Toast

Summary

Toast, a point-of-sale software maker, detected and contained an intrusion linked to the Clop ransomware group's exploitation of a zero-day vulnerability in PTC's Windchill and FlexPLM platforms. The attackers deployed a custom web shell that harvested credentials and enabled the exfiltration of files ranging from gigabytes to terabytes, including databases, engineering documents and backups. The affected company reported that its systems were quickly isolated and the overall impact still remained minimal.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 17, 2026, PTC disclosed CVE-2026-12569 affecting its Windchill and FlexPLM platforms and issued a patch the following day. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its known exploited vulnerabilities catalog on June 25. Researchers observed exploitation of the flaw in late July, with the Clop ransomware group sending threatening emails to alleged victims beginning in mid‑July. Clop employed a custom web shell that enabled credential theft, data exfiltration and persistent access within compromised systems. Among the organizations named by Clop as alleged victims was Toast, a point‑of‑sale restaurant management platform.

Toast informed CyberScoop that it had detected and contained the system intrusions linked to the campaign. The company characterized the impact as limited. Toast did not disclose specifics about any data that may have been accessed or exfiltrated. Its statement mirrored that of other named victims such as Zebra Technologies, which also reported detection and containment with limited consequences.

The Clop operation named more than 40 organizations across various sectors, including Shell, Philips, Fiserv, Zebra, Mindray and Largan Precision. The group asserted that it had stolen data ranging from one gigabyte to several terabytes per victim. Toast’s inclusion in the list reflects its identification as an alleged victim of the Windchill/FlexPLM exploitation campaign. Toast maintained that it had detected and contained the intrusion and described the impact as limited.

Sources

Sources available to members: 2 sources.