Hackers target business giants across multiple industries with severe cyberattack

A prolific hacking group known for exploiting software vulnerabilities to target multiple companies simultaneously has claimed to have stolen large volumes of data from nearly 50 businesses worldwide, including industry giants Philips, Shell, Fiserv and GE.

The astonishing list was published on the cybercriminal group's own website, as reported by Reuters.

Several of the affected companies have since acknowledged the incident, including Dutch companies Philips and Shell.

Philips confirmed that it had been targeted by Cl0p, while Shell said it was aware of a recent "possible incident."

"We are working with our security teams and relevant experts to investigate the situation," Shell said.

A spokesperson for Fiserv, the global fintech company, said it was aware of the threat actor's claims but that "based on our comprehensive review to date", the company had found no evidence that customer, banking, transaction or personal data had been compromised, or that its operating environment had been affected.

US conglomerate GE also said it was aware of the claim and had "initiated our cyber response protocols and are working to assess the potential issue."

It remains unclear how the hackers allegedly gained access to the targeted companies. However, Ransom-ISAC, an industry information-sharing group, issued an advisory on July 22 warning that Cl0p was exploiting vulnerabilities in PTC Windchill and FlexPLM, software packages widely used to support engineering and manufacturing processes.

Brandon Parsons, threat intelligence manager at Ascent Solutions and the author of the Ransom-ISAC advisory, told Reuters that some companies began receiving notices from Cl0p on July 19 or July 20.

The group appears to focus on vulnerabilities in widely used software rather than individual companies, Parsons said, describing Cl0p as “professional data extortionists.”

“They don’t really target a specific company, they target a specific zero day vulnerability and go after it,” Parsons said, referring to previously unknown software vulnerabilities for which vendors have not yet issued patches.

The approach allows Cl0p to exploit a single weakness across numerous organisations using the same software, potentially giving the group access to large amounts of corporate data in a relatively short period.

Cl0p has been active since 2019 and is a ransomware group that has likely already extorted around $500 million from previous victims.

Rather than simply encrypting systems and demanding payment to restore access, the group typically steals files and other sensitive information before threatening to publish the data online unless a ransom is paid.

Such "ransomware" attacks have become increasingly prominent in recent years, with several high-profile incidents demonstrating the potentially enormous consequences for both companies and their customers.

One of the most significant cases was the 2024 cyberattack against Change Healthcare, a subsidiary of US healthcare and insurance giant UnitedHealth Group.

The attack resulted in what was described as the largest healthcare data breach in US history. Sensitive personal, financial and medical information relating to more than 192 million individuals was compromised, while the disruption to Change Healthcare's systems caused widespread problems, including interruptions to prescription services.

UnitedHealth Group ultimately paid a $22 million ransom following the attack, although its systems remained severely disrupted even after the payment.

The latest Cl0p campaign once again highlights the vulnerability created by widely used enterprise software: a single previously unknown flaw can potentially give cybercriminals a route into dozens of companies across multiple industries and countries.

By Nazrin Sadigova