On July 20, 2026, organisations running PTC Windchill began receiving extortion emails with the subject line “Windchill PDMLink module serious data leak.” They arrived from compromised accounts, were blasted to hundreds of recipients inside each victim, and carried Cl0p’s current contact details.

The mass-CC tactic is deliberate and it is Cl0p’s signature. Sending the demand to hundreds of employees rather than to the CISO removes the option of quietly containing the incident. By the time the security team reads it, so has half the company.

The Vulnerability

CVE-2026-12569 carries a CVSS score of 9.3 and yields unauthenticated remote code execution against PTC Windchill and FlexPLM.

The exploit is a chain rather than a single bug. Attackers combine a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet. Together these give code execution before any credential is presented, after which the actors drop hex-named JSP webshells for persistence.

Exploitation is not new as of the extortion wave. Researchers observed JSP webshells being planted on unpatched Windchill instances as early as late June 2026 — roughly three weeks of quiet access before the emails went out. That gap is the whole operation: intrusion, enumeration, bulk exfiltration, and only then the demand.

Why PLM Is a Worse Target Than a Customer Database

Cl0p’s previous mass campaigns — Accellion FTA in 2021, GoAnywhere MFT in early 2023, MOVEit Transfer in mid-2023, Cleo in late 2024 — all hit file transfer software. The pattern was the same: find one internet-exposed product used by thousands of enterprises, exploit it at scale, take whatever files happened to be in transit.

Windchill is a different and, for victims, worse category. Product lifecycle management systems are the authoritative repository for what a manufacturer actually knows how to build:

  • CAD models and assembly drawings
  • Bills of materials with supplier names, part numbers, and negotiated pricing
  • Engineering change orders documenting design history and known defects
  • Manufacturing process specifications and tolerances
  • Regulatory and certification submissions
  • Unreleased product designs

A stolen customer database is a privacy incident with a notification cost and a defined remediation path. A stolen PLM repository is the transfer of a company’s engineering position to whoever buys the leak. It cannot be reissued like a credit card. In aerospace and defence-adjacent manufacturing, some of it is export-controlled, which converts a breach into an ITAR or EAR compliance event with its own separate liability.

The supplier dimension compounds it. BOM data names your suppliers and what you pay them — which is both competitively sensitive to you and a targeting list for whoever wants to attack your supply chain next.

Confirmed Victim Sectors

Reported sectors so far are manufacturing, automotive, aerospace, and retail/apparel. FlexPLM’s strength in apparel and footwear explains the last category — the same platform that manages a jet component’s revision history manages next season’s product line.

As of July 22, Cl0p had not listed any of these victims on its leak site and had not publicly claimed the campaign. That is consistent with prior Cl0p operations, where the group works private negotiations for weeks before beginning staged public postings. MOVEit victims appeared on the leak site in batches over months.

If you run Windchill and have not received an email, that is not evidence you were not hit. Cl0p contacts victims in waves.

What to Do Today

Patch CVE-2026-12569 immediately if you have not. PTC has released fixes; the exposure window has been open since at least late June.

Assume compromise if you were exposed and unpatched at any point since mid-June. Patching removes the vulnerability, not the webshell. Specifically hunt for:

  • Hex-named JSP files anywhere in the Windchill web application directories — these are the documented persistence mechanism and the filenames are randomised
  • Unusual requests to the FlexPLM WSDL endpoint in web server logs
  • Anomalous requests to the Windchill login servlet, particularly ones that do not correspond to real login attempts
  • Bulk export or download activity against the PLM repository, including from legitimate service accounts
  • Large outbound transfers from the Windchill host

Get Windchill off the public internet. There is no operating reason for a PLM server to accept unauthenticated connections from arbitrary addresses. Put it behind VPN or a ZTNA gateway.

Watch your own mail infrastructure. The extortion emails come from compromised accounts, in some cases internal ones. An extortion mail originating inside your tenant is an authentication compromise you need to investigate independently of the PLM breach.

Decide the disclosure position early. If the stolen data includes export-controlled technical data or contract-sensitive supplier terms, the notification obligations run to regulators and customers, not just to affected individuals — and those clocks start at discovery.

Sources