiserv found no evidence of compromise, while Philips described a blocked attempt on internal data; those outcomes are company-specific and do not validate other Cl0p victims.