Cyber Incident Victim: Zebra Technologies

The Cl0p ransomware group began exploiting a newly disclosed vulnerability in PTC’s Windchill product lifecycle management platform after the flaw, tracked as CVE‑2026‑12569, was added to CISA’s Known Exploited Vulnerabilities catalog in June 2026 and warned about by the vendor. The vulnerability, an improper input validation issue that permits a remote, unauthenticated attacker to achieve arbitrary code execution via specially crafted requests, was first observed being used in the wild in late July 2026, with cybersecurity researchers noting its deployment in Cl0p ransomware attacks. Police in Germany had previously alerted organizations about imminent attacks, and the exploitation was anticipated by industry observers. Cl0p affiliates used the security hole to deliver web shells that provided them with access to the Windchill environments of targeted organizations.

Security firm ReliaQuest reported that Cl0p employed a custom implant designed to grant full data theft capability without requiring additional tools; the web shell mapped sensitive vault data, decrypted every credential stored in the Windchill keystore, and incorporated a custom Java class loader that allowed the attackers to execute any further code within the application process, effectively turning the shell into an unlimited backdoor for lateral movement, ransomware deployment, or persistence. The attackers exfiltrated a variety of file types, including databases, project files, backups, photographs, image files, engineering documents, blueprints, diagrams, logs, and other corporate documents, with the volume of stolen data per victim ranging from one gigabyte to several terabytes according to the hackers’ own statements.

On August 12 2026, Cl0p shifted from listing only partial victim names on its leak site to publishing the full names of more than forty organizations allegedly compromised in the Windchill campaign. Among those named were Shell, Philips, Fiserv, Ingersoll Rand, Toast, Mindray, Largan Precision, and Zebra Technologies, which is identified in the article as an enterprise mobility provider. For each victim the hackers specified the type and amount of information taken, although the article does not provide the specific details for Zebra Technologies. The compromised files could contain sensitive personal information and valuable intellectual property, though much of the data may be of low value or already public, a factor the article notes as likely influencing many targeted organizations to refuse ransom payments. Companies such as Shell, Philips, Fiserv and GE publicly stated they were aware of the claims and were investigating, though none had confirmed a significant data breach at the time of reporting. Prior to this campaign, Cl0p had conducted similar data theft and extortion operations exploiting vulnerabilities in Oracle E‑Business Suite, MOVEit, Cleo, and GoAnywhere software.