BBT SE, the company building the 55-kilometre Brenner Base Tunnel between Austria and Italy, has confirmed that unauthorised people accessed some of its data, after the Russian-speaking extortion group Everest claimed it stole 812 gigabytes of files. The company says construction work on the tunnel — one of Europe's largest transport projects — has not been disrupted.
What happened
The intrusion dates to mid-October. Everest published its claim on 17 October, and the Austrian daily Tiroler Tageszeitung first reported the incident on 6 November, followed by der Standard. BBT SE confirmed the breach to Italian news agency ANSA on 7 November, saying it had isolated the affected systems, brought in outside forensic specialists and notified the authorities.
The company has not said which data was touched, how far the attackers got into its network, or whether it entered negotiations with the extortionists or paid anything. The 812-gigabyte figure comes only from Everest itself and has not been independently verified — and, as security researchers have noted, a claimed file size says little about what is actually inside, which could range from project designs and emails to low-value material inflated to apply pressure. According to threat-intelligence reporting, Everest said it would publish the whole archive if talks with the company fail.
Tunnel works continue
BBT SE says its operational activities remain unaffected and no operational processes have been compromised. There is no evidence the attackers reached the tunnel's industrial control systems, and the company has not confirmed that any of its systems were encrypted. The incident, on the facts confirmed so far, is a data-access breach rather than an attack on the tunnel's physical infrastructure.
The Brenner Base Tunnel will link Innsbruck in Austria with Fortezza in Italy, and at about €11.7 billion it is one of Europe's most expensive infrastructure projects. It is not expected to open before 2034. BBT SE, founded in December 2004 on a mandate from Austria, Italy and the European Union, is responsible for designing and building the tunnel.
Who is Everest
Everest is a Russian-speaking cybercrime group that began in 2020 as a ransomware operation and has since moved almost entirely to data theft and extortion — stealing files, threatening to publish them and demanding payment. In July 2026 it reached the data of Swiss train manufacturer Stadler through a supplier's data-exchange platform, a pattern that fits the Brenner incident: an internet-facing system, rather than the tunnel's operational network, as the point of entry.
The investigation is continuing, with forensic experts and the authorities examining how the attackers got in and what they took. Until BBT SE says more, the one confirmed fact is the breach itself — the scale of the theft, and who exactly carried it out, remain claims rather than established facts.
