Swiss train maker Stadler refuses to pay $12.3M ransom

Swiss rail vehicle manufacturer Stadler Rail has reported that it was targeted by the Everest extortion group. The attackers broke into a data-exchange platform the company used jointly with one of its suppliers and demanded a ransom of around 10 million Swiss francs (roughly $12.3 million).

The company refused and filed a report with the cantonal police of Thurgau. “Stadler will not pay a ransom under any circumstances and therefore will not yield to blackmail,” its statement reads.

What exactly happened

According to Stadler, the incident occurred in mid-July. Neither its IT systems nor its production operations were affected, and both continue to run normally worldwide. Only technical information belonging to the supplier was stolen — data that, the company stresses, is not security-related. No significant personal data was taken, and the leak does not affect the Stadler trains in service around the world.

Stadler is a major international manufacturer of locomotives, trams, metro trains, passenger rolling stock and railway signalling systems. The company employs 18,000 people across eight production sites and six engineering centres, and its annual revenue exceeds $4.9 billion.

Notably, Everest itself has not yet publicly claimed the breach, and Stadler does not appear on the group's list of victims — only the extortion letter confirms the attack.

Who Everest are

The Everest group emerged in 2020 as a classic extortion operation, but over time it abandoned encrypting networks in favour of simply stealing data: victims are now threatened with the publication of what was taken if they refuse to pay. In the past, Everest has also moonlighted as an initial access broker, selling entry into compromised networks to other criminals, and at times it has bought up data already stolen by someone else in order to run its own extortion campaigns.

The group has had its own embarrassing episode: in April 2025 its original dark-web leak site was hacked and defaced with a mocking message — “Don't do crime, CRIME IS BAD, xoxo from Prague.” Since then Everest has been operating on a new domain.

For Stadler this is not the first such episode. In 2020, an unknown group broke into its IT infrastructure, infected some of its systems with malware and stole data. That case looked like a ransomware attack, though the company did not officially confirm it at the time.

Source: Bleeping Computer