What happened

The Cl0p ransomware/extortion group listed Shell among dozens of victims (reports cite 43 to more than 50 organizations, including GE and Philips) added to its dark-web leak site in mid-August, tied to exploitation of a since-patched vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM product-lifecycle-management software. For Shell specifically, Cl0p claimed roughly 89 GB of data, allegedly including engineering drawings, facility photographs, project roadmaps and testing reports. Shell said it was investigating with its security teams and stated it had found no evidence of disruption to its refining, drilling or core IT operations; GE said it was assessing the claim. Neither company confirmed the intrusion, the data volume or its authenticity. This record documents an alleged corporate data-theft claim, not a confirmed breach or any refinery or operational-technology compromise, and is unrelated to Cl0p's separate 2025 Oracle E-Business Suite extortion campaign.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.