--- title: Philips and GE investigating Clop ransomware data theft... description: GE and Philips are investigating claims by the Clop ransomware gang that it breached their systems and stole data, following a similar disclosure from Shell... canonical: https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Philips and GE investigating Clop ransomware data theft claims | daily.dev og:description: GE and Philips are investigating claims by the Clop ransomware gang that it breached their systems and stole data, following a similar disclosure from Shell... og:url: https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r og:image: https://api.daily.dev/og/posts/EmGsNWa7r.png og:image:alt: Philips and GE investigating Clop ransomware data theft claims og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Philips and GE investigating Clop ransomware data theft claims **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary GE and Philips are investigating claims by the Clop ransomware gang that it breached their systems and stole data, following a similar disclosure from Shell days earlier. Philips confirmed a contained attempted compromise of an internal enterprise server with no customer impact, while GE said it is assessing the issue. All three companies appear on Clop's leak site among 43 new victims tied to exploitation of CVE-2026-12569, a critical improper input validation flaw in PTC Windchill and FlexPLM, used by over 30,000 customers globally. PTC released patches starting June 17, and CISA, Germany's BSI, and researchers at ReliaQuest and Ransom-ISAC have confirmed active exploitation involving JSP webshells to steal backups, project plans, and facility data. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerability is Clop ransomware exploiting to attack PTC Windchill and FlexPLM instances? Clop is exploiting CVE-2026-12569, a critical improper input validation vulnerability in Internet-exposed PTC Windchill and FlexPLM instances. Attackers deploy JSP webshells to steal backups, project plans, photos, drawings, and blueprints. PTC began releasing patches on June 17, and CISA confirmed active exploitation, requiring federal agencies to secure instances within three days of the flaw being added to its known exploited vulnerabilities catalog. _Teams patching PTC Windchill or FlexPLM can track exploitation updates for CVE-2026-12569 on daily.dev._ ### Which companies has the Clop ransomware gang listed as victims of the PTC Windchill and FlexPLM attacks? Clop listed 43 new victims tied to the PTC Windchill and FlexPLM exploitation, including GE, Philips, and Shell. Philips confirmed a contained attempted compromise of a specific enterprise server with no customer impact, GE said it is assessing the claim, and Shell confirmed investigating after Clop claimed it stole 89GB of data. _Security teams tracking Clop's expanding victim list follow breach disclosures like this on daily.dev._ ## Similar posts on daily.dev - [Clop ransomware targets Windchill, FlexPLM in data theft attacks](https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m) · BleepingComputer · 1 upvotes · 0 comments - [‘Dozens’ of organizations had data stolen in Oracle-linked hacks](https://daily.dev/posts/dozens-of-organizations-had-data-stolen-in-oracle-linked-hacks-2vk14h6y9) · TechCrunch · 1 upvotes · 0 comments - [NHS confirms investigation into Clop cyberattack claim](https://daily.dev/posts/nhs-confirms-investigation-into-clop-cyberattack-claim-frhi5vxq1) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Philips and GE investigating Clop ransomware data theft claims","url":"https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r"},"datePublished":"2026-08-17T11:27:14.112Z","dateModified":"2026-08-24T07:05:18.795Z","description":"GE and Philips are investigating claims by the Clop ransomware gang that it breached their systems and stole data, following a similar disclosure from Shell...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/489f7dcb8165f07cedbe867850c0c8e5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/489f7dcb8165f07cedbe867850c0c8e5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Philips and GE investigating Clop ransomware data theft claims"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/philips-and-ge-investigating-clop-ransomware-data-theft-claims-emgsnwa7r#faq","mainEntity":[{"@type":"Question","name":"What vulnerability is Clop ransomware exploiting to attack PTC Windchill and FlexPLM instances?","acceptedAnswer":{"@type":"Answer","text":"Clop is exploiting CVE-2026-12569, a critical improper input validation vulnerability in Internet-exposed PTC Windchill and FlexPLM instances. Attackers deploy JSP webshells to steal backups, project plans, photos, drawings, and blueprints. PTC began releasing patches on June 17, and CISA confirmed active exploitation, requiring federal agencies to secure instances within three days of the flaw being added to its known exploited vulnerabilities catalog. Teams patching PTC Windchill or FlexPLM can track exploitation updates for CVE-2026-12569 on daily.dev."}},{"@type":"Question","name":"Which companies has the Clop ransomware gang listed as victims of the PTC Windchill and FlexPLM attacks?","acceptedAnswer":{"@type":"Answer","text":"Clop listed 43 new victims tied to the PTC Windchill and FlexPLM exploitation, including GE, Philips, and Shell. Philips confirmed a contained attempted compromise of a specific enterprise server with no customer impact, GE said it is assessing the claim, and Shell confirmed investigating after Clop claimed it stole 89GB of data. Security teams tracking Clop's expanding victim list follow breach disclosures like this on daily.dev."}}]} ```