Cl0p lists Philips among nearly 50 victims of its PTC Windchill campaign

MedDevice Cyber Staff · 4 days ago · 3 min read · Via Philips security advisories page

Cl0p attached company names to nearly 50 masked entries on its leak site on August 12, and Philips is one of them. Shell, Fiserv and GE appear on the same list. Reuters reported the claims on August 13, and Philips said it "identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data," with customer environments unaffected. The group reached its victims through CVE-2026-12569, a flaw in PTC Windchill PDMLink and FlexPLM, the product lifecycle management software used across engineering and manufacturing.

The flaw is deserialization of untrusted data, CWE-502, scored 9.8 on CVSS v3.1 and 9.3 on v4, and exploitation needs no credentials. Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, then drop JSP web shells for persistence. The published hunt pattern is a sixteen character hex filename ending in .jsp under the /Windchill/login/ path.

PTC shipped fixed releases on June 17. First in the wild exploitation was observed the next day. CISA added the CVE to its Known Exploited Vulnerabilities catalog on June 25, and PTC warned of heightened threat activity on June 26. From July 19, companies began receiving extortion emails referencing a "Windchill PDMLink module serious data leak." Masked leak site entries followed on August 5, names on August 12.

For a device manufacturer the target choice is the point. A PLM system holds CAD models, change orders, supplier records, and the engineering documentation behind regulatory submissions, so a single server can expose the technical file for an entire portfolio. ReliaQuest lists medtech among the sectors hit. Researchers counted roughly 80 Windchill instances reachable from the internet in July, 80 percent of them in the United States.

Cl0p ran the same play against MOVEit file transfer servers in 2023 and Oracle E-Business Suite last year: find one flaw in a widely deployed enterprise application, exploit it quietly at scale, then extort everyone at once. Brandon Parsons of Ascent Solutions describes the group as "professional data extortionists" who pick the vulnerability first and discover their victims afterward. None of the claims have been independently verified.

Philips describes the good case, a single contained server that stayed isolated. The harder question lands on every manufacturer that ran Windchill through June and July, because the patch date and the first exploitation date are one day apart, and patching does not evict a web shell that is already in place. Treat the PLM like the regulated system it feeds: patch on disclosure, keep it off the open internet, and run the review as incident response rather than routine maintenance.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Patch Windchill PDMLink and FlexPLM to the fixed releases PTC shipped on June 17, 2026, then hunt: this flaw was exploited from June 18, so a server patched later may already carry a web shell. Any instance that was reachable from the internet while unpatched should be treated as a suspected compromise and reviewed against the published indicators, not just updated.

Apply the fixed releases. PTC shipped fixes for CVE-2026-12569 across supported Windchill PDMLink and FlexPLM lines on June 17, 2026. Patching closes the door but does not evict an intruder already inside.
Hunt for web shells. Search /Windchill/login/ for sixteen character hex .jsp files, review logs back to early June, and block the published C2 addresses.
Remove direct internet exposure. Researchers counted roughly 80 reachable instances in July. Put the PLM behind VPN access with SSO and MFA; it has no business facing the open internet.
Contain the blast radius by design. Segment PLM from general enterprise IT, run service accounts at least privilege, and restrict egress so a staged archive cannot leave quietly.

For Device ManufacturersFix the class in the product

The product turns untrusted bytes into objects without constraint. As the maker, stop deserializing untrusted data into arbitrary types: move to a schema-validated format across trust boundaries, and set any framework type filter to its most restrictive value.

Allow-list types. Validate structure and allow-list expected types before constructing anything.
Restrict the framework. On .NET Remoting set TypeFilterLevel to Low, or replace remoting with an authenticated schema-checked API.
Block the endpoint. Firewall the deserialization port so untrusted hosts cannot reach it.

Mapped EMB3D mitigations

Questions & Answers

Did Cl0p breach Philips in the PTC Windchill campaign?

Philips appeared on Cl0p's leak site on August 12, 2026 among nearly 50 named companies. Philips says it identified and contained an attempted compromise of a specific enterprise server related to internal data, and that customer environments are not affected. The claims have not been independently verified.

What is CVE-2026-12569 in PTC Windchill and FlexPLM?

It is a deserialization of untrusted data flaw, CWE-502, allowing unauthenticated remote code execution on Windchill PDMLink and FlexPLM servers. It scores 9.8 on CVSS v3.1 and 9.3 on v4. PTC shipped fixes on June 17, 2026, exploitation began June 18, and CISA added it to the Known Exploited Vulnerabilities catalog on June 25.

How many companies did Cl0p claim from the Windchill data theft campaign?

Nearly 50 companies were named on the leak site on August 12, 2026, including Philips, Shell, Fiserv and GE, after masked entries appeared on August 5. Extortion emails referencing a Windchill PDMLink data leak reached companies from July 19.

← Back to Threat Intel