Russian cybercrime group Clop published stolen data from Philips and Shell on the dark web on October 8, 2026, approximately two months after claiming the original breach. Clop says it has 89 gigabytes of Shell data, including construction drawings, facility photographs, test report scans, and project plans. BNR journalists reviewed the Philips material and found technical drawings of MRI scanners and other medical equipment, as well as Philips IT infrastructure information. Neither company confirmed paying a ransom. Shell’s published data could not be accessed by BNR. Both companies were investigating as of August.
The Two-Month Gap Between Claim and Publication
Clop first surfaced in 2019 offering ransomware as a service. These days the group’s approach has shifted, as BNR describes it, the focus is now on data theft and extortion rather than file encryption. The model is cleaner from the attacker’s perspective. There’s no technical recovery path for the victim. You either pay or your information goes up on a dark web page.
The August claim against Shell and Philips was consistent with Clop’s broader 2026 activity pattern. The group had been exploiting a then-unpatched vulnerability in Oracle’s E-Business Suite, a critical enterprise platform used widely across large corporations. That flaw, assigned CVE-2025-61882, gave Clop a way into dozens of corporate networks simultaneously, and Shell and Philips appear to be among the victims who fell through that window.
The two-month delay between the August announcement and the October publication is also consistent with Clop’s timeline. It’s not immediate publication. The group gives companies time to negotiate privately before making the data public. When companies don’t engage or engage but refuse to pay, the clock runs out. On October 8, it ran out for Shell and Philips.
What Was in the Data
Shell is one of the world’s largest energy companies. Clop claims 89 gigabytes of data, and what’s described in the listing is not just emails and spreadsheets.
Construction drawings. Photographs of facilities. Scans of test reports. Project plans.
That combination has a different risk profile from the typical corporate credential or customer database dump. Technical drawings of industrial facilities, oil and gas infrastructure in particular, represent sensitive operational information. They describe how facilities are physically structured, how systems interconnect, and where weak points may be. In the wrong hands, this kind of data could assist targeted physical attacks on infrastructure, support competitive intelligence gathering, or be sold to state actors with an interest in energy sector vulnerabilities.
BNR could not access Shell’s data directly. The reason wasn’t stated, it may be behind a paywall within the dark web listing or distributed through a different channel.
The Philips material was accessible and BNR reviewed it. What they found: technical drawings of MRI scanners and other medical devices, and information about Philips’ own IT infrastructure. BNR sent several files to Philips for verification.
Medical device technical drawings carry their own specific risks. They represent intellectual property developed over years of engineering work. They also describe the precise architecture of equipment used in clinical settings, which, if replicated without proper safety validation, creates patient risk. And the IT infrastructure information is useful for anyone planning a more targeted future attack against Philips’ network.
Clop’s Busiest Year
The Shell and Philips data publication sits in a context of sustained Clop activity through 2026.
Earlier in the year, Clop’s exploitation of the Oracle EBS zero-day reached more than 90 organizations across multiple sectors. The AudiA6 laundering case we covered earlier this year showed how ransomware proceeds from groups like Clop flow through layered cryptocurrency infrastructure. And in a particularly striking development in September, rival group ShinyHunters publicly hacked Clop’s own dark web leak site, claiming the group had stolen the Oracle zero-day exploit from them in the first place. As we covered in detail, ShinyHunters exploited a Grav CMS path traversal flaw to seize Clop’s infrastructure and steal their Tor private keys.
That internal criminal dispute and Clop’s response, didn’t slow the group’s victim operations. The Shell and Philips data went up regardless of whatever was happening inside the criminal ecosystem.
Clop’s current tactic of mass exploitation followed by staged publication is structurally similar to what we documented in the supply chain attack pattern analysis , one vulnerability, many victims, early warning signals in underground channels before the public becomes aware.
The Data Is Out. Now What?
This is where the situation becomes difficult to manage for both companies.
Once Clop publishes data on its dark web leak site, that data doesn’t disappear if the listing is later removed. It circulates. It gets copied. It reaches criminal channels and forums. It can be sold or redistributed months and years after the original publication.
The Shell facility drawings and the Philips MRI schematics are now in distribution. We’ve covered this exact problem in our piece on whether stolen data can actually be removed from the dark web, the honest answer is no, and the response shifts from “prevent exposure” to “limit the damage.”
For Shell, the practical consequences depend on what the construction drawings reveal and whether those details are already partially known through other public filings or permit documents. For Philips, the more immediate concern is likely the IT infrastructure information, which can guide follow-on intrusion attempts.
Neither company has confirmed paying a ransom. Neither has confirmed the scope of the breach independently. The investigation that both companies said they were conducting in August is presumably ongoing.
What This Means for Dutch Companies More Broadly
The Dutch corporate ecosystem has had a difficult few months. The Flink data breach we covered saw LPG Group directly contacting customers for ransom payments after Flink refused to pay, a pattern Clop also runs at the corporate level. The Flink customers ignored the demands too, and the data was subsequently listed for sale to the highest bidder.
Clop’s targets are larger. Shell and Philips are globally significant companies, not Dutch food delivery platforms. But the underlying dynamic is the same: companies are increasingly finding that refusing to pay results in data publication, and that data publication is becoming the norm rather than the exception.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has not publicly commented on the Shell or Philips publication as of the October 8 article. If personal data is confirmed in the published dataset, GDPR notification obligations would apply.
What’s publicly confirmed: the data is on the dark web. BNR verified part of it. Both companies were investigating as of August and have not said more since.
Frequently Asked Questions
Did Shell and Philips get hacked?
Both companies confirmed they were investigating claims in August 2026. Clop published what it says is stolen data in October after neither company paid. The breach origin is consistent with Clop’s Oracle EBS zero-day exploitation campaign, though neither company has independently confirmed exactly how the attackers got in.
What data was taken from Shell?
Clop claims 89 gigabytes of Shell data, including construction drawings of facilities, photographs of operational sites, scans of test reports, and project plans. BNR could not directly access the Shell dataset.
What data was taken from Philips?
BNR reviewed the Philips files and found technical drawings of MRI scanners and other medical devices, as well as information about Philips’ internal IT infrastructure. Several files were sent to Philips for verification.
Did Shell or Philips pay the ransom?
Neither company has confirmed paying. The publication of data in October strongly suggests no payment was made, Clop typically publishes only after ransom negotiations fail or are refused.
Is this data still on the dark web?
Once data is published on a dark web leak site it enters wider circulation quickly, regardless of whether the original listing is later removed. At the time of BNR’s investigation on October 8, the Philips data was accessible. Shell’s data could not be accessed by BNR.
Who is Clop?
A Russian cybercrime group active since 2019. It originally offered ransomware as a service but now focuses primarily on data theft and extortion, stealing corporate data, demanding payment, and publishing it if companies don’t comply. In September 2026, rival group ShinyHunters hacked Clop’s own dark web infrastructure.
