{"uuid": "0c16afd9-5517-4f89-90ab-5e0d9f8f7722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "seen", "source": "https://t.me/baseleeak/407", "content": "\ud83d\udd10 INCIDENT: IRCO.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: IRCO.COM\n\n\ud83c\udfe2 About the company: Ingersoll Rand Inc. is an American industrial conglomerate and one of the global leaders in mission-critical flow creation and industrial solutions. The company was founded in 1859, with its headquarters in Davidson, North Carolina, USA. Revenue for 2025 was $7.65 billion, up 6% year over year . Guidance for 2026 is $8.1\u20138.5 billion . The company manages a portfolio of more than 80 brands and serves customers in manufacturing, construction, and energy .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 5564 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 CAD files\n\u2022 PDF drawings\n\u2022 Diagrams\n\u2022 Product presentations\n\u2022 Specifications\n\u2022 Manuals and instructions\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 125\n\u2022 Compromised users: 45\n\u2022 Third-party employee credentials: 108\n\u2022 External attack surface: 83\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: irco-com.mail.protection.outlook.com (Microsoft 365)\n\u2022 SPF record: includes spf.protection.outlook.com, mail.zendesk.com, servers.mcsv.net, amazonses.com, and others\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed IRCO.COM on its leak site as part of a campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM . According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . However: Ransomware.live flags this entry as a \"duplicate\" \u2014 the same domain appears in the database with a note about possible duplication . Moreover, IRCO.COM had already appeared in other groups' lists: in March 2026 it was \"attacked\" by the ALP-001 group with a ransom deadline of March 29 and a claimed volume of 5.9 TB , and in August by the Everest group . At the time of publication, there is no independent confirmation of the leak and no official statement from Ingersoll Rand.\n\n\ud83d\udcab Note: The incident raises significant doubts about its credibility. The same domain has been claimed by at least three different ransomware groups (ALP-001, Everest, Clop) within a few months, and the Clop entry is flagged as a duplicate in tracking databases. The data claimed to have been leaked (CAD files, drawings, specifications) relates to engineering documentation, which is typical for attacks via PLM systems, but the 5.5 TB volume and repeated claims may indicate either a real compromise with repeated monetization or an extortion attempt using previously stolen or fabricated data. Notably, Ingersoll Rand's 2025 financial statements include a line item \"Cybersecurity incident costs\" with a negative value (-$1.3M), which may indirectly indicate settlement of incident consequences in the past .", "creation_timestamp": "2026-09-29T06:45:49.000000Z"}