Shell and Philips hit by Russian ransomware attack

The Russia-linked ransomware group Cl0p claims to have hacked global corporations Shell and Philips. The two are among nearly 50 companies Cl0p has listed on its website, alongside General Electric and payments firm Fiserv.

From the oil giant, the group says it has taken some 89 gigabytes of material, including technical drawings, facility images, scans of test reports and project plans. They claimed to have stolen another 13.5 gigabytes from health technology company Philips, mostly diagrams and blueprints.

Both companies are investigating, with Shell saying it is “aware of a possible incident”.

Philips said it had “identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data”. A spokesperson told NOS that the incident is now under control and has no impact on its customers.

Russian hackers

Cl0p, which has been active since 2019, is a Russia-linked ransomware group that has likely already extorted $500 million from other victims.

It operates by stealing files and other sensitive data from companies and then threatens to publish them online unless a ransom is paid.

There’s no word yet on how much money the hackers are asking for in exchange for not selling or releasing the stolen data.

Security researchers have linked the campaign to a flaw in Windchill, engineering software made by American firm PTC, which was patched on June 17. Neither Shell nor Philips has said how it was breached.

Writing about the attacks, TNW editor-in-chief Ana-Maria Stanciuc said the pattern carried an uncomfortable lesson: “When enough of the corporate world standardises on the same enterprise platform, one shared supplier quietly becomes everyone’s single point of failure, and no amount of internal security spending can fully patch a hole in someone else’s code.”