Attackers reached engineering files on internet-exposed PTC Windchill servers, then emailed hundreds of employees at the affected companies. No files were locked, and a restore does not undo a disclosure.
On 20 July, staff at manufacturers running PTC Windchill started receiving emails with the subject line "Windchill PDMLink module serious data leak". They arrived from randomly compromised third-party accounts, went to hundreds of employees at each company rather than to the security team, and claimed the company's product lifecycle management server had been stripped of engineering data. BleepingComputer reported the campaign on 24 July, after ReliaQuest and Ransom-ISAC confirmed active exploitation.
The way in was CVE-2026-12569, an unsafe deserialization flaw in PTC Windchill and FlexPLM rated CVSS 9.3. Chained with a pre-authentication information disclosure in the FlexPLM WSDL endpoint, it yields unauthenticated remote code execution on an internet-facing server. PTC shipped patches on 17 June; exploitation in the wild was reported the following day. CISA added the flaw to its Known Exploited Vulnerabilities catalog at the end of June and gave federal agencies three days to remediate.
Product lifecycle management is where a manufacturer keeps the design record: CAD models, drawings, revision history, bills of materials, tolerances, test results, supplier documentation. Once inside, the attackers deployed JSP web shells, enumerated the filesystem, staged engineering and design data and exfiltrated it. The sectors named across the reporting are aerospace, defense, automotive, heavy machinery, retail and medtech.
ReliaQuest has been careful about attribution, saying the actor "remains unconfirmed" while noting that the tradecraft resembles earlier Cl0p campaigns against enterprise applications and high-value data repositories. Those campaigns followed one shape: find a flaw in a widely deployed system that holds other people's documents, then work through every exposed instance at once. Accellion FTA, GoAnywhere MFT, MOVEit Transfer, Cleo and Oracle EBS all went that way.
Nothing in this campaign depends on encrypting a victim's files. The threat is publication: the stolen data goes on a leak site, and in past Cl0p campaigns onto BitTorrent, unless the company pays. As of 22 July no victims had been listed publicly, which fits the quiet phase of that model.
This changes which controls are worth anything. Backups, snapshots and disaster recovery answer the question "can we get our data back", and they answer it well. They say nothing about who else now has a copy. For a design that a competitor or a state program would like to read, secrecy was the whole value of the file.
A restore brings the file back. It does not bring back the secret.
These files were not taken from a storage product. They were taken from an application that stores files while doing something else, and they sat on its disk in a form the application could read. That is the ordinary arrangement in enterprise software, and it means the confidentiality of the files is bounded by the security of the entire application: its login servlet, its web endpoints, its deserialization routines, its patch cadence.
Note the interval between the 17 June patch and the 18 June exploitation report. Few organizations can regression-test and roll out a PLM upgrade in a day, and a PLM platform is exactly the kind of system that gets upgraded on a quarterly change window. Any defense that depends on winning that race will lose it eventually.
A live PLM system has to read the files it renders, versions and indexes, so client-side encryption is not a drop-in replacement for it. The live system is rarely the only copy, though. The drawing sent to a supplier, the package handed to a certification body, the archive of a closed program: none of those need a server able to open them.
That is the case SpaceBox Lite is built for. Files are encrypted on the sender's device with AES-256-GCM, under a key exchanged with post-quantum ML-KEM-768 (NIST FIPS 203). The private key stays on the recipient's device, so our servers hold ciphertext and nothing else, and a sender needs no account and hands over no personal data. Post-quantum key exchange is becoming ordinary practice across the industry rather than a SpaceBox feature; it matters for this class of file because a turbine or implant design stays sensitive for decades. Lite is free (1 MB, one sender, three files, with a voucher at beta.i46.space adding 100 MB and 100 files), and it is not available to EU/EEA residents during the beta.
For copies that are kept rather than sent, the property worth buying is unreachability. SpaceBox Ground is an on-premises appliance that is air-gapped and append-only, with retrieval gated behind multiple approvals. An engineering archive held that way cannot be reached through an unpatched web endpoint, because no endpoint stands between the internet and the archive. Why SpaceBox sets out how the pieces fit together.
Patching Windchill remains the first thing to do, and PTC's fix has been available since 17 June. The longer question this campaign raises is how many copies of your most sensitive files are sitting in readable form inside a system whose job is not to keep them secret.