The cybercrime group Everest claims to have obtained technical data through the platform Stadler uses to exchange information with a supplier. The hackers are demanding a ransom of CHF 10 million, but the train manufacturer says it will not pay.
Swiss rail vehicle manufacturer Stadler was the target of a cyber extortion attempt after unauthorized individuals gained access to a platform used to exchange data with one of the company’s suppliers.
The incident occurred in mid-July 2026 through the use of compromised login credentials. Stadler states that its own IT systems were not accessed and remained intact.
The Everest group, which claimed responsibility for the data theft, is demanding a ransom of CHF 10 million from the company, equivalent to approximately EUR 10.8 million at the reference exchange rate published by the European Central Bank for July 20.
The data is not relevant to train safety
The information accessed consists of technical data belonging to a supplier and, according to Stadler, has no bearing on rail safety.
The company maintains that no sensitive personal data was stolen, and the incident does not affect Stadler trains currently in operation in various countries.
Furthermore, production at the group’s factories continues as normal.
Stadler states that, although the data was copied by the attackers, the company did not lose any information and did not find that its IT infrastructure had been compromised.
Access via Compromised Login Credentials
The attackers reportedly did not gain direct access to Stadler’s network but instead used compromised login credentials for the platform through which the manufacturer and supplier exchanged documents and technical information.
Such platforms are commonly used in the railway industry to transmit design documentation, component specifications, and other information necessary for collaboration between manufacturers and suppliers.
Stadler did not specify which supplier company was involved or the exact volume of information stolen.
Stadler filed a criminal complaint
In its ransom note, the Everest group demanded payment of 10 million Swiss francs in exchange for not publishing or using the obtained data.
However, Stadler announced that it will not pay the ransom under any circumstances.
The company filed a criminal complaint with the Thurgau Cantonal Police, the Swiss canton where the manufacturer’s headquarters are located.
Stadler does not intend to provide any further information about the incident at this time, citing the ongoing investigation.
Share on:
