Shell investigates 'potential incident' after Clop data theft claims

The Clop ransomware gang exploited a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software — widely used industrial product lifecycle management platforms — to steal 89GB of sensitive data from Shell, including engineering drawings and facility reports. The root cause is a failure to patch a known, actively exploited vulnerability in third-party enterprise software before threat actors could weaponize it. This incident is particularly dangerous because PLM platforms often contain highly sensitive intellectual property and operational technology blueprints. The fact that General Electric and Philips were also impacted underscores how a single unpatched third-party product can become a systemic risk across multiple critical infrastructure organizations. CISA's advisory highlights that timely patch application and vendor coordination are non-negotiable when critical vulnerabilities are disclosed.