The Everest extortion group posted Brenner Base Tunnel SE, the Austrian-Italian company building the 64-kilometre rail tunnel under the Brenner Pass, on its leak site on 17 October 2026 with a claim of 812 GB of stolen data. No news outlet reported it for 20 days. The Tiroler Tageszeitung broke the story on 6 November, and BBT SE confirmed the next day that attackers had reached part of its internet-accessible data in mid-October.

Our Ransomtracker recorded the entry at 04:31 UTC on 17 October, in the same batch as two Japanese victims that had already told the public they were breached. BBT SE had not. The company says construction is unaffected and no high-security data was touched; it will not say whether Everest has contacted it, and nothing on the record shows encryption.

In brief

• Everest listed “Brenner Base Tunnel” on 17 October 2026 and claims 812 GB. The volume has not been verified, and Everest has not said what the files are.
• BBT SE confirmed a targeted cyberattack on 7 November, after the Tiroler Tageszeitung reported it on 6 November. It says the attack took place in mid-October, that the attackers gained partial access to data reachable from the internet, and that the affected systems were isolated and the authorities informed.
• The company says the construction of the tunnel was not affected and high-security data was not involved. It declined to comment on whether it is negotiating with the attackers.
• Everest put 26 organisations on its leak site in October, its busiest month on the Ransomtracker since February. Kissei Shoji and Chugoku Bend, posted within hours of BBT SE, had both disclosed their incidents before the listing.
• The Alerts.bar index that Ransomnews licenses holds nine infostealer-captured credentials tied to bbt-se.com, five from the company’s own login pages and four from staff accounts, plus 237 records in credential compilations.
• Three months earlier Everest went after Stadler Rail, which refused a demand of about CHF 10 million in July after attackers used stolen logins on a data exchange platform it shares with a supplier.

What has BBT SE confirmed?

A targeted cyberattack in mid-October and partial access to data, and little else. BBT SE is the joint Austrian-Italian project company, based in Bolzano, that is building the Brenner Base Tunnel between Innsbruck and Fortezza. Its spokesperson told the Tiroler Tageszeitung and ANSA on 7 November that unknown attackers had gained partial access to data “accessible via the internet”, that the affected systems had been isolated, that external cybersecurity specialists were carrying out forensic analysis and that the relevant authorities had been informed. According to the dpa report carried by German outlets, the company said the incident posed no danger to construction or to the tunnel’s later operation and that high-security data was not affected. It gave no details on who was responsible or what they wanted, and it declined to say whether there had been negotiations or a payment.

What the statement does not cover matters as much. BBT SE has not said when it detected the intrusion, which systems held the data, whether employee, supplier or tender records are in it, or whether anyone’s personal data was taken. Italian investigators have the case because the company is registered in Bolzano. Initial reporting in the Italian press, citing the authorities, points to Everest, which matches the leak-site entry the Ransomtracker logged three weeks before the company spoke.

What does Everest claim, and when?

812 GB, posted on 17 October. The Everest entry names Brenner Base Tunnel and gives the volume; Security Affairs, Swiss and Spanish reporting all carry the same figure, and none of them has verified it. The table below sets the leak-site record against the public one.

Date (2026)	Event	Source
Mid-October	Intrusion at BBT SE, by the company’s later account	BBT SE via ANSA and dpa
16 October	Everest posts Kissei Shoji, which had disclosed its breach on 9 October	Ransomtracker
17 October, 04:31 UTC	Everest posts Brenner Base Tunnel (claimed 812 GB), Chugoku Bend (claimed 90 GB) and Taekwang Network in one batch	Ransomtracker
20 October	Chugoku Bend announces a leak of design and production files, detected on 14 October	Company notice, via Security Measures Lab
26 October	Everest says it has published the Chugoku Bend data and posts an external file-share link	Security Measures Lab
6 November	Tiroler Tageszeitung reports the BBT SE attack, 20 days after the listing	Security Affairs, Moncloa
7 November	BBT SE confirms a targeted cyberattack and partial data access	ANSA, dpa, Il Sole 24 Ore

Everest has not, as far as the public reporting shows, published BBT SE files, and we do not link to or reproduce leak-site content. The claimed volume is a ceiling, not a measurement: extortion groups round up, count duplicates and include archives they cannot open. Pierluigi Paganini made the same point at Security Affairs on 8 November, arguing that the questions that matter are which files were taken, how sensitive they are and who could use them, and noting there is no evidence the attackers came near the tunnel’s industrial control systems.

Why did the leak site know first?

Because BBT SE chose to say nothing until a newspaper asked, which European law allows. Under the GDPR a company has 72 hours to tell its data protection authority about a breach of personal data, and it must tell the people affected only if the risk to them is high; it is not obliged to tell the public. NIS2 reporting goes to national CSIRTs and authorities, not to the press. A company can therefore meet every legal duty and stay silent while its name sits on a leak site, and that is what the Ransomtracker record shows for three weeks of October.

The two companies Everest posted alongside BBT SE took the other route. Kissei Shoji, a trading and noodle-making subsidiary of Kissei Pharmaceutical, received an email at about 21:50 on 7 October telling it that data had been stolen; its parent announced the unauthorised access on 9 October, a week before Everest listed it with a claim of 323.58 GB and 278,326 files. Chugoku Bend, a Hiroshima manufacturer, detected unauthorised access on 14 October and announced on 20 October that design and production files relating to its customers had been downloaded. Everest posted it three days before that announcement, as “bend.co.jp 90 GB DataBase”, and on 26 October said the data was out. In both cases the public heard about the breach from the victim, and the leak-site entry added pressure, not news.

BBT SE is the clearest October case of the reverse in our records, but not the only one. Black X listed the Japanese healthcare data company enTouch on 9 October, ten days before its parent told the Tokyo Stock Exchange that data had leaked after unauthorised access by a ransomware attacker. The Gentlemen listed Santa Barbara Endodontics on 16 October, three weeks before its breach notice appeared on the California Attorney General’s site. For anyone downstream of a victim, a supplier, a contractor or a customer, the leak site is often the first warning available, which is why the Ransomtracker records the time of every entry.

What does the stealer-log exposure show?

A small footprint, and not a fresh one. Stealercheck, which queries the Alerts.bar index that Ransomnews licenses, returns nine credentials for bbt-se.com captured by infostealer malware on infected computers: five from people logging into bbt-se.com services and four from staff accounts, with six harvested session cookies. None was added in the past 30 days. A further 237 records for the domain sit in credential compilations and combolists, 44 of them staff addresses.

These are aggregate counts, not evidence of how Everest got in, and the company has not described its initial access. The numbers are low for an organisation of this profile, but a service that is “accessible via the internet”, in the company’s words, needs only one working login. Stadler Rail’s July breach is the useful comparison: there, attackers used compromised login credentials on a data exchange platform Stadler shares with a supplier, and the same index holds 50 staff-account records for stadlerrail.com captured by infostealers, four of them added in the past 30 days. Stealer logs and the session cookies that come with them are the cheapest way into exactly that kind of shared portal, which is the exposure we laid out in stealer logs explained.

Who is Everest?

A Russian-speaking extortion operation that now steals and sells more than it encrypts. The US Department of Health and Human Services’ HC3 described Everest in August 2024 as a ransomware-as-a-service group that gets in through compromised user accounts and common remote access tools, and the American Hospital Association’s cyber adviser said at the time that it appeared to act as an initial access broker, selling footholds to other gangs. The Everest profile on the Ransomtracker shows a steady rather than explosive operation: 271 listings since our claims index began in July 2025, none at all in June 2026, 13 in September and 26 in October, the most since February’s 31.

Its October list leans towards industrial and engineering firms and large brands. Alongside BBT SE, Kissei Shoji and Chugoku Bend, the group posted Kennametal and Flydubai on 6 October, Laerdal, KVH and Topcon Healthcare on 12 October, Haier, Lindauer Dornier and PLD Group on 21 October, an entry it calls PWC on 22 October, and Natuzzi and an entry described as an energy storage terminal in Singapore on 27 October. These are claims; we have not seen confirmation from those companies, and a listing under a brand name does not show whose systems the data came from. Stadler is the reminder: the data came from a platform shared with a supplier, Stadler said its own IT was not compromised, and Everest added Stadler Rail to its site on 30 July, a week after Stadler refused to pay.

What should infrastructure builders and their suppliers do?

Treat the portals you share with contractors as part of your perimeter, and watch the leak sites as closely as your logs. Specifically:

• Put every external collaboration and document-exchange platform behind multi-factor authentication that cannot be satisfied by a replayed session cookie, and expire sessions on a short clock. Infostealer cookies bypass MFA that only runs at login; our guide to session-cookie theft covers the controls.
• Check your domains against stealer-log data, including the logins of your suppliers and bidders, and force resets for any account that appears.
• Monitor leak sites for your own name and your main suppliers’ names. A listing can arrive days or weeks before a supplier tells you, and BBT SE’s case shows it can arrive before the press does.
• Decide in advance what you will say publicly if you are listed. Silence did not keep BBT SE out of the news; it only meant the first account came from a newspaper.
• Keep construction, signalling and control networks segmented from the office and document systems. The company says operations were unaffected, and that separation is what makes such a statement credible.

For the incident itself, our incident response runbook applies whether or not anything was encrypted. We will update this article if BBT SE says what data was taken or if Everest publishes it. Everest’s other entries are on the 2026 tracker archive, and confirmed attacks are logged in the confirmed attacks register.

Frequently asked questions

Sources and further reading

• Ransomnews Ransomtracker, Everest operator profile, listings recorded 16 and 17 October 2026
• Security Affairs: Don’t hand propaganda a gift, reading the Brenner Base Tunnel SE breach calmly (8 November 2026)
• Il Sole 24 Ore: Brenner tunnel, hacker attack on BBT management company SE (7 November 2026)
• la Repubblica: Hacker attack on the Brenner mega-tunnel (7 November 2026)
• dpa via t-online: Cyberattacke auf Brennerbasistunnel-Firma (7 November 2026)
• blue News: Hackers attack Europe’s mega-tunnel, trail leads to Stadler blackmailers (7 November 2026)
• Moncloa: Ciberataque túnel Brennero, Everest reclama 812 GB (8 November 2026)
• Security Measures Lab: Everest claims Kissei Shoji, 323 GB and 278,326 files (October 2026)
• Jiho: Kissei Pharmaceutical reports unauthorised access at group company Kissei Shoji (9 October 2026)
• Security Measures Lab: Chugoku Bend confirms leak of design and production files, Everest claims 90 GB (November 2026)
• teiss: Stadler Rail confirms cyberattack, refuses $12.3 million ransom demand (23 July 2026)
• American Hospital Association: HHS alerts health sector to Everest ransomware group (21 August 2024)
• Related: initial access brokers and the ransomware supply chain, double extortion explained and the threat-group catalogue

Reporting by the Ransomnews Research Team. Leak-site dates are when the Ransomtracker recorded each entry. Exposure figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses; no credentials are reproduced and no leak-site content is linked.