Harley-Davidson breach claimed by Cl0p gang with 270GB internal data dump

The Cl0p gang claims a 270 GB breach of Harley-Davidson internal networks – the motorcycle giant appearing to be the latest victim of the group’s most recent Windchill ransomware campaign.

Cl0p posted the legendary motorcycle company on its dark victim leak site on Thursday, eventually adding a “PUBLISHED VIA TORRENT, MAGNET LINK” next to its name.

The seasoned ransomware group declared Harley-Davidson to be one of four companies “THAT DID NOT REACH TO US.”

The magnet link directory shows a total of 270GB of data files in the massive cache.

Furthermore, after deeper analysis of the data on Monday, Cybernews researchers found not only a connection to Windchill, but a decade of Oracle EPM Workspace application logs – but more on that below.

A spokesperson for Harley-Davidson on Friday told Cybernews the 123-year-old company was aware of the claims but is declining to comment further at this time.

Internal Harley-Davidson files exposed

In typical fashion, the Cl0p gang has only provided a published link to the alleged Harley-Davidson data, allowing viewers to determine for themselves what the dump actually contains.

After reviewing the magnet directory and what was publicly accessible, it appears the leak could have ties to Cl0p’s most recent ransomware campaign targeting manufacturing companies that use Windchill PLM software.

Windchill, made by enterprise software company PTC, is one of the most widely used product lifecycle management platforms among major manufacturers globally.

The publicly viewable directory shows folders labeled for PTC Windchill 13 service pack and third-party software files – notable as Windchill 13 is the latest major software release. Image by Cybernews.

On top of those listed above, Cybernews viewed what appeared to be several other Windchill environment indicators, including the following:

• WC12 directory of application components, including install, jmxcore
• Windchill administrator home directory (/home/wcadmin/)
• Solr server, used for Windchill search and indexing
• Vaultlist text file, consistent with Windchill's file-storage architecture
• PublishModeLog and CheckModelInput files, potentially linked to production/application environment

Folders and file names also worth noting were related to system and administrative information, including server logs, processor and system configuration data, backup information, production environment files, and references to data vaults – although it is unknown what the individual files actually contain.

According to the Windchill-maker, PLM platforms handle real-time workflows between product data, engineers, manufacturers, and third-party suppliers across the entire organization – meaning the potential for sensitive and proprietary data to be exposed could be catastrophic.

Researchers uncover decade of Oracle EPM logs

Cybernews researchers on Monday said some of the data they downloaded appeared to be a backup of a development environment containing application logs.

Additionally, the technical stack appears to be linked to Oracle EPM Workspace, which is used mainly for business planning, strategy, and forecasting operations.

Cybernews researchers said the timestamps in the logs span a decade, from 2016 up until the present.

However, it was also noted that the wording in the files – EPM Workspace – is more often used in older versions of the Oracle tool – now commonly referred to as Oracle Cloud or EPM Cloud.

That could indicate Harley-Davidson is using an older version of the software, potentially exposing it to vulnerabilities that Oracle has since patched, the Cybernews researchers said.

Still, the team points out that unauthorized access to the workspace could allow hackers to “see detailed information on the company’s strategies to profit the most, what worked and didn’t work in the past, etc."

This info would be especially useful to competitors, especially if the data is now publicly available,

Cybernews researchers said.

To note, Cybernews attempted to examine the magnet links for GE, ALDO, and Henry Pratt, a global industrial valve manufacturer.

GE’s torrent showed roughly 390GB of data, although the publicly viewable portions consisted primarily of ZIP archives – no mention of Windchill. The ALDO and Henry Pratt directories were not viewable.

Cl0p’s Windchill campaign still expanding

The Cl0p ransomware gang, operating since at least 2019, is no stranger to major extortion, with past campaigns exploiting vulnerabilities in file transfer programs MOVEit, Fortra GoAnywhere, and Cleo.

The Russian-linked group spent most of 2025 extorting companies via a Remote Code Execution (RCE) zero-day in the cloud-based Oracle E-Business Suite (EBS).

In June, Cl0p shifted its focus to exploiting another RCE flaw – this one affecting PTC Windchill PLM systems.

The vulnerability – now patched and cataloged as CVE-2026-12569 – also happened to be a zero-day, allowing Cl0p to gain access to an unknown number of victims without warning.

In July, victims began reporting Cl0p extortion emails with the subject “Windchill PDMLink module serious data leak,” according to Reuters, with the gang publicly naming dozens of alleged victims by August, including GE, Philips, Shell and others.

As part of the latest extortion campaign, Cl0p also targeted PTC FlexPLM, a separate platform built on Windchill and specifically designed for retail manufacturers in apparel, footwear, and other consumer products – potentially explaining ALDO’s appearance on Thursday's list.

Over the years, the hacker group has compromised more than 3,000 major organizations, often publicly taunting victims on its dark leak site and raking in hundreds of millions of dollars.

The gang reportedly earned between $75 million and $100 million from the MOVEit hacks alone.

Ironically, Cl0p, known as a prolific “ransomware” group, appears increasingly uninterested in actually encrypting its victims' systems before exfiltrating their data – instead just focusing on the theft itself, researchers at ZeroFox said in an August profile on the gang.