Shell said it is investigating a potential security incident after Clop claimed it stole 89GB of data. The breach is still unconfirmed, and Shell has not yet said what, if anything, was taken.
The pressure comes from the claim itself: once a ransomware group publicly names a large theft, the response shifts from containment alone to verification, legal review, and disclosure planning. If the data really left, the risk is not just recovery but where those records may surface next.
For energy companies with sensitive internal and partner data, a public exfiltration claim can become its own incident timeline. Even before scope is proven, it can trigger follow-on extortion and force decisions about customers, employees, and regulators while the facts are still incomplete.