Eighty Servers Was Enough

PTC has more than 30,000 customers. Fewer than a hundred had Windchill answering the public internet. Cl0p claims 43. When the hit rate against the reachable population is that high, the question is not how quickly you patch. It is whether anybody knew the platform was exposed.

In July we wrote about this campaign while it was still a vulnerability story, in Your Crown Jewels Live in a System Your SOC Does Not Watch. The extortion has now become public, the victims have names, and the numbers have arrived. They change the lesson.

What happened

The PLM campaign

CVE-2026-12569 is an unsafe deserialisation flaw in PTC Windchill, FlexPLM and Creo Parametric Server permitting unauthenticated remote code execution. The NVD scored it 9.8 under CVSS 3.1. PTC, as the assigning authority, scored it 9.3 under CVSS 4.0. Researchers observed it chained with a pre-authentication information disclosure defect in the FlexPLM WSDL endpoint, after which attackers dropped hex-named JSP web shells under the Windchill login path and staged engineering data for exfiltration.

The warnings were loud and early. PTC began releasing fixes from 17 June. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 25 June with a three-day deadline for US federal agencies. Germany’s Federal Office for Information Security escalated to emailing and telephoning customers overnight.

On 23 July, ReliaQuest reported active exploitation in the wild alongside a coordinated advisory from Ransom-ISAC, eCrime.ch and DEFUSED. Attribution deserves precision here. ReliaQuest stated at the time that the actor remained unconfirmed, while noting tradecraft consistent with previous Cl0p campaigns. Ransom-ISAC separately assessed that the flaw was most likely exploited as a zero-day in early June, before fixes existed. That is an assessment, not a confirmed finding.

The extortion became public in mid-August. Reuters reported Cl0p claiming data from nearly 50 companies. BleepingComputer counted 43 in the batch tied to Windchill and FlexPLM. Cl0p claims roughly 89 GB from Shell, including engineering drawings, facility testing reports and project plans. As in its Oracle E-Business Suite campaign, it emails extortion demands from compromised third-party accounts to hundreds of employees at each target.

The named organisations responded very differently, and the distinctions matter. Philips identified and contained an attempted compromise of one enterprise server, with customer environments unaffected. Shell is aware of a possible incident and investigating. GE has initiated its cyber response protocols. Fiserv reports no evidence that customer, banking, transaction or personal data was compromised.

The commerce flaw

On 11 August, SAP patched CVE-2026-58231, a CVSS 10.0 improper authorisation issue in the SAP Commerce Cloud Data Hub Adapter. An unauthenticated attacker can abuse a default authentication client and submit crafted input to functions lacking sufficient validation, reaching arbitrary code execution. Within three days, Defused Cyber observed exploitation attempts arriving at its honeypots. There is still no public proof-of-concept and no confirmed compromise of a production environment. That distinction should not be inflated in either direction, but the interval is the point.

Why this one is different

The obvious reading is that organisations patch too slowly. It is what most commentary will say this week, and it sends your security team after the wrong problem.

Start with the denominator. PTC has more than 30,000 customers worldwide. Divide 43 by 30,000 and you get a rounding error. But Cl0p never had access to 30,000 organisations. It had access to those whose Windchill servers answered the public internet, and Censys counted fewer than 100 of those on 1 June, declining to a little over 80 by 20 July as PTC’s advisory took effect. Roughly 80% sat in the United States.

Against that population, 43 claimed victims is approaching half. The campaign was close to comprehensive across everything it could reach.

That changes the lesson. The distinguishing factor was not patch velocity, because the reachable set was largely swept regardless. It was being reachable at all. Fewer than one in three hundred PTC customers had made or inherited that configuration choice, and those are the organisations now on a leak site.

Internet exposure of a PLM platform is rarely a deliberate current decision. It is a legacy one. A supplier integration stood up years ago, a contractor portal meant to be temporary, a migration that left a listener open. Nobody chose it this quarter, which is exactly why nobody reviewed it. These systems belong to engineering rather than IT, run change control in quarters because an unplanned restart stops production, and sit outside the inventory driving both patching and exposure management.

Cl0p understands this. Its campaign history reads as a tour of these systems: Accellion, GoAnywhere, Serv-U, Cleo, MOVEit, Oracle E-Business Suite, now PLM. It is not hunting the hardest target. It is hunting the platform with the most valuable data and the least clear owner.

The commercial exposure for UK organisations

Regulatory. NIS2 is in active enforcement across Europe, with the Netherlands’ implementing law entering into force on 15 August and the European Commission having referred Ireland, Spain, France and the Netherlands to the Court of Justice in July over incomplete transposition. DORA supervision has moved from guidance to inspection. In the UK, the Cyber Security and Resilience Bill cleared the Commons and moved to the Lords in June, with Royal Assent expected later this year and implementation phased to 2028. Supply chain accountability runs through all three.

Financial. Engineering drawings, bills of materials and supplier data contain no personal data. No ICO notification, no headline fine, no compliance trigger. The loss lands entirely on the commercial ledger: eroded design advantage, weakened negotiating position, competitors who no longer need to reverse engineer anything. PTC’s customer base includes defence contractors, energy suppliers and medical technology firms. Boards measuring cyber loss through a GDPR lens will undervalue this category.

Contractual. If your PLM instance holds a customer’s designs under an NDA or a manufacturing agreement, a leak is a contractual breach before it is a security incident. The commercial consequence will arrive faster than the regulatory one.

Governance. Note how differently the named organisations could respond. Fiserv stated within days that it had found no evidence of compromise. Philips confirmed it had identified the attempt, contained it to one server and ruled out customer impact. That precision is not luck. It is what knowing your estate buys you, and it is increasingly what a regulator and a major customer expect to hear inside a week.

What leaders should do now

1. Find out what is internet-facing, this week. Not a policy review. An actual scan, and an actual list of business applications answering the public internet with the commercial reason each one is exposed. Fewer than a hundred organisations worldwide had Windchill in that position and roughly half are now on a leak site. This is the highest-yield hour your security team will spend this quarter.

2. Name an owner for every business-critical platform. PLM, ERP, commerce, MES and CAD vaults. One accountable executive per platform in the risk register, with a named deputy. Exposure persists because nobody is answerable for it, and only leadership can fix that.

3. Put the exposed ones behind an access layer. Where exposure exists to serve suppliers or design partners the need is real, but the implementation is often twenty years old. Move it behind a zero-trust gateway or a VPN with phishing-resistant multi-factor authentication. Retire what cannot be justified at all.

4. Bring business applications into the patch SLA. If your PLM or commerce platform sits outside the cycle governing laptops and servers, that gap is your exposure window. Set a tier-one SLA for platforms holding revenue or intellectual property, and report against it at executive level rather than inside IT.

5. Value the intellectual property, not just the personal data. Price what it would cost commercially if your design, engineering or pricing data were published tomorrow. Most organisations have never done this, which is precisely why the category is under-defended.

6. Rehearse a data-theft extortion, not a ransomware outage. Nothing gets encrypted here. Instead hundreds of your employees receive an email from a compromised third-party account. Test who responds, what legal says and who decides on payment.

Then close the two named flaws. Patch Windchill, FlexPLM and Creo Parametric Server, and hunt for JSP web shells under the login path. For SAP Commerce Cloud, apply Security Note 3771065, rebuild and redeploy, and restrict the Data Hub Adapter endpoint with an IP Filter Set in the interim.

Three questions for leadership

1. Which of our business platforms are reachable from the public internet right now, who owns each one by name, and when was that exposure last reviewed?

2. What would it cost us commercially, in revenue and competitive position, if our engineering and design data were published tomorrow?

3. If an extortion group named us on a leak site this afternoon, how many days would it take us to say, with evidence, what was and was not taken?

The strategic takeaway

The perimeter that mattered a decade ago was the network. The perimeter that matters now is the application estate, and most organisations have never drawn it. Cl0p has built a durable business on that gap and does not need a large attack surface to be effective. Eighty servers was enough. Meanwhile the SAP activity suggests the interval between a patch shipping and the first probe is now measured in days.

The organisations that handle the next one well will not be those with the fastest patching. They will be those that already know what they run, where it is exposed and who owns it, and can therefore answer a regulator, a customer and a board inside a week rather than a quarter.

That is a governance capability. It is built in weeks rather than years, and it converts directly into resilience and commercial trust.

Confidence note. Exploitation of CVE-2026-12569 and the honeypot activity against CVE-2026-58231 are confirmed by named researchers. Cl0p’s victim counts and data volumes are the group’s own claims and remain independently unverified, and the two reported counts differ: Reuters put the overall claim at nearly 50 companies, while BleepingComputer counted 43 in the Windchill batch. Ransom-ISAC’s assessment that exploitation began as a zero-day in early June is a researcher assessment rather than a confirmed finding.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification, and specialist technology recruitment as one integrated capability. We are a young firm, the founder personally runs the work, and our perspective comes from a career spent inside cybersecurity and compliance across the sales, marketing and technical sides of the industry.