Published on 17 August 2026
The extortion group Cl0p staged a major appearance on 13 August 2026: according to its own claims, it stole large volumes of data from almost 50 companies worldwide – including well-known names such as Philips, Shell, Fiserv and GE. That's according to a report by the news agency Reuters. But before the headline triggers panic, an important qualification is needed: Reuters was unable to independently confirm either the nature or the scope of the allegedly stolen data. The figure "almost 50" is, for now, a claim made by the attackers – not a confirmed damage report.
Even so, a closer look is worthwhile, because behind the news lies a tangible, technically documented problem: a critical security vulnerability in a widely used industrial software that is demonstrably being actively exploited. For companies using this software, there is an urgent need to act. For everyone else, it's a reason to review their own supply chain.
Cl0p is a notorious ransomware and extortion group. Its approach is typical: it doesn't randomly attack individual companies, but instead seeks out a specific, often still unknown vulnerability (a so-called zero-day, that is, a flaw for which there is no protection available at the time of the attack) and then targets all companies that have this vulnerability. Brandon Parsons of Ascent Solutions / Ransom-ISAC described it to Reuters as follows:
„They don’t really target a specific company, they target a specific zero day vulnerability and go after it.“ – loosely translated: They don't aim at a specific company, but at a specific zero-day vulnerability, and then go after it.
The affected companies have responded very differently. Philips confirmed a contained attempted attack:
„Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data.“ (Reuters)
Philips emphasised that customer environments were not affected. Shell spoke more cautiously of a "possible incident" that it was investigating. Fiserv, after its own review, found no evidence of compromised customer, banking, transaction or personal data. GE has activated its response protocols and is assessing the claim. In other words: no company has confirmed a complete data breach in the form claimed by Cl0p.
The technical background, by contrast, is solid. At the centre is the security vulnerability CVE-2026-12569 (CVE is a globally unique identifier for a known vulnerability) in the products PTC Windchill PDMLink and PTC FlexPLM. These are so-called PLM systems (Product Lifecycle Management) that large industrial companies use to manage their engineering, development and product data – from CAD drawings to bills of materials.
The vulnerability is critical. According to the US vulnerability database NVD, it is a remote code execution vulnerability (RCE) – meaning an attacker can execute arbitrary malicious code on the server remotely. The technical assessment is alarming: the attack is possible over the network, without credentials and without a user having to click on anything. The severity is rated CVSS 9.3 out of 10 (CVSS is a standardised score for assessing the dangerousness of a vulnerability). The cause is an insecure "deserialisation of untrusted data" – simply put: the system trusts data from the internet too uncritically and can thereby be tricked into executing code.
The US security agency CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue on 25 June 2026 and explicitly noted that it is known to be used in ransomware campaigns. This puts it beyond doubt: this vulnerability is being attacked in the real world – it is not a theoretical threat.
PTC describes the typical attack sequence in detail: the attackers deploy so-called web shells – small hidden scripts (JSP files) through which they can execute commands persistently on the server. These end up in the Windchill login directory. Subsequently, files are listed (indicator: a file named flst.txt), engineering and design data is gathered, and finally exfiltrated for the purpose of extortion.
Important for context: while PTC precisely names the technical sequence, attribution to a specific perpetrator remains cautious. The security firm ReliaQuest told SecurityWeek: „The actor behind these attacks remains unconfirmed.“ – the actor behind the attacks is unconfirmed. That the vulnerability is being exploited is established. That every incident traces back to Cl0p, and that data actually leaked from the companies named, is not yet proven.
Here is the most important reassurance up front: This is not a WordPress, CMS or general website problem. If you run a normal corporate website and do not use PTC Windchill or FlexPLM, you are not directly technically affected by CVE-2026-12569.
Directly at risk are:
You may be indirectly affected as an SME if an external development, engineering or IT service provider uses this software and processes your data there – for example engineering documents, supplier data or personal data of your employees and customers.
/Windchill/login/*.jsp, especially for suspiciously named JSP files (16- or 6-character hex names, patterns such as dpr_...jsp). PTC makes it clear: legitimate Windchill traffic does not POST to this path.55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c (a digital fingerprint of a known malicious file).flst.txt in the working directory, for the header X-windchill-req and for unusually large POST responses from JSP files.PTC is unequivocal: „Customers should immediately scan their environments for the new Indicators of Compromise (IOCs).“ For affected instances, emergency priority applies.
5.180.41.35 at the perimeter, alert or block the header X-windchill-req and monitor JSP POSTs.Note: This is a journalistic assessment, not legal advice. Specific incidents should be evaluated with your data protection officer and, where applicable, qualified legal counsel.
Not every technical vulnerability is automatically a GDPR case. Pure engineering data without any personal reference does not trigger a reporting obligation. But as soon as personal data is affected – for example employee, customer, supplier or contact data – Art. 33 GDPR applies: the controller must report the breach without undue delay, and where feasible within 72 hours of becoming aware of it, to the competent supervisory authority, provided there is a risk to the rights and freedoms of natural persons. The report must include the nature of the incident, the categories of data affected, the approximate number of those affected, the likely consequences and the measures taken. Where a high risk is likely, the affected individuals themselves must also be notified (Art. 34 GDPR).
Particularly relevant is Art. 32 GDPR: it requires technical and organisational measures appropriate to the risk. A lack of patch and vulnerability management, or unassessed indicators of compromise, can therefore become relevant from a supervisory standpoint even independently of a specific data theft. The fine framework under Art. 83 GDPR provides for up to 10 million euros or 2 % of worldwide annual turnover for violations of Art. 32 – whichever amount is higher. As a German comparison case, the BfDI originally imposed 9.55 million euros on 1&1 Telecom in 2019 for inadequate measures under Art. 32. However, this is no benchmark for other cases and says nothing about its subsequent legal standing in court.
For operators of unpatched, internet-exposed Windchill or FlexPLM instances, the urgency is high: unauthenticated remote code execution, active exploitation according to CISA, documented exfiltration indicators and available patches – this combination does not permit a routine patch cycle. Since PTC recommends continuing the search for new web shell names, checking for known file names alone is not sufficient.
Part of the necessary sobriety is: there is no publicly verified figure for internet-exposed or actually compromised instances. Cl0p's claim of "almost 50" companies is unconfirmed; BleepingComputer later reported 43 listed new victims – that too is not an independent compromise tally.
For SMEs without this software, there is no immediate technical risk from this particular vulnerability. The overall picture nonetheless remains serious: the BSI describes ransomware as a mass business that increasingly hits SMEs, and notes that attackers choose the most easily attackable targets. Of the 3.1 million SMEs in Germany – 99.4 % of all commercial enterprises – many small and micro businesses, according to the BSI, do not have their own staff for IT security. The pattern is not new: in 2023, Cl0p already exploited the MOVEit vulnerability CVE-2023-34362 to exfiltrate data from numerous organisations via a web shell.
The spectacular headline about Philips, Shell and co. should not distract from the actual message: there is a critically exploited, real vulnerability in PTC Windchill and FlexPLM for which patches are available. Anyone running this software must act now – check the version, patch, search for indicators, reduce exposure. Anyone not running it should use the occasion to critically scrutinise their supply chain and service provider relationships: where does your data reside outside your organisation, and how well is it protected there?
Cl0p's specific victim numbers are unconfirmed – the danger posed by the underlying vulnerability is not. Act accordingly.