Swiss train manufacturer Stadler Rail has announced it will not pay a $12.3 million ransom demanded by the ransomware group Everest, following a data breach that occurred in mid-July. The breach involved the theft of technical documents from a third-party supplier’s file-sharing platform, but Stadler confirmed that its own systems were not affected and that all production sites remain operational. The company has filed a criminal complaint and stated it will not negotiate with the hackers. For further details, see the report by The Record.
Details of the Breach
The stolen data consisted of technical documents belonging to a third-party supplier, obtained after the credentials for the data exchange platform were compromised. Stadler emphasized that no personal information was stolen and that the breach has no impact on trains operating worldwide.
Response to Ransom Demand
Everest, the group responsible for the attack, issued an extortion letter demanding 10 million Swiss francs. In its statement, Stadler declared, “Under no circumstances will Stadler pay a ransom and therefore cannot be extorted.” This incident marks the second known extortion attempt against the company, following a similar attack in 2020.
Background on Everest
Everest is a Russian-speaking ransomware and extortion group that has been active since at least 2020, targeting organizations in critical infrastructure sectors such as energy, transportation, and telecommunications. The group previously claimed responsibility for a cyberattack on Sweden’s state-owned electricity grid operator and a breach involving a contractor for Nissan.
As of the latest updates, it remains unclear whether Everest has begun releasing any of the stolen supplier data, and the group has not listed Stadler on its dark web leak site.
