Cl0p — PTC Windchill campaign

On August 12, 2026, Cl0p claimed to have stolen large volumes of data from close to fifty organizations, including Shell, Philips, General Electric, and Fiserv. The campaign has been linked to vulnerabilities in PTC Windchill and FlexPLM, product lifecycle management software widely deployed across manufacturing and engineering.

The flaw tracked as CVE-2026-12569 is a critical unsafe deserialization vulnerability rated 9.3. Reporting describes attackers chaining a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a separate flaw in the Windchill login servlet to achieve unauthenticated remote code execution. Philips has confirmed an attempted compromise. Fiserv reports no evidence that customer or banking data was affected. Other claims remain unverified.

Claimed volumes: roughly 89 GB from Shell, described as technical drawings, facility images, and project plans. Approximately 13.5 GB from Philips, mostly diagrams and blueprints. Around 391 GB from General Electric covering software backups, system files, and project data.

Notice what is absent. No Social Security numbers. No customer records. No payment data. For most of what is claimed here, there is no notification obligation at all.

PLM systems hold the engineering record: how a refinery is laid out, how a medical device is constructed, what the tolerances and materials are, and every revision of that design over the product's life.

The harmed party is primarily the company itself, and that makes this incident type easy to under-prioritise in a security programme organised around personal data.

Loss of design data is loss of the asset the business exists to own. It compresses a competitor's development timeline, it undermines patent and trade secret positions, and unlike a stolen credential it cannot be rotated. Facility images and project plans for an energy company describe physical infrastructure — a different category again, closer to a targeting package than to a commercial secret.

For a medical device manufacturer, design and manufacturing records also carry regulatory weight, since the device's approved configuration is documented in exactly this material.

Every organisation on this list runs a mature security programme, and several are among the most heavily regulated enterprises in the world. Their identity controls, endpoint tooling, and network monitoring were almost certainly functioning.

A pre-authentication remote code execution chain in an internet-reachable enterprise application does not require any of those controls to fail. There is no phished credential, no lateral movement from a workstation, no malware on an endpoint. Cl0p's operating model for several years has been precisely this: find one vulnerability in one widely deployed enterprise product and harvest dozens of victims simultaneously.

The defensive assumption that breaks is that PLM is an engineering system rather than a crown-jewel datastore, and is therefore an application to patch rather than a repository to inventory.

Data governance programmes are built around personal data because regulators built the incentives that way. The result is that most large enterprises can tell you where customer records live and cannot tell you where their most valuable intellectual property lives.

PLM repositories are among the worst offenders. They accumulate for decades, hold every revision of every design, integrate with CAD systems and supplier portals, and are administered by engineering rather than IT. Supplier access is the part that is rarely mapped at all — external partners are granted access to specific projects, and the resulting permission sprawl is documented nowhere central.

When a claim like this lands, the question is not only what was taken but what was in there to take. For a thirty-year-old PLM instance, that answer does not exist in advance.

The absence of personal data does not mean the absence of obligation, it means the obligations come from elsewhere. Publicly traded companies face SEC materiality assessment and four-business-day disclosure once materiality is determined — and valuing the loss of design data is considerably harder than counting affected individuals.

Defence and dual-use engineering data engages export control regimes. Medical device design records engage regulators in every market where the device is approved. Contractual obligations to customers and joint-venture partners whose data sits in shared project folders run in parallel, and those partners will each want a specific answer about their own material.

Fiserv's statement is the model response: a specific, bounded denial about a named data category. Making that statement safely requires knowing what was in the system.