Brenner Base Tunnel SE has confirmed unauthorized access to some of its data, while saying construction operations remain unaffected, Security Affairs reported on November 8. The extortion group Everest claims it stole 812 GB of files, an unverified figure that raises questions about which project documents and supplier information may have been exposed.
The company is building the Brenner Base Tunnel between Italy and Austria. For its contractors and suppliers, the immediate concern is whether exposed information could help criminals make fraudulent requests look credible. Security Affairs describes that as a possible consequence, rather than an observed attack.
The intrusion reportedly dates to mid-October, with Everest’s claim dated October 17. Austrian press coverage appeared on November 6. On November 7, BBT SE told ANSA that the systems involved had been isolated and that outside forensic specialists and authorities were investigating, Security Affairs reported.
What the files could reveal
If the claimed haul includes authentic, current drawings, surveys and site procedures, those documents could reduce the work an attacker needs to understand the infrastructure. Project names could also give fraudsters convincing details to use when approaching contractors.
The age of any exposed documents matters. The tunnel is not expected to open before 2034 and has a projected cost of about €11.7 billion; older drawings could describe designs that have since changed.
Access to construction documents would not itself give attackers control over the tunnel. Sabotage would require access to operational systems and exploitable weaknesses. Security Affairs reported no evidence of access to industrial systems or interference with tunnel control functions, and BBT SE has not confirmed encryption of its systems. Claims that ransomware could stop the tunnel therefore lack factual support.
The claim and the response
Security Affairs describes Everest as a Russian-speaking cybercriminal group and cites ZeroFox’s observation that it tends to exaggerate the volume of data it steals. Its language and criminal environment do not establish direction by the Russian state.
In July, Everest demanded CHF 10 million from Stadler Rail after using stolen credentials to access a supplier’s data platform; production continued despite that incident, Security Affairs reported.
For organizations handling tunnel project information, Security Affairs recommends identifying the information exposed, revoking potentially compromised credentials, keeping document management systems separate from industrial control networks, and warning suppliers about fraudulent requests. Whether NIS2, the EU cybersecurity framework, applies to a project company still under construction depends on its activities and the relevant national legislation.
The practical priority is to establish which files were actually stolen, how current and useful they remain, and who could still use them, while addressing compromised access and alerting suppliers to possible fraud.
