Shell probes data breach after Clop claims 90GB data theft

Oil and gas giant Shell is probing a suspected cyber incident after Clop claimed to have leveraged a critical PTC Windchill/FlexPLM flaw to breach its internal systems and extract nearly 90 GB of data.

 

Recently, the Clop ransomware group added 43 new victims to its data leak site. The victims were reportedly targeted through Internet-exposed PTC Windchill and FlexPLM systems, which were vulnerable to a critical flaw known as CVE-2026-12569.

 

 

PTC Windchill and FlexPLM are product lifecycle management (PLM) platforms that organisations use to manage product data, designs, documents, and development processes. The systems were reportedly targeted through a critical improper input validation vulnerability, tracked as CVE-2026-12569. The flaw can allow attackers to bypass security checks by sending specially crafted input. When these systems are exposed to the Internet, attackers could potentially exploit the vulnerability to gain unauthorised access or execute malicious code.

 

Oil and gas giant Shell was among the organisations named by the Clop ransomware group, which claimed to have exploited the vulnerability to steal approximately 89 GB of data from the company’s systems. The allegedly stolen information includes engineering drawings, scanned facility testing reports, facility photographs, and project plans, potentially exposing sensitive technical, operational, and project-related information.

 

Acknowledging the claims of the extortion group, in a statement shared with BleepingComputer, a Shell spokesperson said, “We are aware of a potential incident. We are working with our security teams and relevant experts to investigate.”

 

PTC began rolling out security patches for CVE-2026-12569 on June 17 to address the critical vulnerability. Although the company did not confirm that the flaw was being actively exploited in the wild, it issued a private security advisory to customers. PTC urged organisations to apply the available updates and carefully review their environments for any indicators of compromise (IOCs) that could suggest unauthorised activity or a potential breach.

 

Simon Phillips, CTO, CybaVerse said that considering Cl0p’s reputation of launching mass attacks, all organisations showing on the leak site must take steps to investigate these claims. They must monitor for unauthorised access and identify if any data has been exfiltrated from their systems.

 

“Any organisation using either PTC Windchill PDMlink or PTC FlexPLM should apply the patches as a priority. However, another key question this raises is around vulnerabilities in software, and customer organisations continuing to face the financial repercussions when they are exploited by attackers.

 

“As an industry, we need to rethink how we evaluate security and vendors, looking beyond individual vulnerabilities and identifying broader trends. Vendors with recurring vulnerabilities in critical components, such as those found in internet-facing infrastructure, should be flagged as high-risk.”