Hacking group claims mass data theft from Shell, Philips, GE, Fiserv and dozens of others

Philips said it had been targeted by Cl0p while Shell said it was aware of a recent "possible incident", confirming an earlier report on Thursday by Dutch media outlet BNR.

"We are working with our security teams and relevant experts to investigate the situation," a Shell spokesperson said. 

"Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data," Philips said in a statement, adding that the incident does not impact customer environments.

A spokesperson for Fiserv said the company is aware of the threat actor's claims, but "based on our comprehensive review to date", it had found no evidence that customer, banking, transaction or personal data had been compromised, or that its operating environment had been affected.

A GE spokesperson said the company is aware of the claim, and had "initiated our cyber response protocols and are working to assess the potential issue."

Reuters could not independently verify the hacking group’s claims regarding the kind of data it stole and how much. The hackers did not respond to a request for comment.

While it’s not clear how the hackers allegedly accessed the companies, Ransom-ISAC, an industry information sharing group, issued a notice July 22warning that the hacking group was exploiting vulnerabilities in PTC Windchill and FlexPLM, software used to aid in engineering and manufacturing processes. 

Boston-based PTC did not immediately respond to a request for comment. The company has issued multiple security notices to its website, dating to June 18, urging customers to apply a patch for a vulnerability and sharing details about an unnamed attacker attacking its products.

Brandon Parsons, threat intelligence manager with Ascent Solutions and the author of the Ransom-ISAC advisory, said some companies began receiving notices from Cl0p on July 19 or July 20. The group focuses on vulnerabilities in key software packages rather than specific companies, he said, calling them “professional data extortionists.”

“They don’t really target a specific company, they target a specific zero day vulnerability and go after it,” Parsons said, referring to previously unknown bugs that software vendors haven’t yet issued patches for.

(Reporting by Charlotte Van Campenhout, A.J. Vicens; Editing by Kirsten Donovan and Shri Navaratnam)