{"uuid": "80e7a097-8a73-4604-82cd-bd05e95e9e4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/397", "content": "\ud83d\udd10 INCIDENT: MAMMUT.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: MAMMUT.COM\n\n\ud83c\udfe2 About the company: Mammut Sports Group AG is a Swiss manufacturer of high-quality outdoor equipment and apparel for mountaineering and climbing. The company was founded in 1862, with its headquarters in Seon, Switzerland. Mammut operates in around 40 countries and employs approximately 800 people . In 2026, the company was acquired by Chinese private equity firm CPE\u6e90\u5cf0 from Jacobs Capital . Revenue for 2025 was approximately 400 million Swiss francs (roughly $281 million at current exchange rates) .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 136 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 .png files\n\u2022 Windchill files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 1\n\u2022 Compromised users: 173\n\u2022 Third-party employee credentials: 1\n\u2022 External attack surface: 42\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: mx1.mammut.ch, mx2.mammut.ch \n\u2022 SaaS services: Apple, Atlassian, Microsoft 365, SendGrid \n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed MAMMUT.COM on its leak site, claiming the theft of 136 GB of data. According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM. Important: RedPacket Security notes that listings attributed to Clop \"have been reported as including unverified or fabricated victim claims\" . At the time of publication, there is no independent confirmation of the leak and no official statement from Mammut.\n\n\ud83d\udcab Note: This is not the first attack on Mammut. In May 2025, the company was already targeted by ransomware group DATACARRY, which, according to trackers, also operated through credential compromise (infostealer) . A repeat appearance on victim lists within a year may indicate either persistent credential security issues or reuse of previously stolen data.\n\n\u2014\u2014", "creation_timestamp": "2026-09-19T01:00:03.538606Z"}