Philips and GE Investigating Clop Ransomware Data Theft Claims

Tech giants GE Healthcare and Philips have confirmed they are investigating claims by the Clop ransomware gang that the group breached their systems and exfiltrated sensitive engineering data. The attacks exploit CVE-2026-12569, a critical zero-day deserialization vulnerability in PTC Windchill PDMLink and FlexPLM — product lifecycle management software used heavily in industrial, medical device, and manufacturing sectors.

Clop listed at least 43 victims on its dark web leak site between August 12–15, 2026, naming GE Healthcare, Philips, and Shell among confirmed targets. The campaign mirrors Clop's hallmark mass-exploitation playbook seen in prior campaigns against GoAnywhere MFT, MOVEit Transfer, and Oracle E-Business Suite.

The Vulnerability: CVE-2026-12569

The attack chain chains two flaws: a pre-auth information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) into the 9.8 RCE in Windchill's deserialization path. Clop began exploiting this as a zero-day in early June 2026, more than two weeks before PTC issued any patch.

What Was Stolen

Clop deployed pure data exfiltration — no file encryption was used. This "extortion without the lock" approach avoids disrupting operations while maximizing leverage, as victims must pay to prevent public disclosure of proprietary data.

No patient data has been confirmed as compromised. The stolen material focuses on manufacturing IP, engineering blueprints, and facility operational data — valuable for competitive intelligence and potentially for targeting critical infrastructure.

How Clop Got In

Clop's initial access exploited the Windchill/FlexPLM zero-day to deploy JSP webshells directly onto vulnerable PLM servers. Defenders should hunt for files matching:

• [0-9a-f]{16}.jsp under /Windchill/login/
• [0-9a-f]{6}.jsp in the same directory
• dpr_[0-9a-f]{8}.jsp patterns

Once inside, the group performed quiet data staging and exfiltration without deploying ransomware — consistent with their recent operational shift toward pure extortion to reduce response urgency and avoid triggering endpoint detection.

Timeline

Company Responses

Philips confirmed a "contained cybersecurity compromise" affecting internal enterprise servers. The company stated no customer-facing environments were impacted, but has not disclosed what data was accessed.

GE Healthcare confirmed it is investigating the claims and working with cybersecurity experts. No further details have been provided.

Shell confirmed it is investigating and has engaged third-party incident response support.

Remediation

Organizations running PTC Windchill or FlexPLM should act immediately:

1. Patch — Upgrade to Windchill/FlexPLM 11.0 M030 or later
2. Threat Hunt — Scope your investigation back to early June 2026 regardless of when you received any ransom notice; Clop may have had access weeks before contact
3. Hunt for Webshells — Scan /Windchill/login/ for the JSP patterns listed above
4. Review network logs — Large outbound data transfers from PLM servers are a key indicator
5. Engage IR — If Windchill was internet-exposed before June 17, assume compromise and scope accordingly

Clop's Track Record

The Clop gang (Cl0p) has a consistent pattern of mass-exploiting enterprise software zero-days for bulk data exfiltration:

Each campaign follows the same blueprint: acquire a zero-day, mass-exploit before patch availability, exfiltrate quietly, then extort. The increasing focus on industrial and manufacturing software in recent campaigns reflects a strategic targeting shift toward high-value IP holders.

Key Takeaways

1. Clop exploited CVE-2026-12569 in PTC Windchill as a zero-day for 6+ weeks before patches existed
2. 43+ organizations were compromised including industrial giants Philips, GE, and Shell
3. Engineering IP and blueprints were stolen — no encryption, pure extortion
4. Organizations should assume compromise and hunt from June 1 if running unpatched Windchill
5. CISA has added the CVE to KEV — federal patch deadline has passed; private sector should treat this as equally urgent

References

• BleepingComputer — Philips and GE investigating Clop ransomware data theft claims
• Ransom-ISAC — Cl0p Exploitation of PTC Windchill & FlexPLM
• CISA Known Exploited Vulnerabilities Catalog