Your Crown Jewels Live in a System Your SOC Does Not Watch

Most breach response plans start with a question: whose personal data was taken? For this campaign, the answer is nobody’s. And that is precisely why it is dangerous.

Since early June 2026, attackers have been exploiting a critical flaw in PTC Windchill and FlexPLM, the Product Lifecycle Management platforms that hold CAD models, bills of materials, tolerances, supplier specifications and unreleased product designs. They are not after customer records. They are after the engineering data that defines what your company makes and how it makes it. On 20 July, extortion emails began landing.

If your organisation designs or manufactures anything, this briefing is about the systems your security programme was probably never built to protect.

What happened

CVE-2026-12569 is a critical remote code execution vulnerability in PTC Windchill PDMLink and PTC FlexPLM, caused by unsafe deserialisation of untrusted data. NVD scores it CVSS v3.1 9.8. It affects releases prior to 11.0 M030.

In the observed intrusions the flaw is chained with a second defect: a pre-authentication information disclosure in the FlexPLM WSDL endpoint, scored CVSS 7.5. Together they give an unauthenticated attacker on the internet the ability to run code on the server.

The tradecraft is consistent and well documented. Attackers probe the WSDL endpoint, then write hex-named JSP webshells into the Windchill login directory. Post-exploitation includes filesystem enumeration written to a file named flst.txt, staging of engineering and design data, and exfiltration.

Ransom-ISAC, working with eCrime.ch and DEFUSED, assesses the activity as Cl0p ransomware affiliate exploitation, most likely beginning as a zero-day in early June. ReliaQuest, which documented the exploitation, is more careful: it states the actor remains unconfirmed, while noting the tradecraft shares characteristics with previous Cl0p campaigns against enterprise applications and high-value data repositories. That distinction matters, and this briefing keeps it.

German authorities treated this as an emergency. The Federal Office for Information Security emailed and telephoned PTC customers in the middle of the night, urging them to patch immediately. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 25 June and gave US federal agencies three days to remediate.

Why this one is different

The stolen asset is not regulated the way you expect. A CAD model is not personal data. A bill of materials is not personal data. Neither triggers the ICO’s 72-hour clock under UK GDPR, because that clock starts on a personal data breach. Organisations that have rehearsed exactly one breach playbook, the data protection one, will open it and find it does not apply. Meanwhile the harm is real and permanent: you cannot re-issue a product design the way you re-issue a credit card.

The platform sits outside the SOC’s field of view. PLM and PDM systems are usually owned by engineering, not IT. They are procured by engineering, administered by engineering, and integrated with CAD tooling and supplier portals. In most organisations they are not in the EDR estate, their logs are not in the SIEM, and nobody has written a detection rule for them. The attacker chose that gap deliberately. It is the same logic behind MOVEit, Cleo and Oracle E-Business Suite: attack the trusted enterprise repository, not the well-defended endpoint.

The board hears about it from staff, not from security. The extortion emails are sent to hundreds of employees across the victim organisation, from randomly compromised accounts, naming Windchill explicitly. This is designed to bypass your incident process entirely and create internal pressure before your security team has confirmed anything. If your first briefing to the executive is a forwarded email from a shop floor supervisor, you have already lost control of the narrative.

The commercial exposure

Intellectual property. Design data is the asset that took years and significant investment to create, and it retains value to a competitor or a state-aligned buyer indefinitely. Unlike a personal data breach, there is no remediation that restores the position. The loss is permanent.

Regulatory, and not where you are looking. UK GDPR may not be triggered at all if no personal data was taken. But NIS2 does not care what kind of data moved. It triggers on incident significance. For entities in scope, Article 23 requires an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. Mid-market manufacturers pulled into scope as suppliers to essential entities are the least likely to have a 24-hour reporting capability, and the most likely to be asked for one. The UK Cyber Security and Resilience Bill, which cleared its Lords second reading on 14 July, moves the same way.

Contractual. If you hold customer design data under NDA, and much of the manufacturing supply chain does, exfiltration is a notifiable event to your customer regardless of what any regulator requires. Expect those clauses to be read closely. Expect some of them to carry termination rights.

Operational and reputational tail. Cl0p campaigns do not resolve quickly. MOVEit affected more than 2,770 organisations, with victim disclosures continuing for many months. The Oracle E-Business Suite campaign, running from early August 2025, was still producing named victims well into the following year. As of 22 July no victims of this campaign had been named publicly. That is not reassurance. That is the quiet part of the cycle.

You cannot re-issue a product design the way you re-issue a credit card.

What to do now

Patch, then assume you were already hit. Apply the PTC patches for your version. Then hunt back to early June, because patching an already-compromised server evicts nothing. The webshells persist independently of the vulnerability.

Hunt the specific artefacts. Search HTTP access logs for any POST to /Windchill/login/*.jsp, because legitimate Windchill traffic does not POST to that path. Scan the filesystem for hex-named JSP files in the login directory. PTC initially observed 16-character hex names and later added 6-character variants, so match on the pattern rather than the published filenames. Look for flst.txt in /tmp or the Windchill working directory, which confirms attacker file-listing activity. Add a WAF rule blocking any request carrying the header X-windchill-req, which has no legitimate use.

Get the platform into the SOC. Forward Windchill and FlexPLM logs to your SIEM. If that has never been done, the absence of historical logs is itself a finding, and one your board should hear.

Remove it from the internet. Place PLM behind a VPN or trusted access gateway. Internet-exposed PLM is the entire attack surface for this campaign.

Decide your reporting position before you need it. If you are NIS2-scoped, or supply someone who is, work out now who declares and on what evidence. Twenty-four hours is not long enough to invent that process.

Three questions for leadership

Do we know whether our PLM platform is internet-facing, and who owns that decision? Not who administers it. Who is accountable for its exposure. In many organisations the honest answer is that engineering made an availability decision years ago and security was never consulted.

If our design data were exfiltrated, what would we actually be required to report, and to whom? Work through it with no personal data involved. If the answer is a shrug, that is your gap, and NIS2 will close it for you on a 24-hour clock.

Which of our systems hold crown-jewel value but sit outside security monitoring? PLM is today’s example. The category is larger: MES, PDM, source control, CAD vaults, supplier portals. Anywhere the business kept its most valuable data in a system that security was never asked to defend.

The strategic takeaway

A decade of security investment has gone into endpoints, identity and email, and attackers have responded rationally by moving to the enterprise repositories that sit above all three. MOVEit, Cleo, Oracle E-Business Suite and now PLM are the same play executed against different platforms. The common factor is not the technology. It is that each system was trusted, internet-reachable, and owned by somebody outside the security function.

At Garzon Cyber Solutions we help UK and European manufacturers close exactly this gap: bringing engineering platforms into scope for monitoring and assurance, building reporting capability that survives a 24-hour clock, and providing the specialist compliance and detection talent that mid-market manufacturers cannot hire quickly. If your crown-jewel IP sits in a system your security team does not watch, the useful conversation happens before the extortion email, not after it.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification, and specialist technology recruitment as one integrated capability for organisations scaling into enterprise markets.