General Electric (GE) and Philips are investigating claims by the Clop ransomware group that their systems were breached and data was stolen. While GE stated it is assessing the potential issue, Philips confirmed an attempted cybersecurity compromise of a specific internal enterprise server, which it has since contained. Philips clarified that this incident did not impact customer environments.
The Clop group has listed GE, Philips, and oil giant Shell on its leak site as part of a new batch of 43 alleged victims. The group claims to have exploited a critical improper input validation vulnerability, tracked as CVE-2026-12569, affecting internet-exposed instances of PTC Windchill and PTC FlexPLM. These enterprise software platforms are widely used across various sectors, including aerospace, defense, automotive, retail, and medtech, by over 30,000 customers globally.
Clop asserts that it exfiltrated a range of sensitive data from the compromised systems of Shell, GE, and Philips, including backups, project plans, facility photos, drawings, diagrams, and blueprints.
PTC initiated the release of security patches for CVE-2026-12569 on June 17 and advised customers to scrutinize their environments for indicators of compromise. Although initial reports did not confirm in-the-wild exploitation, cybersecurity firm ReliaQuest and the Ransomware Information Sharing and Analysis Centre (Ransom-ISAC) have since corroborated Clop's attacks on Windchill and FlexPLM. Threat actors in these incidents are reportedly deploying JSP webshells to steal sensitive data from affected Product Lifecycle Management (PLM) platforms.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of the flaw after PTC issued a warning of "heightened threat activity" on June 26. CISA subsequently added CVE-2026-12569 to its catalog of known exploited vulnerabilities, mandating federal agencies to secure their PTC Windchill and FlexPLM instances within three days. German authorities, specifically the Federal Office for Information Security (BSI), also issued an urgent advisory to PTC customers to patch their systems promptly.
The Clop extortion group has a history of targeting enterprise platforms for data theft. Previous campaigns have exploited vulnerabilities in Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers, with the latter impacting over 2,770 organizations worldwide. Beginning in August 2025, the group also exploited an Oracle EBS zero-day flaw to steal sensitive files from numerous organizations, including The Washington Post, Harvard University, Logitech, and Korean Air. The U.S. Department of State offers a $10 million reward for information linking the group's attacks to a foreign government.
