Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
Cl0p ransomware group names over 40 victims of a campaign exploiting PTC Windchill vulnerability.
The Cl0p ransomware group has publicly named over 40 organizations as victims of a campaign exploiting a vulnerability in PTC's Windchill and FlexPLM platforms. The attackers used a custom implant to steal sensitive data, including project files, blueprints, and corporate documents, ranging from 1GB to several terabytes per victim. This campaign follows Cl0p's previous data theft operations targeting other software vulnerabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run PTC?
Get an email when a new story names PTC, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Cl0p ransomware group successfully exploited a known vulnerability in PTC's Windchill and FlexPLM platforms, compromising over 40 organizations and exfiltrating highly sensitive engineering and corporate data. The root cause lies in organizations failing to patch enterprise software in a timely manner, leaving internet-facing platforms exposed to well-resourced threat actors. This campaign mirrors Cl0p's previous MOVEit and GoAnywhere operations, demonstrating a repeating pattern of targeting widely-used enterprise software with unpatched vulnerabilities. The theft of blueprints, project files, and proprietary documents represents severe intellectual property loss with long-term competitive and national security implications.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-12569