🔐 INCIDENT: LARGAN.COM.TW
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: LARGAN.COM.TW
🏢 About the company: Largan Precision Co., Ltd. is a Taiwanese optical lens manufacturer and a key supplier of camera modules for Apple. The company was founded in 1987, with its headquarters in Taichung, Taiwan. Largan is the world's largest manufacturer of smartphone lenses and holds a significant share of the high-end optics market. Its claimed annual revenue is $1.7 billion.
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 56 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
• Project files
• Software (Soft)
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
• Compromised employees: 0
• Compromised users: 43
• Third-party employee credentials: 0
• External attack surface: 6
🌐 DETECTED INFRASTRUCTURE:
• MX records:
• SPF record:
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed LARGAN.COM.TW on its leak site as part of a large-scale campaign linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.8) in PTC Windchill and FlexPLM . The vulnerability involves insecure deserialization and improper input validation, allowing an unauthenticated remote attacker to execute arbitrary code . Clop used a custom JSP web shell to access Windchill data, including credential decryption and file exfiltration . Largan Precision is listed among more than 40 alleged victims in the campaign alongside Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others . According to Clop's statement: "The full database will be leaked if Largan Precision Co., Ltd. does not contact us to negotiate" . At the time of publication, there is no independent confirmation of the leak and no official statement from the company.
💫 Note: Largan Precision is a critical Apple supplier in the camera module supply chain, which makes a potential leak of project data and software particularly sensitive. However, the absence of compromised employees (0) alongside 43 compromised users may indicate access through external accounts or contractors rather than direct employee credentials.
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: LARGAN.COM.TW
🏢 About the company: Largan Precision Co., Ltd. is a Taiwanese optical lens manufacturer and a key supplier of camera modules for Apple. The company was founded in 1987, with its headquarters in Taichung, Taiwan. Largan is the world's largest manufacturer of smartphone lenses and holds a significant share of the high-end optics market. Its claimed annual revenue is $1.7 billion.
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 56 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
• Project files
• Software (Soft)
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
• Compromised employees: 0
• Compromised users: 43
• Third-party employee credentials: 0
• External attack surface: 6
🌐 DETECTED INFRASTRUCTURE:
• MX records:
mail.largan.com.tw, mailgw1.largan.com.tw, mailgw2.largan.com.tw • SPF record:
v=spf1 ip4:219.87.176.11 ip4:219.87.176.7 ip4:60.248.234.226 ip4:123.51.154.9 -all 🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed LARGAN.COM.TW on its leak site as part of a large-scale campaign linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.8) in PTC Windchill and FlexPLM . The vulnerability involves insecure deserialization and improper input validation, allowing an unauthenticated remote attacker to execute arbitrary code . Clop used a custom JSP web shell to access Windchill data, including credential decryption and file exfiltration . Largan Precision is listed among more than 40 alleged victims in the campaign alongside Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others . According to Clop's statement: "The full database will be leaked if Largan Precision Co., Ltd. does not contact us to negotiate" . At the time of publication, there is no independent confirmation of the leak and no official statement from the company.
💫 Note: Largan Precision is a critical Apple supplier in the camera module supply chain, which makes a potential leak of project data and software particularly sensitive. However, the absence of compromised employees (0) alongside 43 compromised users may indicate access through external accounts or contractors rather than direct employee credentials.
4 Vulnerabilities Already Under Attack: CISA Adds SharePoint, WSO2, MikroTik, and Adobe Commerce to Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.
The most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0–4.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.
The flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.
The second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.
Adobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.
Microsoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.
The fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.
MikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as "Flagged" if it detects known indicators of compromise.
CISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.
____
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of flaws known to be exploited in the wild. The security gaps affect Microsoft SharePoint servers, WSO2 API management products, Adobe Commerce and Magento e-commerce stores, and devices running MikroTik RouterOS. For some of these vulnerabilities, attackers require no credentials or user interaction to succeed.
The most critical flaw, CVE-2026-5430, affects WSO2 API Manager versions 4.1.0–4.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigned the vulnerability a maximum CVSS score of 10 for certain configurations, warning that a successful attack allows for full account takeover, including administrative access.
The flaw stems from the validation process of JSON Web Tokens (JWT), which act as digital passes between applications and services. WSO2 accepted tokens signed with an unsupported algorithm, allowing malicious actors to forge tokens and bypass authentication. The vendor released patches in the spring and recommends installing the relevant updates or upgrading to an unaffected version.
The second critical vulnerability, CVE-2026-71362 (CVSS score: 9.1), impacts Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An authorization bypass flaw allows unauthenticated attackers to gain access to customer accounts. Experts at Sansec, who analyzed the patch, discovered that the system incorrectly handled user identity within a session, enabling an attacker to switch the session to another client and access their profile and personal data.
Adobe addressed CVE-2026-71362 in its August update (APSB26-92). At the time of the advisory's release, the company stated it had no evidence of active exploitation. However, Sansec claimed its security systems had already blocked attempts to exploit CVE-2026-71362. Its inclusion in the CISA catalog now confirms that active exploitation has moved beyond lab proof-of-concepts.
Microsoft SharePoint is being targeted via CVE-2026-65660 (CVSS score: 8.8). The flaw allows a low-privileged user to inject and execute code on the server over the network. Microsoft patched the vulnerability in August for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Unlike the flaws in WSO2 and Adobe Commerce, exploiting CVE-2026-65660 requires a valid user account.
The fourth vulnerability, CVE-2026-67279, is located in the SSH server of MikroTik RouterOS. Under a specific sequence of actions, RouterOS began processing commands before the user authentication process was fully completed. As a result, an unauthenticated remote client could create, modify, and restore files within the accessible RouterOS directory, including configuration files and diagnostic data. Researchers described the issue after analyzing the September updates.
MikroTik resolved the related flaws in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. The company advises against leaving SSH exposed to untrusted networks. Following the update, administrators should inspect devices for unknown users, scripts, or other configuration changes. RouterOS may also label a device as "Flagged" if it detects known indicators of compromise.
CISA has not disclosed who is exploiting these four vulnerabilities or which organizations are being targeted. U.S. federal agencies are required to remediate CVE-2026-5430 and CVE-2026-71362 by September 27, and CVE-2026-65660 and CVE-2026-67279 by September 28. For other organizations, inclusion in the CISA catalog serves as a high-priority alert that updates must be deployed immediately given the confirmed active exploitation, and internet-facing systems should be checked for signs of breach.
____
Dangerous Flaw Discovered in Elementor: Simple URL Click Grants Superuser Privileges
A simple link can turn an active WordPress administrator session into a site takeover tool. A newly discovered vulnerability in the Elementor Website Builder allows attackers to bypass REST API Cross-Site Request Forgery (CSRF) protection and execute actions with the privileges of an authenticated user, including creating a new administrator account.
The vulnerability, tracked as CVE-2026-62062, received a CVSS 3.1 score of 8.8. It affects Elementor versions 4.3.0 and 4.3.1. Patchstack disclosed the flaw on September 25 following a report by a security researcher known as Saggre. While Elementor is installed on over 10 million sites, the potential blast radius for the vulnerable versions is estimated at around 2 million installations.
The flaw resides in the Editor Events module, which handles editor telemetry. The code attempts to identify requests directed to Elementor’s own route by searching for the string elementor/v1/events/. However, it checks for this string across the entire raw URI. This includes the query string, which is fully controlled by the request sender.
An attacker can append this specific string as a harmless parameter to a request aimed at a completely different REST route. Elementor mistakenly recognizes the request as its own and returns a successful result in the authentication filter before standard WordPress checks take place. Consequently, the core skips the REST nonce verification, which is supposed to ensure that the action was genuinely initiated by the authorized user.
However, authorization checks are not completely bypassed. The REST API still verifies whether the specific action is permitted for the current user, meaning the impact depends on the victim's privileges. If the crafted URL is opened by a logged-in administrator, a request to the standard user route can create a secondary administrative account with the attacker’s credentials.
This attack scenario requires no JavaScript, HTML forms, or an attacker-controlled website. WordPress supports the _method parameter, which can turn a standard GET request into a state-changing write operation. As a result, the entire malicious payload fits directly into a URL that can be delivered via email, direct message, or comment. The victim only needs to open the link during an active session.
This bypass affects more than just Elementor's routes. Because the check triggers before WordPress identifies the actual REST route, the vulnerability extends to the entire available REST API, including functions from other plugins. The actual scope of achievable actions depends on the user's permissions and installed components, with administrator creation being the most critical exploit scenario.
The issue specifically impacts versions 4.3.0 and 4.3.1. Older releases do not contain the vulnerable Editor Events proxy, though they may have other flaws. In early September, threat actors were already targeting Elementor Pro via a different critical vulnerability that allowed arbitrary PHP file uploads and remote code execution (RCE).
Elementor released version 4.3.2 on September 24. The patched code no longer parses the raw URI alongside its parameters; instead, it checks the pre-determined WordPress REST route and requires the Elementor namespace to be strictly at the beginning. This approach prevents attackers from injecting the required string via the query string.
A similar class of attacks recently affected the WordPress core itself. In the Click2Shell chain, an authenticated administrator's browser also executed an unintended action after opening a crafted resource, though the underlying technical mechanism differed. As of now, there is no public evidence of active exploitation (in the wild) for CVE-2026-62062. Patchstack strongly recommends upgrading to Elementor 4.3.2 or later.
A simple link can turn an active WordPress administrator session into a site takeover tool. A newly discovered vulnerability in the Elementor Website Builder allows attackers to bypass REST API Cross-Site Request Forgery (CSRF) protection and execute actions with the privileges of an authenticated user, including creating a new administrator account.
The vulnerability, tracked as CVE-2026-62062, received a CVSS 3.1 score of 8.8. It affects Elementor versions 4.3.0 and 4.3.1. Patchstack disclosed the flaw on September 25 following a report by a security researcher known as Saggre. While Elementor is installed on over 10 million sites, the potential blast radius for the vulnerable versions is estimated at around 2 million installations.
The flaw resides in the Editor Events module, which handles editor telemetry. The code attempts to identify requests directed to Elementor’s own route by searching for the string elementor/v1/events/. However, it checks for this string across the entire raw URI. This includes the query string, which is fully controlled by the request sender.
An attacker can append this specific string as a harmless parameter to a request aimed at a completely different REST route. Elementor mistakenly recognizes the request as its own and returns a successful result in the authentication filter before standard WordPress checks take place. Consequently, the core skips the REST nonce verification, which is supposed to ensure that the action was genuinely initiated by the authorized user.
However, authorization checks are not completely bypassed. The REST API still verifies whether the specific action is permitted for the current user, meaning the impact depends on the victim's privileges. If the crafted URL is opened by a logged-in administrator, a request to the standard user route can create a secondary administrative account with the attacker’s credentials.
This attack scenario requires no JavaScript, HTML forms, or an attacker-controlled website. WordPress supports the _method parameter, which can turn a standard GET request into a state-changing write operation. As a result, the entire malicious payload fits directly into a URL that can be delivered via email, direct message, or comment. The victim only needs to open the link during an active session.
This bypass affects more than just Elementor's routes. Because the check triggers before WordPress identifies the actual REST route, the vulnerability extends to the entire available REST API, including functions from other plugins. The actual scope of achievable actions depends on the user's permissions and installed components, with administrator creation being the most critical exploit scenario.
The issue specifically impacts versions 4.3.0 and 4.3.1. Older releases do not contain the vulnerable Editor Events proxy, though they may have other flaws. In early September, threat actors were already targeting Elementor Pro via a different critical vulnerability that allowed arbitrary PHP file uploads and remote code execution (RCE).
Elementor released version 4.3.2 on September 24. The patched code no longer parses the raw URI alongside its parameters; instead, it checks the pre-determined WordPress REST route and requires the Elementor namespace to be strictly at the beginning. This approach prevents attackers from injecting the required string via the query string.
A similar class of attacks recently affected the WordPress core itself. In the Click2Shell chain, an authenticated administrator's browser also executed an unintended action after opening a crafted resource, though the underlying technical mechanism differed. As of now, there is no public evidence of active exploitation (in the wild) for CVE-2026-62062. Patchstack strongly recommends upgrading to Elementor 4.3.2 or later.
🔐 INCIDENT: TOASTTAB.COM
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: TOASTTAB.COM
🏢 About the company: Toast, Inc. is an American technology company providing cloud-based POS solutions, payment processing, and management tools for the restaurant industry. Its headquarters is located in Boston, Massachusetts, USA. Revenue for 2025 was $6.15 billion , and for the first half of 2026 — $3.54 billion . The company serves restaurants of all sizes across the United States and internationally .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 215 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
• Project files
• Backup databases
• Logs
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
• Compromised employees: 9
• Compromised users: 6928
• Third-party employee credentials: 20
• External attack surface: 105
🌐 DETECTED INFRASTRUCTURE:
• MX records:
• SaaS services (per TXT records): Apple, DocuSign, Stripe, Miro, Loom, OpenAI, Salesforce, Mailgun, Google, Microsoft
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed TOASTTAB.COM on its leak site as part of a large-scale campaign linked to the exploitation of a critical vulnerability in PTC Windchill . However, Toast, Inc. has officially confirmed the incident: "Toast identified unauthorized access to a limited number of files; to date, the files identified contain nonsensitive internal documents. We isolated the affected systems the same day we detected the activity, and the situation has been contained" . Company spokesperson Allie Rosenberg emphasised that no customer data was affected .
💫 Note: The incident is notable in that Toast is one of the few companies in the current Clop attack wave to promptly confirm unauthorized access and issue an official comment. This contrasts with most alleged victims, which either remain silent or deny the incident. It is also important to note that, according to a RedPacket Security warning, listings attributed to Clop "have been reported as including unverified or fabricated victim claims" .
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: TOASTTAB.COM
🏢 About the company: Toast, Inc. is an American technology company providing cloud-based POS solutions, payment processing, and management tools for the restaurant industry. Its headquarters is located in Boston, Massachusetts, USA. Revenue for 2025 was $6.15 billion , and for the first half of 2026 — $3.54 billion . The company serves restaurants of all sizes across the United States and internationally .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 215 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
• Project files
• Backup databases
• Logs
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
• Compromised employees: 9
• Compromised users: 6928
• Third-party employee credentials: 20
• External attack surface: 105
🌐 DETECTED INFRASTRUCTURE:
• MX records:
aspmx.l.google.com, alt1.aspmx.l.google.com, etc. (Google Workspace) • SaaS services (per TXT records): Apple, DocuSign, Stripe, Miro, Loom, OpenAI, Salesforce, Mailgun, Google, Microsoft
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed TOASTTAB.COM on its leak site as part of a large-scale campaign linked to the exploitation of a critical vulnerability in PTC Windchill . However, Toast, Inc. has officially confirmed the incident: "Toast identified unauthorized access to a limited number of files; to date, the files identified contain nonsensitive internal documents. We isolated the affected systems the same day we detected the activity, and the situation has been contained" . Company spokesperson Allie Rosenberg emphasised that no customer data was affected .
💫 Note: The incident is notable in that Toast is one of the few companies in the current Clop attack wave to promptly confirm unauthorized access and issue an official comment. This contrasts with most alleged victims, which either remain silent or deny the incident. It is also important to note that, according to a RedPacket Security warning, listings attributed to Clop "have been reported as including unverified or fabricated victim claims" .
🔐 INCIDENT: IRCO.COM
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: IRCO.COM
🏢 About the company: Ingersoll Rand Inc. is an American industrial conglomerate and one of the global leaders in mission-critical flow creation and industrial solutions. The company was founded in 1859, with its headquarters in Davidson, North Carolina, USA. Revenue for 2025 was $7.65 billion, up 6% year over year . Guidance for 2026 is $8.1–8.5 billion . The company manages a portfolio of more than 80 brands and serves customers in manufacturing, construction, and energy .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 5564 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
• CAD files
• PDF drawings
• Diagrams
• Product presentations
• Specifications
• Manuals and instructions
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
• Compromised employees: 125
• Compromised users: 45
• Third-party employee credentials: 108
• External attack surface: 83
🌐 DETECTED INFRASTRUCTURE:
• MX records:
• SPF record: includes
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed IRCO.COM on its leak site as part of a campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM . According to Clop's standard statement: "The full leak will be published soon unless a company representative contacts us via the channels provided" . However: Ransomware.live flags this entry as a "duplicate" — the same domain appears in the database with a note about possible duplication . Moreover, IRCO.COM had already appeared in other groups' lists: in March 2026 it was "attacked" by the ALP-001 group with a ransom deadline of March 29 and a claimed volume of 5.9 TB , and in August by the Everest group . At the time of publication, there is no independent confirmation of the leak and no official statement from Ingersoll Rand.
💫 Note: The incident raises significant doubts about its credibility. The same domain has been claimed by at least three different ransomware groups (ALP-001, Everest, Clop) within a few months, and the Clop entry is flagged as a duplicate in tracking databases. The data claimed to have been leaked (CAD files, drawings, specifications) relates to engineering documentation, which is typical for attacks via PLM systems, but the 5.5 TB volume and repeated claims may indicate either a real compromise with repeated monetization or an extortion attempt using previously stolen or fabricated data. Notably, Ingersoll Rand's 2025 financial statements include a line item "Cybersecurity incident costs" with a negative value (-$1.3M), which may indirectly indicate settlement of incident consequences in the past .
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: IRCO.COM
🏢 About the company: Ingersoll Rand Inc. is an American industrial conglomerate and one of the global leaders in mission-critical flow creation and industrial solutions. The company was founded in 1859, with its headquarters in Davidson, North Carolina, USA. Revenue for 2025 was $7.65 billion, up 6% year over year . Guidance for 2026 is $8.1–8.5 billion . The company manages a portfolio of more than 80 brands and serves customers in manufacturing, construction, and energy .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 5564 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
• CAD files
• PDF drawings
• Diagrams
• Product presentations
• Specifications
• Manuals and instructions
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
• Compromised employees: 125
• Compromised users: 45
• Third-party employee credentials: 108
• External attack surface: 83
🌐 DETECTED INFRASTRUCTURE:
• MX records:
irco-com.mail.protection.outlook.com (Microsoft 365)• SPF record: includes
spf.protection.outlook.com, mail.zendesk.com, servers.mcsv.net, amazonses.com, and others🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed IRCO.COM on its leak site as part of a campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM . According to Clop's standard statement: "The full leak will be published soon unless a company representative contacts us via the channels provided" . However: Ransomware.live flags this entry as a "duplicate" — the same domain appears in the database with a note about possible duplication . Moreover, IRCO.COM had already appeared in other groups' lists: in March 2026 it was "attacked" by the ALP-001 group with a ransom deadline of March 29 and a claimed volume of 5.9 TB , and in August by the Everest group . At the time of publication, there is no independent confirmation of the leak and no official statement from Ingersoll Rand.
💫 Note: The incident raises significant doubts about its credibility. The same domain has been claimed by at least three different ransomware groups (ALP-001, Everest, Clop) within a few months, and the Clop entry is flagged as a duplicate in tracking databases. The data claimed to have been leaked (CAD files, drawings, specifications) relates to engineering documentation, which is typical for attacks via PLM systems, but the 5.5 TB volume and repeated claims may indicate either a real compromise with repeated monetization or an extortion attempt using previously stolen or fabricated data. Notably, Ingersoll Rand's 2025 financial statements include a line item "Cybersecurity incident costs" with a negative value (-$1.3M), which may indirectly indicate settlement of incident consequences in the past .
🛡 The DMDC Breach: 9 Months of Silence and 3M Service Members' Unencrypted Data Exposed
The Pentagon has officially acknowledged a massive security incident. A vulnerability at the Defense Manpower Data Center (DMDC) has compromised the personal data of over 3 million individuals — spanning active-duty military personnel, reservists, contractors, and veterans.
📊 Timeline and Hard Figures:
• Dwell Time: From October 2025 to July 16, 2026. Attackers maintained undetected, persistent access for 9 full months.
• Breach Scale: The incident impacts 2,76 million living personnel and 294,000 records of deceased individuals. (The total DMDC repository holds over 60 million records).
• Exfiltrated Data: Unencrypted PII (Personally Identifiable Information) — full names, SSNs (Social Security Numbers), dates of birth, contact details, and critically — military occupational specialties and duty stations.
🛠 Technical Vector: Where the Pentagon Erred
Official DMDC notification letters sent to victims remain light on specifics, but cybersecurity analysts can piece together the technical reality:
1. File-Sharing System Vulnerability: The attack did not target the secure core database. Instead, it exploited a peripheral file-sharing server. Hackers likely leveraged a Path Traversal or Pre-Auth RCE vulnerability in a third-party software layer to gain an initial foothold.
2. Lack of Encryption (Unencrypted PII): The administrative critical failure lies in the data handling. Files stored on or passing through this transit server were kept in cleartext.
3. Logging and SIEM Failure: The fact that a "limited number of unauthorized users" spent 9 months roaming the server points to a complete lack of anomalous data exfiltration detection and substandard log auditing.
🎯 Threat Actors and Real-World Impact
The Pentagon claims there is "no evidence of data misuse" and suggests hackers might have just "viewed" the data rather than downloading it. In the InfoSec community, this is a joke — threat actors do not maintain persistence in a military network for nearly a year just to "browse."
The broader context is telling: in late September 2026, the ShinyHunters threat group simultaneously claimed a breach of the FBI's recruiting portal (FBIJobs.gov). While attribution for the DMDC breach remains unconfirmed, the stolen data feeds two distinct threat vectors:
1. Cybercrime (Financial Fraud): A complete Name + DOB + SSN package is a turn-key asset for Identity Theft. It allows fraudsters to open fraudulent lines of credit, hijack tax refunds, and exploit medical insurance.
2. APT Groups (Espionage): Mapping real identities to specific military occupational specialties and locations is a goldmine for foreign intelligence. This data will likely power highly sophisticated Spear-Phishing campaigns and social engineering operations targeting officers and critical infrastructure operators.
🛑 Remediation Efforts
The Pentagon patched the flaw in July but waited until September to begin notifications. Victims are being offered the standard consolation prize: a complimentary year of IDX credit monitoring. But as the joke goes in InfoSec circles: "Credit monitoring won't erase your military clearance profile from a foreign intelligence database."
++++
The Pentagon has officially acknowledged a massive security incident. A vulnerability at the Defense Manpower Data Center (DMDC) has compromised the personal data of over 3 million individuals — spanning active-duty military personnel, reservists, contractors, and veterans.
📊 Timeline and Hard Figures:
• Dwell Time: From October 2025 to July 16, 2026. Attackers maintained undetected, persistent access for 9 full months.
• Breach Scale: The incident impacts 2,76 million living personnel and 294,000 records of deceased individuals. (The total DMDC repository holds over 60 million records).
• Exfiltrated Data: Unencrypted PII (Personally Identifiable Information) — full names, SSNs (Social Security Numbers), dates of birth, contact details, and critically — military occupational specialties and duty stations.
🛠 Technical Vector: Where the Pentagon Erred
Official DMDC notification letters sent to victims remain light on specifics, but cybersecurity analysts can piece together the technical reality:
1. File-Sharing System Vulnerability: The attack did not target the secure core database. Instead, it exploited a peripheral file-sharing server. Hackers likely leveraged a Path Traversal or Pre-Auth RCE vulnerability in a third-party software layer to gain an initial foothold.
2. Lack of Encryption (Unencrypted PII): The administrative critical failure lies in the data handling. Files stored on or passing through this transit server were kept in cleartext.
3. Logging and SIEM Failure: The fact that a "limited number of unauthorized users" spent 9 months roaming the server points to a complete lack of anomalous data exfiltration detection and substandard log auditing.
🎯 Threat Actors and Real-World Impact
The Pentagon claims there is "no evidence of data misuse" and suggests hackers might have just "viewed" the data rather than downloading it. In the InfoSec community, this is a joke — threat actors do not maintain persistence in a military network for nearly a year just to "browse."
The broader context is telling: in late September 2026, the ShinyHunters threat group simultaneously claimed a breach of the FBI's recruiting portal (FBIJobs.gov). While attribution for the DMDC breach remains unconfirmed, the stolen data feeds two distinct threat vectors:
1. Cybercrime (Financial Fraud): A complete Name + DOB + SSN package is a turn-key asset for Identity Theft. It allows fraudsters to open fraudulent lines of credit, hijack tax refunds, and exploit medical insurance.
2. APT Groups (Espionage): Mapping real identities to specific military occupational specialties and locations is a goldmine for foreign intelligence. This data will likely power highly sophisticated Spear-Phishing campaigns and social engineering operations targeting officers and critical infrastructure operators.
🛑 Remediation Efforts
The Pentagon patched the flaw in July but waited until September to begin notifications. Victims are being offered the standard consolation prize: a complimentary year of IDX credit monitoring. But as the joke goes in InfoSec circles: "Credit monitoring won't erase your military clearance profile from a foreign intelligence database."
++++
🔥 Retaliation & PR: How ShinyHunters Breached the FBI for "Marketing"
While the Pentagon is still recovering from the exposure of 3 million service members' records, the Federal Bureau of Investigation (FBI) is facing its own, arguably more embarrassing, security fiasco. The notorious ShinyHunters cybercrime group has breached FBIJobs.gov, exfiltrating the personal data of nearly every active agent, employee, and applicant.
🎯 The Motive: Money?
No. This was pure "retaliation" and a PR stunt. In May 2026, the FBI issued a public Public Service Announcement (PSA) warning against ShinyHunters' tactics, labeling them as mere extortionists, swatters, and blackmailers.
The threat actors took offense. They claimed the FBI breach was a "marketing campaign to protect our business and fight disinformation." Their demand? The FBI's leadership must delete or revise the May PSA. In exchange, they promised not to sell the database.
🛠 Technical Vector: How Did They Get In?
Unlike past major breaches (such as the Snowflake campaign) that relied heavily on stolen credentials, this attack was purely technical:
1. Application Vulnerability: The attack targeted a flaw within the web application hosted on the public-facing FBIJobs.gov server.
2. Missing Patches: Mandiant analysts discovered that hackers exploited a critical, newly discovered flaw in Oracle PeopleSoft (CVE-2026-35273). A patch had been available since June 2026, but the FBI simply... failed to apply it.
3. Data Volume: Once inside the server, ShinyHunters claimed to have exfiltrated between 2 and 3 terabytes of data.
📦 Inside the Archives (Spoiler: It's Worse Than It Looks)
To prove the breach, the group shared a sample of 5,000 records with journalists. The FBI has officially acknowledged the incident and sent out internal alerts: the bureau is operating under the assumption that every employee's data has been compromised.
The leaked data includes:
• Full names, home addresses, personal phone numbers, SSNs, and emergency contact details.
• Information on employee spouses.
• 🩸 The most absurd part: Medical screening results for special agents (ranging from blood and urine analysis to medical notes like "banana allergy").
🕵️♂️ The Real-World Danger
For undercover operatives and counterintelligence officers, this is a national security nightmare. Stolen samples already show data of personnel assigned to sensitive desks (including operations involving Russia, China, and Iran). Their residential addresses are now exposed, leaving them and their families vulnerable to physical and digital targeting.
⚖️ An Ironic Twist
While ShinyHunters was busy issuing ultimatums to the Bureau, the Dutch National Police quietly arrested one of the group's key members in Amsterdam.
Immediately following the arrest (around September 28–29), the group's tone shifted dramatically. They walked back their threats, stating they would fully refrain from leaking or selling the FBI database. It seems the "marketing campaign" went a step too far.
The takeaway: Even if you are the world's leading law enforcement agency, patching Oracle PeopleSoft on time is not a luxury—it's basic hygiene.
++++
While the Pentagon is still recovering from the exposure of 3 million service members' records, the Federal Bureau of Investigation (FBI) is facing its own, arguably more embarrassing, security fiasco. The notorious ShinyHunters cybercrime group has breached FBIJobs.gov, exfiltrating the personal data of nearly every active agent, employee, and applicant.
🎯 The Motive: Money?
No. This was pure "retaliation" and a PR stunt. In May 2026, the FBI issued a public Public Service Announcement (PSA) warning against ShinyHunters' tactics, labeling them as mere extortionists, swatters, and blackmailers.
The threat actors took offense. They claimed the FBI breach was a "marketing campaign to protect our business and fight disinformation." Their demand? The FBI's leadership must delete or revise the May PSA. In exchange, they promised not to sell the database.
🛠 Technical Vector: How Did They Get In?
Unlike past major breaches (such as the Snowflake campaign) that relied heavily on stolen credentials, this attack was purely technical:
1. Application Vulnerability: The attack targeted a flaw within the web application hosted on the public-facing FBIJobs.gov server.
2. Missing Patches: Mandiant analysts discovered that hackers exploited a critical, newly discovered flaw in Oracle PeopleSoft (CVE-2026-35273). A patch had been available since June 2026, but the FBI simply... failed to apply it.
3. Data Volume: Once inside the server, ShinyHunters claimed to have exfiltrated between 2 and 3 terabytes of data.
📦 Inside the Archives (Spoiler: It's Worse Than It Looks)
To prove the breach, the group shared a sample of 5,000 records with journalists. The FBI has officially acknowledged the incident and sent out internal alerts: the bureau is operating under the assumption that every employee's data has been compromised.
The leaked data includes:
• Full names, home addresses, personal phone numbers, SSNs, and emergency contact details.
• Information on employee spouses.
• 🩸 The most absurd part: Medical screening results for special agents (ranging from blood and urine analysis to medical notes like "banana allergy").
🕵️♂️ The Real-World Danger
For undercover operatives and counterintelligence officers, this is a national security nightmare. Stolen samples already show data of personnel assigned to sensitive desks (including operations involving Russia, China, and Iran). Their residential addresses are now exposed, leaving them and their families vulnerable to physical and digital targeting.
⚖️ An Ironic Twist
While ShinyHunters was busy issuing ultimatums to the Bureau, the Dutch National Police quietly arrested one of the group's key members in Amsterdam.
Immediately following the arrest (around September 28–29), the group's tone shifted dramatically. They walked back their threats, stating they would fully refrain from leaking or selling the FBI database. It seems the "marketing campaign" went a step too far.
The takeaway: Even if you are the world's leading law enforcement agency, patching Oracle PeopleSoft on time is not a luxury—it's basic hygiene.
++++
🚨 The Kiteworks Global Kill Switch: A "Rescue" from Intelligence Agencies or the Death of Privacy?
US cybersecurity giant Kiteworks (formerly Accellion)—whose "secure" file-sharing platforms are used by thousands of corporations worldwide—orchestrated an unprecedented spectacle. On September 25, 2026, the company announced an emergency nine-hour global system shutdown, forcing administrators to manually take servers offline.
But stripping away the rhetoric, for any information security specialist, the picture
looks like this:
* A convenient excuse: Blaming one’s own buggy code and yet another developer screw-up on a "Big Brother warning" is a stroke of genius for avoiding lawsuits. No admission of fault means no compensation for nine hours of business downtime.
* Kiteworks is an unreliable partner: instead of releasing a hotfix that wouldn't interrupt operations, the vendor simply offloaded the problem onto its customers.
* Goodbye, privacy: The statement regarding "assistance from intelligence agencies" is an official admission that Kiteworks software is under the complete surveillance of the likes of the FBI or CISA. If these agencies spot vulnerabilities within a proprietary product before the vendor itself does, it means backdoors are present. For commercial clients, this spells the automatic end of privacy.
Bottom line: The company's statement directly implies cooperation with intelligence agencies, as well as its complete inability to ensure the uninterrupted and secure operation of its systems.
US cybersecurity giant Kiteworks (formerly Accellion)—whose "secure" file-sharing platforms are used by thousands of corporations worldwide—orchestrated an unprecedented spectacle. On September 25, 2026, the company announced an emergency nine-hour global system shutdown, forcing administrators to manually take servers offline.
But stripping away the rhetoric, for any information security specialist, the picture
looks like this:
* A convenient excuse: Blaming one’s own buggy code and yet another developer screw-up on a "Big Brother warning" is a stroke of genius for avoiding lawsuits. No admission of fault means no compensation for nine hours of business downtime.
* Kiteworks is an unreliable partner: instead of releasing a hotfix that wouldn't interrupt operations, the vendor simply offloaded the problem onto its customers.
* Goodbye, privacy: The statement regarding "assistance from intelligence agencies" is an official admission that Kiteworks software is under the complete surveillance of the likes of the FBI or CISA. If these agencies spot vulnerabilities within a proprietary product before the vendor itself does, it means backdoors are present. For commercial clients, this spells the automatic end of privacy.
Bottom line: The company's statement directly implies cooperation with intelligence agencies, as well as its complete inability to ensure the uninterrupted and secure operation of its systems.
🔐 INCIDENT: ALDOGROUP.COM (ALDOSHOES.COM)
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: ALDOGROUP.COM (ALDOSHOES.COM)
🏢 About the company: ALDO Group is a Canadian multinational footwear and accessories retailer headquartered in Montreal, Quebec. Founded in 1972 by Aldo Bensadoun, the company designs, manufactures, and sells shoes, boots, handbags, and accessories through its ALDO and Call It Spring brands. Operating thousands of stores worldwide across over 100 countries, it serves both wholesale and direct retail markets. The claimed annual revenue is $2.0 billion, with a workforce of thousands globally.
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 424 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
* TSV files
* Software
* Project files
* CAD files
* Customer data
* Business records
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
Compromised users: 1396
External attack surface: 100
🌐 DETECTED INFRASTRUCTURE:
* MX records: alt1–alt4.aspmx.l.google.com (Google Workspace)
* SaaS services: No well-known cloud or SaaS service detected
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed ALDO Group on its leak site, claiming the theft of 424 GB of data and demanding that the company contact the group for negotiations. According to Clop's statement: "Your data will be leaked unless we are contacted for negotiations. This is your final warning." The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM. At the time of publication, ALDO Group had made no official statement confirming or denying the leak.
💫 Note: The high number of compromised users (1396) alongside zero compromised employees and zero third-party employee credentials may indicate that access to the environment was obtained primarily through external customer or partner accounts rather than through direct company employee credentials.
⏪ PREVIOUS INCIDENTS
December 2023 — LockBit (franchise partner systems)
On December 6, 2023, the LockBit ransomware group claimed an attack on ALDO, setting a ransom deadline of December 25. The company officially stated that the incident impacted the systems of an undisclosed franchise partner, not ALDO Group's own systems. An ALDO spokesperson emphasised: "No Aldo Group owned or operated systems were affected by this incident." According to KELA, the affected entity was an Israel-based ALDO franchise. No customer financial or payment card information was impacted.
2025 — ALDO Shoes Portugal Database Sale
A dark web listing appeared advertising the sale of a database from ALDO Shoes Portugal, reportedly containing approximately 146,000 customer orders. This is a separate incident, not linked to the LockBit or Clop attacks.
October 2024 — Apparel Group Leak
Cybernews researchers discovered a misconfigured AWS bucket belonging to Apparel Group (UAE), a distributor for Adidas, Levi‘s, Asics, and ALDO. The bucket contained nearly 2.4 million files — shipping labels revealing full names, home addresses, phone numbers, and order details of customers. At the time of publication, the bucket remained publicly accessible.
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: ALDOGROUP.COM (ALDOSHOES.COM)
🏢 About the company: ALDO Group is a Canadian multinational footwear and accessories retailer headquartered in Montreal, Quebec. Founded in 1972 by Aldo Bensadoun, the company designs, manufactures, and sells shoes, boots, handbags, and accessories through its ALDO and Call It Spring brands. Operating thousands of stores worldwide across over 100 countries, it serves both wholesale and direct retail markets. The claimed annual revenue is $2.0 billion, with a workforce of thousands globally.
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 424 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
* TSV files
* Software
* Project files
* CAD files
* Customer data
* Business records
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
Compromised users: 1396
External attack surface: 100
🌐 DETECTED INFRASTRUCTURE:
* MX records: alt1–alt4.aspmx.l.google.com (Google Workspace)
* SaaS services: No well-known cloud or SaaS service detected
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed ALDO Group on its leak site, claiming the theft of 424 GB of data and demanding that the company contact the group for negotiations. According to Clop's statement: "Your data will be leaked unless we are contacted for negotiations. This is your final warning." The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM. At the time of publication, ALDO Group had made no official statement confirming or denying the leak.
💫 Note: The high number of compromised users (1396) alongside zero compromised employees and zero third-party employee credentials may indicate that access to the environment was obtained primarily through external customer or partner accounts rather than through direct company employee credentials.
⏪ PREVIOUS INCIDENTS
December 2023 — LockBit (franchise partner systems)
On December 6, 2023, the LockBit ransomware group claimed an attack on ALDO, setting a ransom deadline of December 25. The company officially stated that the incident impacted the systems of an undisclosed franchise partner, not ALDO Group's own systems. An ALDO spokesperson emphasised: "No Aldo Group owned or operated systems were affected by this incident." According to KELA, the affected entity was an Israel-based ALDO franchise. No customer financial or payment card information was impacted.
2025 — ALDO Shoes Portugal Database Sale
A dark web listing appeared advertising the sale of a database from ALDO Shoes Portugal, reportedly containing approximately 146,000 customer orders. This is a separate incident, not linked to the LockBit or Clop attacks.
October 2024 — Apparel Group Leak
Cybernews researchers discovered a misconfigured AWS bucket belonging to Apparel Group (UAE), a distributor for Adidas, Levi‘s, Asics, and ALDO. The bucket contained nearly 2.4 million files — shipping labels revealing full names, home addresses, phone numbers, and order details of customers. At the time of publication, the bucket remained publicly accessible.
🔐 INCIDENT: PHILIPS.COM
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop (also known as Cl0p)
🎯 Compromised domain: PHILIPS.COM
🏢 About the company: Royal Philips is a Dutch multinational health technology company headquartered in Amsterdam. Founded in 1891, the company specialises in diagnostic imaging, patient monitoring, medical devices, and personal health products. Philips generated approximately €18 billion in 2025 sales and employs approximately 63,700 people with sales and services in more than 100 countries .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 13.5 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
* PDF drawings
* Diagrams
* Blueprints
* IT infrastructure data
A later analysis by BNR found that the stolen files included PDF documents with designs and technical drawings of MRI scanners and other medical equipment, as well as CAD files for 3D modelling .
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
* Compromised employees: 413
* Compromised users: 60,802
* Third-party employee credentials: 793
* External attack surface: 200
🌐 DETECTED INFRASTRUCTURE:
* MX records: philips-com.mail.protection.outlook.com (Microsoft 365)
* SaaS services: Atlassian, Smartsheet, Slack, Notion, OpenAI, Cloudflare, Airtable, Jamf, OneTrust
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed Philips on its leak site as part of a campaign affecting nearly 50 organisations, claiming the theft of 13.5 GB of data . Philips officially confirmed: "Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data. This has no impact on customer environments" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM (CVSS 9.8) . PTC began releasing patches on June 17, 2026; CISA added the flaw to its Known Exploited Vulnerabilities catalog. Clop deployed JSP webshells for persistence and data exfiltration . On October 6, 2026, BNR reported that Clop had published Philips' stolen data on the dark web after the company apparently did not enter negotiations .
💫 Note: The extraordinarily high HudsonRock figures (413 employees and 60,802 users) indicate extensive credential compromise via infostealers. Combined with 793 third-party employee credentials, this may suggest that access to the environment was obtained through both external accounts and the PTC vulnerability, rather than exclusively through direct employee credentials.
⏪ PREVIOUS INCIDENTS
June–July 2026 — CVE-2026-12569 in PTC Windchill/FlexPLM (Clop campaign)
This incident is part of a broader Clop campaign affecting nearly 50 organisations, including Shell (89 GB), General Electric, Fiserv, and others . The attack exploited a critical remote code execution flaw in PTC's PLM platforms. PTC began issuing patches on June 17, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and Germany's BSI issued overnight emergency notifications to PTC customers .
March 2026 — CVE-2026-4681 (related Windchill/FlexPLM flaw)
Germany's BSI took emergency action in March 2026 over a related flaw tracked as CVE-2026-4681 in Windchill and FlexPLM, indicating that Clop or other groups were already exploiting PTC products earlier in 2026
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop (also known as Cl0p)
🎯 Compromised domain: PHILIPS.COM
🏢 About the company: Royal Philips is a Dutch multinational health technology company headquartered in Amsterdam. Founded in 1891, the company specialises in diagnostic imaging, patient monitoring, medical devices, and personal health products. Philips generated approximately €18 billion in 2025 sales and employs approximately 63,700 people with sales and services in more than 100 countries .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 13.5 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
* PDF drawings
* Diagrams
* Blueprints
* IT infrastructure data
A later analysis by BNR found that the stolen files included PDF documents with designs and technical drawings of MRI scanners and other medical equipment, as well as CAD files for 3D modelling .
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
* Compromised employees: 413
* Compromised users: 60,802
* Third-party employee credentials: 793
* External attack surface: 200
🌐 DETECTED INFRASTRUCTURE:
* MX records: philips-com.mail.protection.outlook.com (Microsoft 365)
* SaaS services: Atlassian, Smartsheet, Slack, Notion, OpenAI, Cloudflare, Airtable, Jamf, OneTrust
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed Philips on its leak site as part of a campaign affecting nearly 50 organisations, claiming the theft of 13.5 GB of data . Philips officially confirmed: "Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data. This has no impact on customer environments" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM (CVSS 9.8) . PTC began releasing patches on June 17, 2026; CISA added the flaw to its Known Exploited Vulnerabilities catalog. Clop deployed JSP webshells for persistence and data exfiltration . On October 6, 2026, BNR reported that Clop had published Philips' stolen data on the dark web after the company apparently did not enter negotiations .
💫 Note: The extraordinarily high HudsonRock figures (413 employees and 60,802 users) indicate extensive credential compromise via infostealers. Combined with 793 third-party employee credentials, this may suggest that access to the environment was obtained through both external accounts and the PTC vulnerability, rather than exclusively through direct employee credentials.
⏪ PREVIOUS INCIDENTS
June–July 2026 — CVE-2026-12569 in PTC Windchill/FlexPLM (Clop campaign)
This incident is part of a broader Clop campaign affecting nearly 50 organisations, including Shell (89 GB), General Electric, Fiserv, and others . The attack exploited a critical remote code execution flaw in PTC's PLM platforms. PTC began issuing patches on June 17, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and Germany's BSI issued overnight emergency notifications to PTC customers .
March 2026 — CVE-2026-4681 (related Windchill/FlexPLM flaw)
Germany's BSI took emergency action in March 2026 over a related flaw tracked as CVE-2026-4681 in Windchill and FlexPLM, indicating that Clop or other groups were already exploiting PTC products earlier in 2026
🔐 INCIDENT: FISERV.COM
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: FISERV.COM
🏢 About the company: Fiserv, Inc. is an American multinational fintech company headquartered in Milwaukee, Wisconsin. Founded in 1984, it is a Fortune 500 company. Fiserv provides payments and financial technology solutions for banks, credit unions, and merchants, including the Clover platform for small and medium-sized businesses. The company reported $21.19 billion in 2025 revenue with approximately 38,000 employees .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 874 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
* Projects
* CAD files
* Windchill files
* Software (Soft)
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
* Compromised employees: 4
* Compromised users: 1064
* Third-party employee credentials: 170
* External attack surface: 104
🌐 DETECTED INFRASTRUCTURE:
MX records: mxa-00265f01.gslb.pphosted.com, mxb-00265f01.gslb.pphosted.com (Proofpoint)
Additional: FortiOS SSL-VPN credentials exposed via "FortiBleed" leak (CVE-2022-40684)
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed Fiserv on its leak site as part of a campaign affecting more than 40 organisations, claiming the theft of 874 GB of data . Fiserv officially stated: "Our comprehensive review to date has found no evidence of compromised customer, banking, transaction, or personal data" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM (CVSS 9.3) . Clop has not published sample files to support its claims .
_____
📅 Date of attackers' claim: August 12, 2026
🦠 Attacker: Ransomware group Clop
🎯 Compromised domain: FISERV.COM
🏢 About the company: Fiserv, Inc. is an American multinational fintech company headquartered in Milwaukee, Wisconsin. Founded in 1984, it is a Fortune 500 company. Fiserv provides payments and financial technology solutions for banks, credit unions, and merchants, including the Clover platform for small and medium-sized businesses. The company reported $21.19 billion in 2025 revenue with approximately 38,000 employees .
💰 Ransom demanded: not specified
📦 Total volume of the claimed archive: 874 GB
📂 WHAT IS CLAIMED ABOUT THE LEAK:
* Projects
* CAD files
* Windchill files
* Software (Soft)
🔓 ADDITIONAL COMPROMISE DATA (HudsonRock):
* Compromised employees: 4
* Compromised users: 1064
* Third-party employee credentials: 170
* External attack surface: 104
🌐 DETECTED INFRASTRUCTURE:
MX records: mxa-00265f01.gslb.pphosted.com, mxb-00265f01.gslb.pphosted.com (Proofpoint)
Additional: FortiOS SSL-VPN credentials exposed via "FortiBleed" leak (CVE-2022-40684)
🧾 STATUS:
⚠️ Claim by the hacker group Clop. On August 12, 2026, Clop listed Fiserv on its leak site as part of a campaign affecting more than 40 organisations, claiming the theft of 874 GB of data . Fiserv officially stated: "Our comprehensive review to date has found no evidence of compromised customer, banking, transaction, or personal data" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM (CVSS 9.3) . Clop has not published sample files to support its claims .
_____
🚨 FBI Data Breach: Hackers Claim Theft, Arrests Follow
📋 What Happened
The hacking group ShinyHunters claims to have breached the FBIJobs.gov portal and stolen sensitive personal data belonging to a vast number of current and former FBI employees and job applicants. According to the group, the stolen data includes names, home addresses, Social Security numbers, job assignments, and emergency contact details — and in some cases, information about spouses and family members .
The hackers claim to possess 2–3 terabytes of data, including details on personnel working in sensitive units focused on China, Russia, Hezbollah, and drug cartels. A former FBI counterintelligence operative described the haul as a "foreign intelligence service goldmine" .
🕐 Timeline
September 21–22, 2026: ShinyHunters posts a message on its dark-web site claiming responsibility for the breach. The FBIJobs.gov portal goes offline. The FBI confirms it is investigating "unauthorized activity" .
September 23, 2026: The FBI issues a public statement acknowledging the claim and says it is "actively and aggressively investigating" the matter. The point of breach remains undetermined .
September 28, 2026: ShinyHunters tells journalists it will not publish the stolen data .
September 29–30, 2026: The FBI's Cyber Division chief publicly warns remaining ShinyHunters members to come forward, saying: "You know how to find us, and we know how to find you" .
October 2–3, 2026: Reports emerge of a key arrest in Jordan .
🚔 Arrests
September 15, 2026 — Netherlands: Dutch police arrest Pepijn van der Stap, a 24-year-old "reformed hacker" employed as an offensive security lead at Neo Security. Van der Stap was previously convicted in 2023 for data theft and extortion. He is ordered held for 90 more days .
Late September / Early October — Jordan: Saif al-Din Khader (nickname "Rey") is arrested by Jordanian authorities. According to sources, he is cooperating with the FBI to help identify other members of the group. Jordan's state television confirmed the arrest, saying "investigations are ongoing" .
FBI Director Kash Patel commented on the Dutch arrest, stating: "More arrests are on the table" .
💬 "We Won't Publish"
On September 28, ShinyHunters sent a statement to journalists saying the group never intended to publish the stolen data. The group described its actions as a "marketing campaign" to combat what it called "disinformation" about its tactics .
The group had initially given the FBI a one-week ultimatum to retract a May advisory that characterized ShinyHunters as using harassment and threats. When the deadline passed without the FBI complying, ShinyHunters said the ultimatum was "not a deadline or a threat" .
⚠️ The Catch
ShinyHunters admits it cannot guarantee what happens to data samples it already shared with journalists. A representative stated: "We cannot guarantee... because that is out of our control and certain journalists violated our trust" .
Cybersecurity researchers remain skeptical. Ian Lin of Packetlabs noted: "You still can't trust them to keep safe your data... At any moment they could choose to use this data for their own additional purposes" .
🔍 What's Next
The FBI continues to investigate the breach and has not confirmed the full scope of the damage. The bureau is operating under the assumption that all employees' data may have been exposed . The investigation remains ongoing, and further arrests are possible.
📋 What Happened
The hacking group ShinyHunters claims to have breached the FBIJobs.gov portal and stolen sensitive personal data belonging to a vast number of current and former FBI employees and job applicants. According to the group, the stolen data includes names, home addresses, Social Security numbers, job assignments, and emergency contact details — and in some cases, information about spouses and family members .
The hackers claim to possess 2–3 terabytes of data, including details on personnel working in sensitive units focused on China, Russia, Hezbollah, and drug cartels. A former FBI counterintelligence operative described the haul as a "foreign intelligence service goldmine" .
🕐 Timeline
September 21–22, 2026: ShinyHunters posts a message on its dark-web site claiming responsibility for the breach. The FBIJobs.gov portal goes offline. The FBI confirms it is investigating "unauthorized activity" .
September 23, 2026: The FBI issues a public statement acknowledging the claim and says it is "actively and aggressively investigating" the matter. The point of breach remains undetermined .
September 28, 2026: ShinyHunters tells journalists it will not publish the stolen data .
September 29–30, 2026: The FBI's Cyber Division chief publicly warns remaining ShinyHunters members to come forward, saying: "You know how to find us, and we know how to find you" .
October 2–3, 2026: Reports emerge of a key arrest in Jordan .
🚔 Arrests
September 15, 2026 — Netherlands: Dutch police arrest Pepijn van der Stap, a 24-year-old "reformed hacker" employed as an offensive security lead at Neo Security. Van der Stap was previously convicted in 2023 for data theft and extortion. He is ordered held for 90 more days .
Late September / Early October — Jordan: Saif al-Din Khader (nickname "Rey") is arrested by Jordanian authorities. According to sources, he is cooperating with the FBI to help identify other members of the group. Jordan's state television confirmed the arrest, saying "investigations are ongoing" .
FBI Director Kash Patel commented on the Dutch arrest, stating: "More arrests are on the table" .
💬 "We Won't Publish"
On September 28, ShinyHunters sent a statement to journalists saying the group never intended to publish the stolen data. The group described its actions as a "marketing campaign" to combat what it called "disinformation" about its tactics .
The group had initially given the FBI a one-week ultimatum to retract a May advisory that characterized ShinyHunters as using harassment and threats. When the deadline passed without the FBI complying, ShinyHunters said the ultimatum was "not a deadline or a threat" .
⚠️ The Catch
ShinyHunters admits it cannot guarantee what happens to data samples it already shared with journalists. A representative stated: "We cannot guarantee... because that is out of our control and certain journalists violated our trust" .
Cybersecurity researchers remain skeptical. Ian Lin of Packetlabs noted: "You still can't trust them to keep safe your data... At any moment they could choose to use this data for their own additional purposes" .
🔍 What's Next
The FBI continues to investigate the breach and has not confirmed the full scope of the damage. The bureau is operating under the assumption that all employees' data may have been exposed . The investigation remains ongoing, and further arrests are possible.