Swiss rail automobile producer Stadler Rail introduced that the Everest ransomware group had demanded roughly $12.3 million after infiltrating an information alternate platform it shared with one in every of its suppliers.
Though the attackers haven’t publicly claimed the assault, the Swiss firm stated it obtained an extortion letter from the Everest ransomware demanding a ten million Swiss franc ransom.
In response, the corporate stated it could not pay the blackmailer and filed a legal criticism with Thurgau cantonal police.
“Mr. Stadler won’t pay the ransom underneath any circumstances and subsequently shouldn’t be a goal for extortion.”
Stadler Rail is a number one Swiss multinational railway producer that manufactures locomotives, trams, metros, passenger trains and railway signaling methods.
The corporate provides rail operators all over the world, employs 18,000 individuals throughout eight manufacturing amenities and 6 engineering websites, and has annual revenues of greater than $4.9 billion.
Stadler stated the incident occurred in mid-July however had no impression on the corporate’s IT methods or manufacturing operations and that globally it was persevering with as regular.
The corporate stated the hackers solely stole technical info unrelated to safety from its suppliers.
“No related private information has been stolen. Stadler’s rolling inventory in operation all over the world shouldn’t be affected by the info theft. Stadler’s world manufacturing continues as regular.”
Everest is a risk group that emerged as a ransomware operation in 2020, however has deserted community encryption ways in favor of information theft. The gang is now threatening victims with divulging the stolen information until they pay a ransom.
Up to now, Everest bought entry to compromised networks to different risk actors and acted as an preliminary entry dealer. In some circumstances, hackers additionally obtained information stolen by different risk actors to hold out their very own extortion campaigns.
After the unique darkish net leak web site was defaced with the message “CRIME IS BAD xoxo from Prague” in April 2025, the Everest ransomware gang is now working a brand new area. Stadler Rail shouldn’t be but listed on the gang’s extortion web site.
In 2020, Stadler suffered a cybersecurity incident during which an unknown group of hackers infiltrated its IT methods, contaminated elements of its infrastructure with malware, and stole information from compromised gadgets.
The incident seemed to be a ransomware assault, however Stadler didn’t affirm that on the time.
Safety groups doc 54% of profitable assaults and problem a warning on solely 14%. The remaining strikes invisibly by the surroundings.
Picus’ whitepaper exhibits how you can check your SIEM and EDR guidelines in breach and assault simulations to make sure threats go undetected.
Get the white paper
