Everest claims data theft from Brenner Base Tunnel operator

Brenner Base Tunnel SE (BBT SE) has confirmed that unauthorized individuals accessed some of its data, with the extortion group Everest claiming to have exfiltrated 812 GB of files. No independent verification of that volume has been provided, and Everest’s boast is treated cautiously.

The intrusion reportedly dates to mid-October, with Everest’s claim dated 17 October; Austrian media first reported the incident, and on 7 November BBT SE told ANSA that operations were unaffected, the affected systems were isolated, and forensic investigators and authorities were involved. The company stressed there is no verifiable evidence so far that attackers accessed industrial control systems or tampered with tunnel control functions, and it did not confirm any encryption of its systems.

Piece by piece, the article notes that genuine impact hinges on what information was exposed. It cautions that attacker access to drawings or site procedures could enable plausible impersonation of contractors, though these are hypothetical scenarios rather than confirmed sightings. Everest is described as a Russian‑speaking cybercriminal group; ZeroFox has observed that this group tends to exaggerate data stolen.

The piece urges a practical response focused on identifying which files were exposed, revoking potentially compromised credentials, ensuring document management systems are segregated from industrial networks, and warning suppliers about fraudulent requests. It also discusses whether NIS2 applies to a project company still under construction, depending on activities and national law.

The author asks three concrete questions for clarification: which files were actually stolen, how recent and relevant they are, and who might still be able to use them.