Brenner Base Tunnel SE breach: Everest claims 812 GB, Security Affairs reports

What happened

According to Security Affairs, Brenner Base Tunnel (BBT) SE has confirmed that unauthorized people accessed some of its data. BBT SE is the company building the Brenner Base Tunnel between Italy and Austria. The extortion group Everest claims it took 812 GB of files. Security Affairs says nobody has verified that figure. It also notes that ZeroFox has observed that the group tends to exaggerate how much data it steals.

The timeline Security Affairs reports:

• The intrusion reportedly dates to mid-October.
• Everest’s claim is dated 17 October.
• The Austrian press broke the story on 6 November.
• On 7 November, BBT SE told ANSA that operations are unaffected, the systems involved are isolated, and outside forensic experts and the authorities are investigating.

What is not confirmed, per Security Affairs:

• Data: which files were taken and the actual data volume.
• Entry point: how the attackers got in.
• Encryption: BBT SE has not confirmed any encryption of its systems.
• Operational systems: there is no evidence that attackers accessed industrial systems or tampered with the tunnel’s control functions.

Security Affairs describes Everest as a Russian-speaking cybercriminal group. It adds that this does not prove the group is directed by the Russian state. The outlet also says the same group demanded CHF 10 million from Stadler Rail in July, after using stolen credentials to access a supplier’s data platform.

Am I affected?

Not confirmed. BBT SE has not said publicly which files or which parties are involved, according to Security Affairs.

Security Affairs describes these as possible scenarios, not observed events:

• If the data is real and current, drawings, surveys and site procedures could help an attacker with reconnaissance.
• Fraudsters could use project names to deceive contractors.

The outlet also notes that the tunnel will not open before 2034, so older drawings may describe a design that has since changed.

What to do now

These steps follow the measures Security Affairs recommends:

1. If you are a supplier or contractor, treat unexpected payment, document or credential requests that reference the project as possible fraud, and confirm them with a known contact.
2. If you shared documents or accounts with BBT SE, identify what information may have been exposed.
3. Revoke and rotate any credentials that may have been compromised.
4. Keep document management systems separate from industrial control networks.
5. Wait for BBT SE or the authorities to say which files were taken before drawing conclusions about the impact.

Sources

• Security Affairs: Don’t Hand Propaganda a Gift: Reading the Brenner Base Tunnel SE Breach Calmly