Shell investigates a “possible incident” after Clop claims theft of 89 GB of data

The UK's Shell — one of the three largest oil and gas companies in the world, alongside Chevron and ExxonMobil — has confirmed that it is investigating a possible information security incident. The trigger was a claim by the ransomware group Clop, which announced on its dark web site that it had stolen 89 GB of the company's data.

“We are aware of a possible incident. We are working with our security teams and relevant experts to carry out an investigation,” a Shell spokesperson told BleepingComputer. The company has not disclosed any further details so far.

According to the attackers, the stolen files include engineering drawings, scans of facility test reports, photographs of plants and project plans. Shell employs around 85,000 people in more than 70 countries, and its network of fuel and charging stations serves over 20 million customers every day.

A vulnerability in PTC's PLM platforms

Shell turned out to be just one of 43 new victims on Clop's list. All of them, by all appearances, were targeted in attacks on internet-facing instances of PTC Windchill and FlexPLM. The attackers exploited a critical improper input validation vulnerability assigned the identifier CVE-2026-12569. As part of the same campaign, Clop claimed to have stolen backups, system files, projects, drawings and schematics from the technology conglomerates General Electric and Philips.

PTC began releasing patches for CVE-2026-12569 on June 17 and, although it did not confirm any instances of exploitation in real-world attacks, it sent customers a private warning urging them to check their environments for signs of compromise. After the company reported “heightened threat activity” on June 26, the US agency CISA confirmed active exploitation of the vulnerability, added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to protect their systems within three days. Germany's BSI raised the alarm in the middle of the night, demanding that PTC customers install the updates as soon as possible.

The attacks were also confirmed by specialists at Ransom-ISAC, as well as by the firm ReliaQuest, according to which the attackers deployed JSP web shells to steal data from the compromised PLM platforms. Experts have recommended installing the updates, moving systems behind a VPN or trusted gateways where possible, and — if compromise is suspected — isolating the servers, collecting forensic artifacts and changing compromised credentials.

PTC Windchill and FlexPLM belong to the class of product lifecycle management (PLM) systems and are used in the aerospace, defense and automotive industries, heavy machinery, retail and medtech. According to PTC, its products are used by more than 30,000 customers worldwide.

Source: Bleeping Computer