Russian-speaking cybercrime group Cl0p has claimed to have stolen large volumes of data from nearly 50 companies worldwide, including Shell, Philips, Fiserv and General Electric (GE). The affected companies have acknowledged the claims or confirmed they are investigating potential security incidents, but the extent of any data theft has not been independently verified.

Cl0p, which is known for exploiting vulnerabilities in widely used enterprise software to target multiple organizations simultaneously, published a list of companies it claims were affected by the latest campaign.

The group alleged it had stolen about 89 gigabytes of data from Shell and 13.5 gigabytes from Philips. It claimed the Shell files include engineering drawings, facility photographs, technical reports and project plans, while the Philips data allegedly contains technical drawings, schematics and design documents. However, the group has not released any sample files to support its claims.

Companies investigate alleged breach

Shell said it is aware of a potential cybersecurity incident and is investigating the matter with its internal security teams and external specialists.

Philips said it detected and contained an attempted cyber intrusion involving a specific corporate server, adding that customer environments were not affected.

Fiserv said it is aware of Cl0p's claims but that its investigation has found no evidence that customer data, banking information, personal data or company operations were compromised.

General Electric also said it is aware of the allegations and has activated its cyber incident response procedures to assess any potential impact.

Attack may be linked to software vulnerabilities

Cybersecurity experts believe the attackers may have exploited vulnerabilities in enterprise software used by multiple organizations rather than targeting individual companies directly.

Ransom-ISAC issued a warning on July 22 that Cl0p was exploiting security flaws in PTC Windchill and FlexPLM, software widely used in engineering, manufacturing and product lifecycle management.

PTC had previously issued security advisories urging customers to apply software updates. Threat intelligence expert Brandon Parsons said some companies began receiving notifications from Cl0p on July 19 and 20, suggesting the group targeted software vulnerabilities rather than specific organizations.

Data theft and extortion strategy

Unlike traditional ransomware groups that encrypt victims' systems, Cl0p primarily focuses on stealing sensitive data and demanding ransom payments in exchange for not publishing the information.

If victims refuse to pay, the group typically threatens to release the stolen data on its leak site or other dark web platforms.

Cl0p has used the same strategy in previous campaigns, including the large-scale MOVEit attacks in 2023, when it exploited a single software vulnerability to compromise hundreds of organizations worldwide.

Extent of data breach remains unclear

At this stage, the most significant uncertainty is whether Cl0p actually obtained the amount of data it claims to have stolen from nearly 50 companies.

While Shell and Philips have confirmed they are investigating cybersecurity incidents, neither company has verified that the volumes of data claimed by Cl0p were taken. Fiserv likewise said it has found no evidence that sensitive customer or transaction data was compromised.

As a result, the group's claims remain unverified. Nevertheless, cybersecurity experts say the incident highlights how a single vulnerability in widely used enterprise software can simultaneously expose dozens of major organizations, with the full impact expected to become clearer as investigations continue.(ILKHA)