Philips and GE investigating Clop ransomware data theft claims
Clop ransomware claims data theft from GE, Philips, and Shell, exploiting a PTC software vulnerability.
GE and Philips are investigating claims by the Clop ransomware gang that they breached systems and stole data. Philips confirmed a breach of an internal server but stated it was contained and did not impact customers. This follows similar claims against Shell. The attacks likely exploit a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software, which Clop claims to have used to steal sensitive data including project plans and blueprints.
AI summary of the linked source. Not reviewed by an editor. How this works
Run General Electric?
Get an email when a new story names General Electric, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Clop ransomware gang exploited a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software — third-party platforms used by major industrial and healthcare organizations — to exfiltrate highly sensitive data including project plans and engineering blueprints. This attack highlights the compounding risk of unpatched third-party software in critical industries, where a single vendor vulnerability can cascade across multiple high-value targets simultaneously. Philips confirmed a server breach but claims containment, illustrating that even partial breaches can expose sensitive intellectual property before defenders respond. The pattern mirrors Clop's previous MOVEit and GoAnywhere campaigns, reinforcing that this group systematically weaponizes zero-day or n-day vulnerabilities in widely deployed enterprise software. Organizations that rely on third-party platforms must treat vendor patch cycles as part of their own security posture.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-12569