Fewer than 100 PTC Windchill instances were exposed to the internet
Assessment
Censys states this as its own observation as of 1 June 2026, with about 80 remaining on 20 July, 80% in the United States and roughly a quarter behind Akamai. The figure is verified as what Censys saw; it is not a count of all reachable instances. Passive fingerprinting undercounts hosts behind CDNs, on non-default paths, or exposing only FlexPLM endpoints. Set against Cl0p's 43 leak-site listings, the number implies either a very high exploitation rate or a larger real attack surface than observed. PTC states it has over 30,000 customers and has not published an exposure figure.
Where this claim appeared
Censys · 2026-07-30
https://censys.com/blog/cl0p-targets-windchill/What “Verified” means
Established by primary sources — the original disclosure, a vendor incident report, a court filing, a government advisory, or the affected party itself. Where a claim is material, at least two independent sources agree.
5 of 5 · rating scale
Assessed in
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion CampaignThink this assessment is wrong? Report an error.