{"uuid": "b4e3d2e0-f62d-487c-a447-f00a09b3138d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/392", "content": "\ud83d\udd10 INCIDENT: SUUNTO.CN (SUUNTO.COM)\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: SUUNTO.CN (SUUNTO.COM)\n\n\ud83c\udfe2 About the company: Suunto Oy is a Finnish manufacturer of sports watches, dive computers, and precision instruments. The company was founded in 1936, and its headquarters is located in Vantaa, Finland. In 2022, Suunto was acquired from Amer Sports by Chinese company Liesheng Technology . The brand's products are sold in more than 100 countries worldwide . The estimated annual revenue is approximately $108\u2013111 million .\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 1470 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 1\n\u2022 Compromised users: 3139\n\u2022 Third-party employee credentials: 4\n\u2022 External attack surface: 101\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM . The attackers deployed a custom JSP web shell capable of decrypting credentials, exfiltrating files, and enabling remote code execution . According to Clop's statement, \"The full leak will be published soon, unless a company representative contacts us\" . At this time, there is no independent confirmation of the leak and no official statement from Suunto.\n\n\ud83d\udcab Note: Suunto is a Finnish brand with a 90-year history and global recognition. The detected infostealer traces (3139 compromised users, 4 third-party employee credentials) indicate that access to the environment may have been obtained not only through the Windchill vulnerability but also through previously compromised credentials, which significantly expands the attack surface.\n\n---", "creation_timestamp": "2026-09-18T00:00:09.764031Z"}