Brenner Tunnel Operator Hit by Cyberattack
BBT SE confirmed the attack on the Brenner Base Tunnel linking Austria and Italy and says no tunnel operations have been affected.
Updated on Nov. 7, 2026 in Cybersecurity
Live Poll
Do you think cyberattacks on major infrastructure are becoming a serious everyday threat?
BBT SE, the operator of the Brenner Base Tunnel connecting Austria and Italy, confirmed it was targeted by a cyberattack. The company said it isolated the affected data source and notified the relevant authorities.
Why it matters
The attack targets critical cross-border transport infrastructure, underscoring the cyber risks facing large public works projects. BBT SE's assessment that tunnel operations were unaffected limits immediate disruption to travel and freight along the route.
The attack is attributed to a suspected Russian-speaking group called Everest, linked to an international cyber extortion network. No technical details about the intrusion method or the affected data source have been disclosed.
The players
BBT SE
BBT SE is the company that operates the Brenner Base Tunnel, a major rail link through the Alps between Austria and Italy.
Everest
Everest is a Russian-speaking cyber extortion group that steals sensitive data and demands payment from victims.
The details
The Russian-speaking group Everest is suspected of involvement, and ZeroFox analysis says the group steals sensitive data, threatens to publish it, and demands payment from victims. BBT SE responded immediately after discovering the attack and isolated the affected data source.
Timeline
Friday, November 6, 2026: BBT SE confirmed the cyberattack to Tiroler Tageszeitung.
Threat Landscape
The attack follows the data-theft-and-extortion model in which groups such as Everest steal sensitive files and threaten publication to force payment, a pattern now aimed at large public infrastructure projects. It places a major Alpine rail tunnel within the same threat category already documented against energy and transport operators.
Travelers and freight shippers relying on the Brenner corridor face no disruption according to current assessment, since BBT SE reports tunnel operations were not affected. The incident is a reminder that organizations holding sensitive data should watch for extortion demands and phishing attempts.
The takeaway
Critical infrastructure operators increasingly face data-theft extortion even when core systems keep running. Isolating affected systems quickly and notifying authorities remains the standard first response.
Further reading
For broader context on how these extortion campaigns operate, see Cybersecurity.
Live Poll
Do you think cyberattacks on major infrastructure are becoming a serious everyday threat?
