--- title: Cl0p claims a mass hack of Shell, Philips, and dozens more description: Ransomware group Cl0p claims to have stolen data from Shell, Philips, and dozens of other companies, tied by researchers to a zero-day flaw in Oracle's... canonical: https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cl0p claims a mass hack of Shell, Philips, and dozens more | daily.dev og:description: Ransomware group Cl0p claims to have stolen data from Shell, Philips, and dozens of other companies, tied by researchers to a zero-day flaw in Oracle's... og:url: https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm og:image: https://api.daily.dev/og/posts/lrRk0aHPm.png og:image:alt: Cl0p claims a mass hack of Shell, Philips, and dozens more og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cl0p claims a mass hack of Shell, Philips, and dozens more **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary Ransomware group Cl0p claims to have stolen data from Shell, Philips, and dozens of other companies, tied by researchers to a zero-day flaw in Oracle's E-Business Suite. Shell reportedly lost about 89GB of technical drawings and facility data, while Philips lost roughly 13.5GB of diagrams and blueprints. Other named targets include GE and Fiserv. Neither the Oracle link nor the full victim count has been confirmed by the affected companies, and the incident echoes Cl0p's 2023 MOVEit campaign, which exploited a single shared software flaw to breach hundreds of organizations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerability is suspected in the Cl0p attacks on Shell and Philips? Security researchers have tied the campaign to a zero-day vulnerability in Oracle's E-Business Suite, enterprise software widely used for finance, procurement, and operations. Neither Shell nor Philips has confirmed how they were breached, so the Oracle link remains reported by researchers rather than officially verified by the victims. _Security teams tracking enterprise software vulnerabilities can follow breaking developments like this on daily.dev._ ### How much data did Cl0p claim to steal from Shell and Philips? Cl0p claims to have taken roughly 89GB from Shell, including technical drawings, facility images, test report scans, and project plans, and about 13.5GB from Philips, mostly diagrams and blueprints. The group also named GE and Fiserv among close to 50 companies allegedly affected in the same campaign. _Anyone assessing exposure from this breach can follow updates on daily.dev as details emerge._ ### How is Cl0p's extortion tactic different from typical ransomware attacks? Cl0p favors data-theft extortion rather than encrypting files: it quietly steals data, then threatens to publish it on a leak site unless the victim pays. During the 2023 MOVEit mass hack, Cl0p breached hundreds of organizations through a single file-transfer flaw, and when Shell refused to negotiate that time, the group published its data anyway. _Executives weighing ransom negotiation strategy can track how these extortion campaigns unfold on daily.dev._ ## Similar posts on daily.dev - [Clop's Oracle EBS rampage reaches Dartmouth College](https://daily.dev/posts/clop-s-oracle-ebs-rampage-reaches-dartmouth-college-ehzpuuxwk) · The Register · 0 upvotes · 0 comments - [Clop ransomware targets Windchill, FlexPLM in data theft attacks](https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ransomware](https://daily.dev/tags/ransomware), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cl0p claims a mass hack of Shell, Philips, and dozens more","url":"https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm"},"datePublished":"2026-08-14T07:36:13.867Z","dateModified":"2026-08-18T19:21:17.110Z","description":"Ransomware group Cl0p claims to have stolen data from Shell, Philips, and dozens of other companies, tied by researchers to a zero-day flaw in Oracle's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0cdf181734c5c63300616f0444466d77?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0cdf181734c5c63300616f0444466d77?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ransomware,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Cl0p claims a mass hack of Shell, Philips, and dozens more"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cl0p-claims-a-mass-hack-of-shell-philips-and-dozens-more-lrrk0ahpm#faq","mainEntity":[{"@type":"Question","name":"What vulnerability is suspected in the Cl0p attacks on Shell and Philips?","acceptedAnswer":{"@type":"Answer","text":"Security researchers have tied the campaign to a zero-day vulnerability in Oracle's E-Business Suite, enterprise software widely used for finance, procurement, and operations. Neither Shell nor Philips has confirmed how they were breached, so the Oracle link remains reported by researchers rather than officially verified by the victims. Security teams tracking enterprise software vulnerabilities can follow breaking developments like this on daily.dev."}},{"@type":"Question","name":"How much data did Cl0p claim to steal from Shell and Philips?","acceptedAnswer":{"@type":"Answer","text":"Cl0p claims to have taken roughly 89GB from Shell, including technical drawings, facility images, test report scans, and project plans, and about 13.5GB from Philips, mostly diagrams and blueprints. The group also named GE and Fiserv among close to 50 companies allegedly affected in the same campaign. Anyone assessing exposure from this breach can follow updates on daily.dev as details emerge."}},{"@type":"Question","name":"How is Cl0p's extortion tactic different from typical ransomware attacks?","acceptedAnswer":{"@type":"Answer","text":"Cl0p favors data-theft extortion rather than encrypting files: it quietly steals data, then threatens to publish it on a leak site unless the victim pays. During the 2023 MOVEit mass hack, Cl0p breached hundreds of organizations through a single file-transfer flaw, and when Shell refused to negotiate that time, the group published its data anyway. Executives weighing ransom negotiation strategy can track how these extortion campaigns unfold on daily.dev."}}]} ```