Hackers gained access to BBT SE data in mid-October. BBT SE is the company building the Brenner Base Tunnel between Austria and Italy. The Russian-speaking group Everest is suspected to have carried out the hack. It is the second cyberattack on a major rail tunnel project on the Scandinavian-Mediterranean (ScanMed) corridor in short succession, after the Fehmarnbelt tunnel contractor was also targeted.
The Italian project company BBT SE is responsible for the design and construction of the Brenner Base Tunnel. The 64-kilometre underground railway connects Innsbruck (Austria) and Fortezza (Italy).
The hackers accessed some of BBT SE’s data that could be reached via the internet and was not meant for the public. BBT SE isolated the affected systems, hired external forensic experts and informed the authorities.
It is still unclear which systems the hackers reached and how much data they took. Everest listed BBT SE on its extortion site on 17 October and claims to have stolen 812 gigabytes of data. That figure has not been confirmed. Everest threatens to publish the material if negotiations fail. BBT SE did not say whether it has been in contact with the hackers or paid a ransom.
The group is not new to the rail sector. In mid-July 2026, Everest demanded a ransom of 10 million Swiss francs (about €10.8 million) from the Swiss rolling stock manufacturer Stadler Rail, after breaking into a data exchange platform shared with a supplier using compromised credentials. Stadler refused to pay and filed a complaint.
Impact on rail freight and security
The incident has had no consequences for operational activities or the construction site, BBT SE said. A spokesperson told the German press agency dpa that no high-security data was involved and that there are no risks to the tunnel’s future operation. Based on what is known now, the attack does not change the tunnel’s opening timeline. That timeline was already revised in October, when BBT SE pushed the opening back to 2034, with costs rising to about €11.7 billion.
Still, the data theft could matter heading into the future. If design drawings, surveys or site procedures were stolen, they could support targeted reconnaissance or more convincing fraud attempts against contractors, according to the Italian outlet Cybersecurity360. However, data theft does not immediately translate into an ability to interfere in the tunnel’s systems.
Fehmarnbelt contractor was targeted before
On 11 October, Femern Link Contractors (FLC), the consortium behind the 18-kilometre Fehmarnbelt tunnel between Denmark and Germany, also identified a cyberattack on its systems. Several vessels at the Rødbyhavn construction site came to a standstill. FLC later informed project owner Sund & Bælt that data, including employees’ personal data, had been stolen. A group calling itself Barracuda has reportedly claimed the attack.
In the Fehmarnbelt tunnel case, the impact on the timeline is less clear. Work has resumed in several areas, but FLC earlier refused to explain how the construction programme could be affected, publication Construction Briefing reported. Similarly to the Brenner Base Tunnel, trains through the Fehmarnbelt tunnel had already been delayed to 2035 in October.