BBT SE confirms data breach at Brenner Base Tunnel project as Everest claims 812 GB of stolen files
Brenner Base Tunnel (BBT) SE, the Italian-Austrian company building the Brenner Base Tunnel, has confirmed that unauthorized actors accessed part of its data, while the Russian-speaking extortion group Everest claims to have exfiltrated 812 GB of files. The intrusion reportedly dates to mid-October, with Everest's claim posted on 17 October and the story broken by the Austrian press on 6 November. On 7 November BBT SE told ANSA that operations are unaffected, the affected systems were isolated and external forensic experts and the authorities are involved. The company has confirmed no encryption of its systems, and there is no evidence that attackers reached industrial control systems or tampered with tunnel functions, so claims that ransomware could halt the project are unsupported. Everest's volume claim is unverified and ZeroFox has observed that the group tends to overstate the amount of data it steals. BBT SE confirmed that the compromised data was non-public and taken via internet-facing access, and said the investigation was assigned to the Polizia Postale in Bolzano (euronews.com, reporting the company statement relayed by Italian media).
Detalhes técnicos
The exposure concerns document-management content rather than operational technology: if current, engineering drawings, surveys and site procedures would reduce an attacker's reconnaissance effort and could be reused by fraudsters impersonating the project toward contractors — scenarios, not observed activity. Age limits the value of the data: the tunnel is not due to open before 2034, at a projected cost of about €11.7 billion, so older drawings may describe superseded designs. Everest operates in a Russian-speaking cybercrime ecosystem, which does not establish state direction; in July the same group demanded CHF 10 million from Stadler Rail after using stolen credentials to reach a supplier's data platform, and production there continued. Austrian reporting cited by euronews.com described Everest as a pro-Russian criminal network, a characterisation the article under review explicitly cautions against absent evidence.
Remediação
Defenders should determine precisely which files were exposed, revoke potentially compromised credentials, maintain strict segmentation between document management systems and industrial control networks, and alert suppliers to fraudulent requests referencing project names. Applicability of NIS2 to a construction-stage project company depends on its activities and national transposition.
Linha do tempo
-
BBT SE confirms data breach at Brenner Base Tunnel project as Everest claims 812 GB of stolen files
ler a análise desta fonte ocultar
Brenner Base Tunnel (BBT) SE, the Italian-Austrian company building the Brenner Base Tunnel, has confirmed that unauthorized actors accessed part of its data, while the Russian-speaking extortion group Everest claims to have exfiltrated 812 GB of files. The intrusion reportedly dates to mid-October, with Everest's claim posted on 17 October and the story broken by the Austrian press on 6 November. On 7 November BBT SE told ANSA that operations are unaffected, the affected systems were isolated and external forensic experts and the authorities are involved. The company has confirmed no encryption of its systems, and there is no evidence that attackers reached industrial control systems or tampered with tunnel functions, so claims that ransomware could halt the project are unsupported. Everest's volume claim is unverified and ZeroFox has observed that the group tends to overstate the amount of data it steals. BBT SE confirmed that the compromised data was non-public and taken via internet-facing access, and said the investigation was assigned to the Polizia Postale in Bolzano (euronews.com, reporting the company statement relayed by Italian media).
Technical Details
The exposure concerns document-management content rather than operational technology: if current, engineering drawings, surveys and site procedures would reduce an attacker's reconnaissance effort and could be reused by fraudsters impersonating the project toward contractors — scenarios, not observed activity. Age limits the value of the data: the tunnel is not due to open before 2034, at a projected cost of about €11.7 billion, so older drawings may describe superseded designs. Everest operates in a Russian-speaking cybercrime ecosystem, which does not establish state direction; in July the same group demanded CHF 10 million from Stadler Rail after using stolen credentials to reach a supplier's data platform, and production there continued. Austrian reporting cited by euronews.com described Everest as a pro-Russian criminal network, a characterisation the article under review explicitly cautions against absent evidence.
Remediation
Defenders should determine precisely which files were exposed, revoke potentially compromised credentials, maintain strict segmentation between document management systems and industrial control networks, and alert suppliers to fraudulent requests referencing project names. Applicability of NIS2 to a construction-stage project company depends on its activities and national transposition.