Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs

Cybersecuritynews •Tushar Subhra Dutta • July 24, 2026

Cl0p ransomware affiliates are exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data. The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment. The activity places manufacturers, automotive firms, aerospace organizations, and retail apparel companies at particular risk because Windchill […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Clop Ransomware Exploits Critical Vulnerability in Windchill and FlexPLM The Clop ransomware gang is actively exploiting a critical vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems, allowing unauthenticated remote code execution. This exploitation involves deploying JSP webshells for data exfiltration, targeting sectors such as Manufacturing, Automotive, Aerospace, and Retail/Apparel. The vulnerability was disclosed on June 18, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on June 25, 2026. Companies have begun receiving extortion emails from the Clop gang, demanding ransom for stolen data. PTC has released security patches, but unpatched systems remain at risk. The attacks were confirmed by Ransom-ISAC, which is monitoring the situation closely. 28 sources 73

Extracted Entities

Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs

The full story

Extracted Entities

Attack Types (1)

Industries (3)

MITRE ATT&CK (3)

Platforms (2)

Ransomware Groups (1)