WORLDTECHBrenner Base Tunnel operator confirms unauthorised data access as Everest claims 812 GB theft
Brenner Base Tunnel SE, the company building the tunnel linking Italy and Austria, has confirmed that unauthorised people reached part of its data. The confirmation came after the Everest extortion group claimed to have taken 812 gigabytes of files, a volume no independent party has checked.
What the company has acknowledged
The company has accepted that unauthorised parties gained access to its data. According to the operator, its operational systems were not affected and have been isolated from the incident.
Outside forensic specialists and the authorities are examining the case. The intrusion is reported to have taken place in mid-October, whereas Everest dates its claim to 17 October. Austrian media first reported the matter on 6 November, and on 7 November the company told ANSA that the affected systems had been isolated.
Unverified claims from the attackers
Everest puts the stolen volume at 812 gigabytes, but no independent party has confirmed that figure. Security specialists caution that criminal groups frequently overstate how much information they have taken.
Everest, a group associated with Russian-speaking operations, targeted Stadler Rail in July using stolen credentials. The exposure of project drawings and site procedures has raised concern about reconnaissance, although the tunnel is not due to open until 2034, which means some older design documents are already out of date.
Security priorities and next steps
Security professionals say the priorities are establishing what information was exposed, revoking compromised credentials and hardening document management systems. Officials are also weighing the impact on suppliers and on the integrity of the project.
So far there is no evidence that attackers obtained access to industrial control systems or that the tunnel's physical security is endangered.
Open questions
- How much data was actually taken, given that the 812 gigabyte figure is unverified?
- Which credentials or systems were used to gain access, and have they now been revoked?
- What effect will the exposure of project documents have on suppliers and the schedule?