https://vulnerability.circl.lu/sightings/feed 2026-09-25T21:19:24.709381+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d8addbcc-e0db-4448-bda5-41868f1c87ce/export 2026-09-25T21:19:24.739074+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d8addbcc-e0db-4448-bda5-41868f1c87ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/398", "content": "\ud83d\udd10 INCIDENT: PARTECH.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: PARTECH.COM\n\n\ud83c\udfe2 About the company: According to Clop's claim, PARTECH.COM belongs to a company with annual revenue of $475,700,000. However, precise identification is complicated: the domain partech.com is associated with two distinct organizations \u2014 French venture capital firm Partech (offices in Paris, San Francisco, Berlin, Dakar; \u20ac1.5B under management) and American PAR Technology Corporation (NYSE: PAR), whose fiscal year 2026 revenue guidance is $516\u2013523 million . The claimed revenue of $475.7 million is closer to PAR Technology's figures than to Partech's estimates ($39.2M) . Clop does not specify which entity is the actual victim.\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 24 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\u2022 CAD files\n\u2022 Backups\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 2\n\u2022 Compromised users: 8\n\u2022 Third-party employee credentials: 16\n\u2022 External attack surface: 16\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: partech-com.mail.protection.outlook.com (Microsoft 365)\n\u2022 SaaS services (per TXT records): Atlassian, Wrike, Amazon, Shopify, Google, Cloudflare, Smartsheet, BrowserStack, Zoom, Anthropic, Miro, ConfigCat, Intacct, and others\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed PARTECH.COM on its leak site, claiming the theft of 24 GB of data. According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM . At the time of publication, there is no independent confirmation of the leak and no official statement from the company.\n\n\ud83d\udcab Note: The most significant feature of this incident is the ambiguity in victim identification. The domain partech.com is used by at least two organizations with different profiles, which complicates assessing the credibility of the claim and the potential impact. If the victim is PAR Technology (a restaurant technology provider), the leak of CAD files and backups could affect intellectual property and client data; if Partech (a venture capital firm), it could involve confidential information of portfolio companies and investors.\n\n\u2014\u2014", "creation_timestamp": "2026-09-22T00:00:09.010789Z"} 2026-09-22T00:00:09.010789+00:00 https://vulnerability.circl.lu/sighting/bca0dd7d-cd82-45cf-ac8e-027f692d7ded/export 2026-09-25T21:19:24.740771+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bca0dd7d-cd82-45cf-ac8e-027f692d7ded", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/399", "content": "\ud83d\udd10 INCIDENT: STARKEY.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: STARKEY.COM\n\n\ud83c\udfe2 About the company: Starkey Hearing Technologies, Inc. is an American hearing aid manufacturer founded in 1967. Its headquarters is located in Hopkins, Minnesota, USA. The company is the largest American-owned hearing aid manufacturer and ranks among the global top five with a market share of around 15% . Starkey specialises in AI-integrated hearing aids with features such as step tracking, fall detection, and language translation . Its annual revenue is approximately $1 billion .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 3030 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 10\n\u2022 Compromised users: 11\n\u2022 Third-party employee credentials: 18\n\u2022 External attack surface: 38\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: starkey-com.mail.protection.outlook.com (Microsoft 365) \n\u2022 SaaS services (per TXT records): Dynatrace, Google, Apple, Cisco, Anthropic, Firebase, Zapier, Microsoft, OpenAI, KnowBe4 \n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed STARKEY.COM on its leak site, claiming the theft of 3030 GB of data and demanding that the company contact the group for negotiations. According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM. At the time of publication, there is no independent confirmation of the leak and no official statement from Starkey.\n\n\ud83d\udcab Note: Starkey is the only American-owned hearing aid manufacturer and an active player in AI-driven medical technology. The 3030 GB leak volume is one of the largest in the current Clop attack wave, which may indicate a significant volume of intellectual property, including project data and research databases.\n\n____", "creation_timestamp": "2026-09-22T00:00:08.948714Z"} 2026-09-22T00:00:08.948714+00:00 https://vulnerability.circl.lu/sighting/ff8024a1-2aa6-4cb2-92c6-a2754018dbbf/export 2026-09-25T21:19:24.740883+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ff8024a1-2aa6-4cb2-92c6-a2754018dbbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/400", "content": "\ud83d\udd10 INCIDENT: LARGAN.COM.TW\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: LARGAN.COM.TW\n\n\ud83c\udfe2 About the company: Largan Precision Co., Ltd. is a Taiwanese optical lens manufacturer and a key supplier of camera modules for Apple. The company was founded in 1987, with its headquarters in Taichung, Taiwan. Largan is the world's largest manufacturer of smartphone lenses and holds a significant share of the high-end optics market. Its claimed annual revenue is $1.7 billion.\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 56 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Project files\n\u2022 Software (Soft)\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 0\n\u2022 Compromised users: 43\n\u2022 Third-party employee credentials: 0\n\u2022 External attack surface: 6\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: mail.largan.com.tw, mailgw1.largan.com.tw, mailgw2.largan.com.tw \n\u2022 SPF record: v=spf1 ip4:219.87.176.11 ip4:219.87.176.7 ip4:60.248.234.226 ip4:123.51.154.9 -all \n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed LARGAN.COM.TW on its leak site as part of a large-scale campaign linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.8) in PTC Windchill and FlexPLM . The vulnerability involves insecure deserialization and improper input validation, allowing an unauthenticated remote attacker to execute arbitrary code . Clop used a custom JSP web shell to access Windchill data, including credential decryption and file exfiltration . Largan Precision is listed among more than 40 alleged victims in the campaign alongside Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others . According to Clop's statement: \"The full database will be leaked if Largan Precision Co., Ltd. does not contact us to negotiate\" . At the time of publication, there is no independent confirmation of the leak and no official statement from the company.\n\n\ud83d\udcab Note: Largan Precision is a critical Apple supplier in the camera module supply chain, which makes a potential leak of project data and software particularly sensitive. However, the absence of compromised employees (0) alongside 43 compromised users may indicate access through external accounts or contractors rather than direct employee credentials.", "creation_timestamp": "2026-09-22T00:00:08.885602Z"} 2026-09-22T00:00:08.885602+00:00 https://vulnerability.circl.lu/sighting/b45b42ae-b21f-4461-a12d-dbc2a392d134/export 2026-09-25T21:19:24.740972+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b45b42ae-b21f-4461-a12d-dbc2a392d134", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/393", "content": "\ud83d\udd10 INCIDENT: SMAPCENTER.UAH.EDU\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: SMAPCENTER.UAH.EDU\n\n\ud83c\udfe2 About the organization: SMAP Center (Systems Management and Production Center) is a research center at the University of Alabama in Huntsville (UAH). The center participates in U.S. Department of Defense research, particularly on diminishing manufacturing sources and material shortages (DMSMS) in weapon systems, and also runs STEM education and medical simulation projects (MEDNET). UAH's annual research expenditure is about $154.5 million, with 17 research centers at the university. The center's estimated revenue is $113 million.\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 6.08 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA:\n\n\u2022 Compromised employees: not disclosed\n\u2022 Compromised users: not disclosed\n\u2022 Third-party employee credentials: not disclosed\n\u2022 External attack surface: not disclosed\n\nNote: No HudsonRock data was found for SMAPCENTER.UAH.EDU. The attack vector was a server-side application vulnerability (PTC Windchill RCE), not endpoint infostealer malware, so no infostealer credential data is expected for this target. To verify manually, the domain can be checked via HudsonRock's free lookup tool.\n\n\ud83c\udf10 INFRASTRUCTURE:\n\n\u2022 IP address: 146.229.99.30, Huntsville, Alabama, USA\n\u2022 ASN: AS10364, University of Alabama in Huntsville (UAH)\n\u2022 Subdomain: apps.smapcenter.uah.edu (time-tracking system, protected by DUO MFA)\n\u2022 Owning entity: Systems Management and Production Center, UAH research center, network range 146.229.0.0/16\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM. The vulnerability is an insecure deserialization flaw enabling remote code execution via the wt.fv.uploadtocache.DoUploadToCache_Server upload path. In Windchill environments, Clop deployed a custom JSP web shell capable of decrypting credentials, enumerating file vaults, and exfiltrating engineering data, receiving commands via a custom X-windchill-req HTTP header. The same campaign wave included Shell, Philips, General Electric, and roughly 50 other organizations. According to Clop's statement, \"The full leak will be published soon, unless a university representative contacts us.\" At this time, there is no independent confirmation of the leak and no official statement from UAH or the SMAP Center.\n\n\ud83d\udcab Note: The SMAP Center is tied to defense research and management systems for the U.S. Department of Defense, which makes it a particularly sensitive target for extortionists.\n\n---", "creation_timestamp": "2026-09-19T01:00:03.629705Z"} 2026-09-19T01:00:03.629705+00:00 https://vulnerability.circl.lu/sighting/9b9fa9c8-4f1c-4742-9711-51d4b85a3d2e/export 2026-09-25T21:19:24.741059+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9b9fa9c8-4f1c-4742-9711-51d4b85a3d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/396", "content": "\ud83d\udd10 INCIDENT: CORNELIUS.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: CORNELIUS.COM\n\n\ud83c\udfe2 About the company: Cornelius Inc. is an American manufacturer of beverage dispensing equipment, founded in 1931. The company specialises in fountain, frozen, and juice dispensers, as well as commercial ice machines. Cornelius is part of Marmon Foodservice Technologies, which in turn is owned by Marmon Holdings and Berkshire Hathaway. Its headquarters is located in Osseo, Minnesota, USA. Products are supplied to more than 100 countries, and its workforce numbers between 1,000 and 5,000 employees . The claimed annual revenue is $269.8 million .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 3684 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\u2022 PDF documents\n\u2022 TXT files\n\u2022 DOC documents\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 0\n\u2022 Compromised users: 12\n\u2022 Third-party employee credentials: 16\n\u2022 External attack surface: 3\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: cornelius-com.mail.protection.outlook.com (Microsoft 365)\n\u2022 SaaS services: Microsoft 365, Smartsheet\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed Cornelius Inc. on its leak site, claiming the theft of 3684 GB of data and demanding that the company contact the group for negotiations. According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM. However, on August 13, 2026, it emerged that law firm Bryson, Harris, Suciu, DeMay PLLC had launched an investigation into the potential data breach, inviting current and former employees as well as commercial distributors to participate in a preliminary investigation for a potential class action lawsuit . At the time of publication, Cornelius Inc. had made no official statement confirming or denying the leak.\n\n\ud83d\udcab Note: The absence of compromised employees (0) alongside 12 compromised users and 16 third-party employee credentials may indicate that access to the environment was obtained primarily through external accounts or contractors rather than through direct company employee credentials.\n\n---", "creation_timestamp": "2026-09-19T01:00:03.590470Z"} 2026-09-19T01:00:03.590470+00:00 https://vulnerability.circl.lu/sighting/80e7a097-8a73-4604-82cd-bd05e95e9e4d/export 2026-09-25T21:19:24.741140+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "80e7a097-8a73-4604-82cd-bd05e95e9e4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/397", "content": "\ud83d\udd10 INCIDENT: MAMMUT.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: MAMMUT.COM\n\n\ud83c\udfe2 About the company: Mammut Sports Group AG is a Swiss manufacturer of high-quality outdoor equipment and apparel for mountaineering and climbing. The company was founded in 1862, with its headquarters in Seon, Switzerland. Mammut operates in around 40 countries and employs approximately 800 people . In 2026, the company was acquired by Chinese private equity firm CPE\u6e90\u5cf0 from Jacobs Capital . Revenue for 2025 was approximately 400 million Swiss francs (roughly $281 million at current exchange rates) .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 136 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 .png files\n\u2022 Windchill files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 1\n\u2022 Compromised users: 173\n\u2022 Third-party employee credentials: 1\n\u2022 External attack surface: 42\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: mx1.mammut.ch, mx2.mammut.ch \n\u2022 SaaS services: Apple, Atlassian, Microsoft 365, SendGrid \n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed MAMMUT.COM on its leak site, claiming the theft of 136 GB of data. According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . The attack is part of a large-scale Clop campaign linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM. Important: RedPacket Security notes that listings attributed to Clop \"have been reported as including unverified or fabricated victim claims\" . At the time of publication, there is no independent confirmation of the leak and no official statement from Mammut.\n\n\ud83d\udcab Note: This is not the first attack on Mammut. In May 2025, the company was already targeted by ransomware group DATACARRY, which, according to trackers, also operated through credential compromise (infostealer) . A repeat appearance on victim lists within a year may indicate either persistent credential security issues or reuse of previously stolen data.\n\n\u2014\u2014", "creation_timestamp": "2026-09-19T01:00:03.538606Z"} 2026-09-19T01:00:03.538606+00:00 https://vulnerability.circl.lu/sighting/f2f4ba9c-d87c-4fda-a875-2bb540794c9a/export 2026-09-25T21:19:24.741222+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f2f4ba9c-d87c-4fda-a875-2bb540794c9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/VulnerabilityNews/43190", "content": "First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild\n\nCISA has added the remote code execution flaw CVE-2026-12569 to its Known Exploited Vulnerabilities catalog.\nThe post First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/", "creation_timestamp": "2026-09-18T05:00:05.116433Z"} 2026-09-18T05:00:05.116433+00:00 https://vulnerability.circl.lu/sighting/b4e3d2e0-f62d-487c-a447-f00a09b3138d/export 2026-09-25T21:19:24.741294+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b4e3d2e0-f62d-487c-a447-f00a09b3138d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/392", "content": "\ud83d\udd10 INCIDENT: SUUNTO.CN (SUUNTO.COM)\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: SUUNTO.CN (SUUNTO.COM)\n\n\ud83c\udfe2 About the company: Suunto Oy is a Finnish manufacturer of sports watches, dive computers, and precision instruments. The company was founded in 1936, and its headquarters is located in Vantaa, Finland. In 2022, Suunto was acquired from Amer Sports by Chinese company Liesheng Technology . The brand's products are sold in more than 100 countries worldwide . The estimated annual revenue is approximately $108\u2013111 million .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 1470 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 1\n\u2022 Compromised users: 3139\n\u2022 Third-party employee credentials: 4\n\u2022 External attack surface: 101\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM . The attackers deployed a custom JSP web shell capable of decrypting credentials, exfiltrating files, and enabling remote code execution . According to Clop's statement, \"The full leak will be published soon, unless a company representative contacts us\" . At this time, there is no independent confirmation of the leak and no official statement from Suunto.\n\n\ud83d\udcab Note: Suunto is a Finnish brand with a 90-year history and global recognition. The detected infostealer traces (3139 compromised users, 4 third-party employee credentials) indicate that access to the environment may have been obtained not only through the Windchill vulnerability but also through previously compromised credentials, which significantly expands the attack surface.\n\n---", "creation_timestamp": "2026-09-18T00:00:09.764031Z"} 2026-09-18T00:00:09.764031+00:00 https://vulnerability.circl.lu/sighting/c5c8b4a3-b2e4-4ff1-95ac-bfb2a012b8b4/export 2026-09-25T21:19:24.741370+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c5c8b4a3-b2e4-4ff1-95ac-bfb2a012b8b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "seen", "source": "https://t.me/baseleeak/392", "content": "\ud83d\udd10 INCIDENT: SUUNTO.CN (SUUNTO.COM)\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: SUUNTO.CN (SUUNTO.COM)\n\n\ud83c\udfe2 About the company: Suunto Oy is a Finnish manufacturer of sports watches, dive computers, and precision instruments. The company was founded in 1936, and its headquarters is located in Vantaa, Finland. In 2022, Suunto was acquired from Amer Sports by Chinese company Liesheng Technology . The brand's products are sold in more than 100 countries worldwide . The estimated annual revenue is approximately $108\u2013111 million .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 1470 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 1\n\u2022 Compromised users: 3139\n\u2022 Third-party employee credentials: 4\n\u2022 External attack surface: 101\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM . The attackers deployed a custom JSP web shell capable of decrypting credentials, exfiltrating files, and enabling remote code execution . According to Clop's statement, \"The full leak will be published soon, unless a company representative contacts us\" . At this time, there is no independent confirmation of the leak and no official statement from Suunto.\n\n\ud83d\udcab Note: Suunto is a Finnish brand with a 90-year history and global recognition. The detected infostealer traces (3139 compromised users, 4 third-party employee credentials) indicate that access to the environment may have been obtained not only through the Windchill vulnerability but also through previously compromised credentials, which significantly expands the attack surface.\n\n---", "creation_timestamp": "2026-09-17T07:00:03.763316Z"} 2026-09-17T07:00:03.763316+00:00 https://vulnerability.circl.lu/sighting/0d305347-3fa4-4fb1-830f-f27379e6da6e/export 2026-09-25T21:19:24.741444+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0d305347-3fa4-4fb1-830f-f27379e6da6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mv3qzjh5wj2u", "content": "Clop ransomware group claims massive data theft from Shell, Philips, GE, and 40+ others by exploiting a critical PTC Windchill vulnerability (CVE-2026-12569). #Clop #Ransomware #SupplyChainAttack\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-09T14:34:17.372031Z"} 2026-09-09T14:34:17.372031+00:00