[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fas1ZCcOih82Tv7ywYsJh4MIkc1LIFTiLJmatnbYbjcE":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"510d03e6-4d73-4904-bdb5-e902d9bc3568","Shell investigates 'potential incident' after Clop data theft claims","shell-investigates-potential-incident-after-clop-data-theft-claims-ba32a4","Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data. [...]","Shell is investigating a potential security incident after the Clop ransomware gang claimed to have stolen 89GB of sensitive data, including engineering drawings and facility reports. The alleged theft is linked to attacks exploiting a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software, which has also reportedly impacted General Electric and Philips. Both PTC and CISA have issued warnings and advisories regarding this actively exploited vulnerability.","Shell investigates potential data breach after Clop ransomware claims theft of 89GB of data.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fshell-investigates-potential-incident-after-clop-data-theft-claims\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F14\u002FShell_headpic.jpg","2026-08-14T11:55:45+00:00","2026-08-14T12:00:18.642037+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Clop","threat_actor",{"name":21,"type":22},"PTC Windchill","product",{"name":24,"type":22},"PTC FlexPLM",{"name":26,"type":27},"Shell","vendor",{"name":29,"type":27},"PTC",{"name":31,"type":27},"General Electric","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-12569","Critical vulnerability in PTC Windchill and FlexPLM exploited by Clop",[26,29,31],{"controls":62,"vendors":146},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":122,"name":123,"problem":124,"products":125},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[126,133,138],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":128,"url":131,"description":132},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":134,"product_name":135,"url":136,"description":137},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":162},"clop-exploits-unpatched-plm-software-to-steal-89gb-from-shell","Clop Exploits Unpatched PLM Software to Steal 89GB from Shell","The Clop ransomware gang exploited a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM software — widely used industrial product lifecycle management platforms — to steal 89GB of sensitive data from Shell, including engineering drawings and facility reports. The root cause is a failure to patch a known, actively exploited vulnerability in third-party enterprise software before threat actors could weaponize it. This incident is particularly dangerous because PLM platforms often contain highly sensitive intellectual property and operational technology blueprints. The fact that General Electric and Philips were also impacted underscores how a single unpatched third-party product can become a systemic risk across multiple critical infrastructure organizations. CISA's advisory highlights that timely patch application and vendor coordination are non-negotiable when critical vulnerabilities are disclosed.",[152,153,154,155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST SI-2: Flaw Remediation","NIST SA-9: External Information System Services","NIST SC-7: Boundary Protection","CISA KEV (Known Exploited Vulnerabilities) Catalog","GDPR Article 32: Security of Processing","ITIL Change Management: Emergency Change Procedures",{}]