AMSTERDAM: A prolific hacking group known for exploiting software vulnerabilities to attack multiple targets simultaneously claimed it had stolen large volumes of data from nearly 50 companies worldwide including Philips, Shell, Fiserv and GE, according to a posting on the group’s website.
Philips said it had been targeted by Cl0p while Shell said it was aware of a recent “possible incident”, confirming an earlier report on Thursday by Dutch media outlet BNR.
“We are working with our security teams and relevant experts to investigate the situation,“ a Shell spokesman said.
“Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data,“ Philips said in a statement, adding that the incident does not impact customer environments.
A spokesman for Fiserv said the company is aware of the threat actor’s claims, but “based on our comprehensive review to date”, it had found no evidence that customer, banking, transaction or personal data had been compromised, or that its operating environment had been affected.
A GE spokesman said the company is aware of the claim, and had “initiated our cyber response protocols and are working to assess the potential issue.”
Reuters could not independently verify the hacking group’s claims regarding the kind of data it stole and how much.
While it’s not clear how the hackers allegedly accessed the companies, Ransom-ISAC, an industry information sharing group, issued a notice July 22 warning that the hacking group was exploiting vulnerabilities in PTC Windchill and FlexPLM, software used to aid in engineering and manufacturing processes.
Boston-based PTC did not immediately respond to a request for comment. The company has issued multiple security notices to its website, dating to June 18, urging customers to apply a patch for a vulnerability and sharing details about an unnamed attacker attacking its products.
Brandon Parsons, threat intelligence manager with Ascent Solutions and the author of the Ransom-ISAC advisory, said some companies began receiving notices from Cl0p on July 19 or July 20. The group focuses on vulnerabilities in key software packages rather than specific companies, he said, calling them “professional data extortionists.”
“They don’t really target a specific company, they target a specific zero day vulnerability and go after it,“ Parsons said.
