{"uuid": "d8addbcc-e0db-4448-bda5-41868f1c87ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12569", "type": "exploited", "source": "https://t.me/baseleeak/398", "content": "\ud83d\udd10 INCIDENT: PARTECH.COM\n\n\ud83d\udcc5 Date of attackers' claim: August 12, 2026\n\n\ud83e\udda0 Attacker: Ransomware group Clop\n\n\ud83c\udfaf Compromised domain: PARTECH.COM\n\n\ud83c\udfe2 About the company: According to Clop's claim, PARTECH.COM belongs to a company with annual revenue of $475,700,000. However, precise identification is complicated: the domain partech.com is associated with two distinct organizations \u2014 French venture capital firm Partech (offices in Paris, San Francisco, Berlin, Dakar; \u20ac1.5B under management)  and American PAR Technology Corporation (NYSE: PAR), whose fiscal year 2026 revenue guidance is $516\u2013523 million . The claimed revenue of $475.7 million is closer to PAR Technology's figures than to Partech's estimates ($39.2M) . Clop does not specify which entity is the actual victim.\n\n\ud83d\udcb0 Ransom demanded: not specified\n\n\ud83d\udce6 Total volume of the claimed archive: 24 GB\n\n\ud83d\udcc2 WHAT IS CLAIMED ABOUT THE LEAK:\n\n\u2022 Databases\n\u2022 Project files\n\u2022 CAD files\n\u2022 Backups\n\n\ud83d\udd13 ADDITIONAL COMPROMISE DATA (HudsonRock):\n\n\u2022 Compromised employees: 2\n\u2022 Compromised users: 8\n\u2022 Third-party employee credentials: 16\n\u2022 External attack surface: 16\n\n\ud83c\udf10 DETECTED INFRASTRUCTURE:\n\n\u2022 MX records: partech-com.mail.protection.outlook.com (Microsoft 365)\n\u2022 SaaS services (per TXT records): Atlassian, Wrike, Amazon, Shopify, Google, Cloudflare, Smartsheet, BrowserStack, Zoom, Anthropic, Miro, ConfigCat, Intacct, and others\n\n\ud83e\uddfe STATUS:\n\u26a0\ufe0f Claim by the hacker group Clop. On August 12, 2026, Clop listed PARTECH.COM on its leak site, claiming the theft of 24 GB of data. According to Clop's standard statement: \"The full leak will be published soon unless a company representative contacts us via the channels provided\" . The attack is part of a large-scale Clop campaign in August 2026 linked to the exploitation of critical vulnerability CVE-2026-12569 in PTC Windchill and FlexPLM . At the time of publication, there is no independent confirmation of the leak and no official statement from the company.\n\n\ud83d\udcab Note: The most significant feature of this incident is the ambiguity in victim identification. The domain partech.com is used by at least two organizations with different profiles, which complicates assessing the credibility of the claim and the potential impact. If the victim is PAR Technology (a restaurant technology provider), the leak of CAD files and backups could affect intellectual property and client data; if Partech (a venture capital firm), it could involve confidential information of portfolio companies and investors.\n\n\u2014\u2014", "creation_timestamp": "2026-09-22T00:00:09.010789Z"}