BBT SE confirms unauthorized access to corporate data as Everest claims 812 GB

BBT SE, the company responsible for building the tunnel between Austria and Italy, confirmed that unauthorized individuals accessed some of its corporate data. The company dates the intrusion to 17 October 2026 or mid-October 2026. BBT SE said tunnel construction and operational processes were not affected. Austrian press broke the story on 6 November 2026, with wider coverage appearing on 7 November 2026.

The ransomware cartel Everest claims it exfiltrated 812 GB of information, but the claim is unverified. BBT SE has not confirmed the attacker’s identity, and investigators have not publicly named a group. Claims that a ransom was demanded are unconfirmed. The company refrained from discussing possible negotiations or payment of alleged ransoms.

The company is still investigating, and the attackers have not been identified.

Everest is identified as a Russian-speaking cybercriminal group. On its dark web platform, Everest listed the Brenner Base Tunnel as a target for attacks in Austria. Everest said it would publish sensitive data if its ransom demands were not met. Detailed investigations are continuing to establish what happened during the attack.

The Brenner Base Tunnel is 64 kilometers long and links Austria and Italy as a cross-border rail corridor. It is a major Italy–Austria infrastructure project. The tunnel is not expected to open before 2034, and its projected cost is about €11.7 billion. BBT SE is a project company, and the sources mention no share price, insurance claim, or cost estimate tied to the incident.

“The incident has not affected the construction of the tunnel.”

BBT SE isolated affected systems, brought in outside forensic experts, and notified the relevant authorities. Investigators have not established how deeply the attackers entered the network or how much data was taken. The company has not disclosed the duration of the attackers’ access to its network.

Investigators have found no evidence that industrial systems were breached or control functions were altered. The company has not confirmed that its systems were encrypted. A 21-day gap separates the intrusion date from the first public reporting, a span consistent with containment and forensic work before disclosure.

Internal correspondence, supplier details, schedules and planning files together with drawings could be part of the project data at risk; exposure of this material might aid an intruder or enable extortion. Drawings, surveys and site procedures could help an attacker conduct reconnaissance, though these are scenarios, not confirmed sightings. Even if production keeps running, stolen documents could support later attacks, phishing messages or extortion attempts.

Attackers could use employee names, project contacts and document formats to write convincing messages to staff and partners. Understanding tunnel construction does not confer control over it; disrupting operations requires access to operational systems and exploitable weaknesses. Because the tunnel will not open before 2034, older drawings might show a design that is no longer current.

Whether NIS2 covers BBT SE depends on what the company does and which national law applies. No established link connects this incident to cyber attacks on the Italian foreign minister.

The cybersecurity firm ZeroFox says the group tends to overstate how much data it steals. Everest said it would publish sensitive data if its ransom demands were not met. Everest previously demanded CHF 10 million from Stadler Rail in July after entering a supplier’s data platform with stolen credentials, and production continued. Everest previously targeted Stadler Rail and uses stolen credentials to access supplier data platforms.

Breachsense indexed 17 accounts ending in @bbt-se.com and 39 credentials belong to bbt-se.com itself; the data was last checked Nov 8, 2026, and none of it is necessarily connected to this attack. Security Affairs says firms should identify exposed information, revoke possibly compromised credentials, separate document management from industrial control networks, and alert suppliers to fraudulent requests.