Everest data-theft extortion: Brenner Base Tunnel SE — 812 GB claimed stolen from construction project data
Severity: medium · Patch status: no-fix-needed · Since 2026-11-08
Brenner Base Tunnel SE, the company building the ~€11.7bn Brenner Base Tunnel between Italy and Austria, confirmed that unauthorized actors accessed some of its data. The Russian-speaking extortion group Everest claims theft of 812 GB of files (claim posted 17 October); the claim is unverified and the group is known to exaggerate stolen volumes. Austrian press reported the story on 6 November 2026. BBT SE says operations are unaffected, affected systems are isolated, and external forensics and authorities are engaged. No evidence indicates access to industrial control systems, tampering, or encryption. Exposed drawings, surveys and procedures could aid reconnaissance or contractor fraud, though the tunnel opens no earlier than 2034 so documents may be outdated. Everest previously demanded CHF 10m from Stadler Rail in July. Investigation ongoing; key open questions are which files were taken, their currency, and who can use them.
What to do
- Identify exactly which data and documents were exposed and their recency
- Revoke potentially compromised credentials and tighten access to document management systems
- Keep document management/IT networks segregated from industrial control networks
- Warn contractors and suppliers about fraudulent requests using stolen project names/details
- Review NIS2 applicability and regulatory notification obligations; cooperate with forensics and authorities
Sources
All live incidents on Threat Watch
