Named Is Not Breached
When Hackers Name a Firm You Rely On
In August 2026 the Cl0p extortion group named dozens of organizations, Shell and Fiserv among them, after a campaign against PTC's Windchill software, and several answered with carefully bounded statements. This brief asks what a leak-site entry establishes about a named organization and what it leaves open. Built from the campaign chronology, company responses and the record of earlier leak-site claims. For security, legal and family office staff deciding how to respond and record when a vendor is named.
Unlock this Command Brief.
Get this assessment, the full subscription collection, and new intelligence as it is published.
For your first year, then $100/month. Or $750 for the first year, then $1,000 annually.
- The CORGI Morning Brief, each morning
- This brief and the subscription collection, 90+ briefs
- New Command Briefs as they are released
- Principal and Analyst briefs, as PDF
Secure checkout through Substack. Substack asks for your email first.
How it happens
Extortion and leak publication
Extortion groups publish or list stolen data, and the listing itself shapes exposure.
More on breach and custody →- Defender failureMeasurement misread. A metric or record is read as measuring something it does not (reach as people, coverage as resolution, a notice or payment as closure, a score as a fixed property).