{"id":40301,"date":"2021-03-29T23:46:22","date_gmt":"2021-03-29T23:46:22","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/"},"modified":"2021-03-29T23:46:22","modified_gmt":"2021-03-29T23:46:22","slug":"after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/","title":{"rendered":"After oil giant Shell hit by Clop ransomware gang, workers&#8217; visas dumped online as part of extortion attempt"},"content":{"rendered":"<p><span data-label=\"updated\">Updated<\/span> Royal Dutch Shell is the latest corporation to be attacked by the Clop ransomware gang.<\/p>\n<p>The extortionists siphoned sensitive documents from a software system used by the oil giant, and have now leaked online some of the data \u2013 notably a selection of workers&#8217; passport and visa scans \u2013 to chivy the corporation along to cough up a ransom. The idea being that if the ransom is paid, no more data will be dumped in public.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",button,mpu,\" data-sm=\",button,mpu,\" data-md=\",button,banner_plus,mpu\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener noreferrer\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Earlier this month, the oil giant admitted a file-transfer application had been compromised, writing in a statement that \u201can unauthorized party gained access to various files during a limited window of time.\u201d<\/p>\n<p>It attempted to <a target=\"_blank\" href=\"https:\/\/www.shell.com\/energy-and-innovation\/digitalisation\/news-room\/third-party-cyber-security-incident-impacts-shell.html\" rel=\"noopener noreferrer\">downplay<\/a> the impact noting that \u201cthere is no evidence of any impact to Shell\u2019s core IT systems,\u201d and the server accessed was \u201cisolated from the rest of Shell\u2019s digital infrastructure.\u201d But it did acknowledge that the crooks had probably grabbed \u201csome personal data and&#8230; data from Shell companies and some of their stakeholders.\u201d<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",button,mpu_plusplus,\" data-sm=\",button,mpu_plusplus,\" data-md=\",button,mpu_plusplus,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener noreferrer\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"promo_article\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/regmedia.co.uk\/2021\/02\/23\/shutterstock_bombardier_jet_assembly.jpg?x=174&amp;amp;y=115&amp;amp;crop=1\" width=\"174\" height=\"115\" alt=\"The Bombardier C-Series jet assembly line in Canada\"><\/p>\n<h2 title=\"And what may be CAD drawing of a military radar antenna\">Clop ransomware gang leaks online what looks like stolen Bombardier blueprints of GlobalEye radar snoop jet<\/h2>\n<p><a href=\"https:\/\/www.theregister.com\/2021\/02\/23\/bombardier_clop_ransomware_leaks\/\"><span>READ MORE<\/span><\/a><\/div>\n<p>To encourage Shell to pay off the thieves and prevent further stolen data from leaking, the gang has now uploaded to its Tor-hidden website a selection of documents, including scans of purported Shell employees\u2019 US visas as well as a passport page and files from its American and Hungarian offices.<\/p>\n<p>We&#8217;re not sharing a link to the material for obvious reasons.<\/p>\n<p>The theft and pressure tactics are just the latest in a string of crimes by the Clop gang, which has been primarily going after organizations that deployed <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2021\/01\/25\/asic_accellion_breach\/\" rel=\"noopener noreferrer\">vulnerable versions<\/a> of Accellion&#8217;s legacy file-transfer appliance, exploiting the software to steal internal information. And so it&#8217;s no surprise to see the oil giant note: &#8220;Shell has been impacted by a data security incident involving Accellion\u2019s File Transfer Appliance. Shell uses this appliance to securely transfer large data files.&#8221;<\/p>\n<p>A spokesperson for Shell was not available for immediate comment on the aforementioned leaks.<\/p>\n<p>Earlier this month, files from infosec outfit Qualys, including purchase orders, appliance scan results, and quotations also <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2021\/03\/03\/qualys_ransomware_clop_gang\/\" rel=\"noopener noreferrer\">appeared<\/a> on the extortionists&#8217; hidden site. And it&#8217;s far from alone.<\/p>\n<p>Other victims include Canadian aerospace firm <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2021\/02\/23\/bombardier_clop_ransomware_leaks\/\" rel=\"noopener noreferrer\">Bombardier<\/a>, which saw details of a military-grade radar leaked, London ad agency <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2021\/01\/22\/the7stars_ransomware_attack_clop\/\" rel=\"noopener noreferrer\">The7stars<\/a>, and German giant <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2020\/10\/09\/software_ag_ransomware\/\" rel=\"noopener noreferrer\">Software AG<\/a>.<\/p>\n<p>And to pile on the pressure, the Clop gang now emails the customers of its victims, warning that data has been stolen and will be leaked if a ransom isn&#8217;t paid, in an attempt to get said clients to demand the extortionists are paid off to keep quiet, <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/ransomware-gang-urges-victims-customers-to-demand-a-ransom-payment\/\">reported<\/a> BleepingComputer. \u00ae<\/p>\n<h3 class=\"crosshead\"> <span>Updated to add<\/span><br \/>\n<\/h3>\n<p>A PR person for Shell has been in touch to stress once again that the oil giant&#8217;s Accellion deployment was specifically attacked by thieves rather than its IT systems as a whole. Also, while the Clop gang has in the past infected victims with ransomware, which scrambles files and demands a ransom to restore them, in this case, the crooks simply stole information, according to the Shell spinner.<\/p>\n<p>&#8220;A cyber incident impacted a third-party, Accellion, software tool called the File Transfer Appliance (FTA) which is used within Shell,&#8221; she told us.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",button,dbutton,mpu_plus,dmpu,\" data-sm=\",button,dbutton,mpu_plus,dmpu,\" data-md=\",button,dbutton,mpu_plus,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener noreferrer\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>&#8220;Criminal hackers gained access to files sent by users of the Accellion tool in a short period of time. The incident was isolated to Accellion\u2019s tool and there is no evidence that it affected Shell\u2019s own IT systems. The compromised servers were rebuilt and brought into service with a new Accellion security patch. The security patch closes the vulnerabilities and enhances security controls to detect new attacks.&#8221; \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2021\/03\/29\/shell_clop_ransomware_leaks_update\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Another day, another data nightmare Updated\u00a0 Royal Dutch Shell is the latest corporation to be attacked by the Clop ransomware gang.\u2026  READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-40301","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>After oil giant Shell hit by Clop ransomware gang, workers&#039; visas dumped online as part of extortion attempt 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"After oil giant Shell hit by Clop ransomware gang, workers&#039; visas dumped online as part of extortion attempt 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-29T23:46:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"After oil giant Shell hit by Clop ransomware gang, workers&#8217; visas dumped online as part of extortion attempt\",\"datePublished\":\"2021-03-29T23:46:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/\"},\"wordCount\":628,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/\",\"name\":\"After oil giant Shell hit by Clop ransomware gang, workers' visas dumped online as part of extortion attempt 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2021-03-29T23:46:22+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"After oil giant Shell hit by Clop ransomware gang, workers&#8217; visas dumped online as part of extortion attempt\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"After oil giant Shell hit by Clop ransomware gang, workers' visas dumped online as part of extortion attempt 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/","og_locale":"en_US","og_type":"article","og_title":"After oil giant Shell hit by Clop ransomware gang, workers' visas dumped online as part of extortion attempt 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-03-29T23:46:22+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"After oil giant Shell hit by Clop ransomware gang, workers&#8217; visas dumped online as part of extortion attempt","datePublished":"2021-03-29T23:46:22+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/"},"wordCount":628,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/","url":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/","name":"After oil giant Shell hit by Clop ransomware gang, workers' visas dumped online as part of extortion attempt 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2021-03-29T23:46:22+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YGsj4ymHs7HK3MjGQsVCVgAAAI0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/after-oil-giant-shell-hit-by-clop-ransomware-gang-workers-visas-dumped-online-as-part-of-extortion-attempt\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"After oil giant Shell hit by Clop ransomware gang, workers&#8217; visas dumped online as part of extortion attempt"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=40301"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40301\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=40301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=40301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=40301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}