[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvRtxDV8JrLXGhYnM8RqmcO00eoerAAUspf_GTMPRsKU":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"89cd8e57-d39a-4ee4-a287-6010e2294e76","Philips and GE investigating Clop ransomware data theft claims","philips-and-ge-investigating-clop-ransomware-data-theft-claims-1982bb","Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data. [...]","GE and Philips are investigating claims by the Clop ransomware gang that they breached systems and stole data. Philips confirmed a breach of an internal server but stated it was contained and did not impact customers. This follows similar claims against Shell. The attacks likely exploit a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software, which Clop claims to have used to steal sensitive data including project plans and blueprints.","Clop ransomware claims data theft from GE, Philips, and Shell, exploiting a PTC software vulnerability.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphilips-and-ge-investigating-clop-ransomware-data-theft-claims\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F17\u002FPhilips-GE.jpg","2026-08-17T11:25:02+00:00","2026-08-17T12:00:07.668509+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Clop","threat_actor",{"name":21,"type":22},"General Electric","vendor",{"name":24,"type":22},"Philips",{"name":26,"type":22},"Shell",{"name":28,"type":29},"PTC Windchill","product",{"name":31,"type":29},"PTC FlexPLM","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-12569","Improper input validation vulnerability exploited by Clop",[21,24,26],{"controls":62,"vendors":149},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":93,"product_name":117,"url":118,"description":119},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":121,"name":122,"problem":123,"products":124},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":169},"clop-ransomware-exploits-unpatched-ptc-software-to-steal-data-from-ge-and-philips","Clop Ransomware Exploits Unpatched PTC Software to Steal Data from GE and Philips","The Clop ransomware gang exploited a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software — third-party platforms used by major industrial and healthcare organizations — to exfiltrate highly sensitive data including project plans and engineering blueprints. This attack highlights the compounding risk of unpatched third-party software in critical industries, where a single vendor vulnerability can cascade across multiple high-value targets simultaneously. Philips confirmed a server breach but claims containment, illustrating that even partial breaches can expose sensitive intellectual property before defenders respond. The pattern mirrors Clop's previous MOVEit and GoAnywhere campaigns, reinforcing that this group systematically weaponizes zero-day or n-day vulnerabilities in widely deployed enterprise software. Organizations that rely on third-party platforms must treat vendor patch cycles as part of their own security posture.",[155,156,157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-9: External Information System Services","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-171 3.14.1: Identify and Correct Information System Flaws","NIST CSF ID.RA-1: Asset Vulnerabilities are Identified and Documented","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ISO 27001 A.12.6.1: Management of Technical Vulnerabilities","ISO 27001 A.15.2.1: Monitoring and Review of Supplier Services","ITIL Change Management: Emergency Change Procedures",{}]