CADChain Blog
2026-11-10 13:55 News

Brenner Base Tunnel Cyberattack: Hackers Hit a Contractor Data Exchange Server and Demand Ransom. What Engineering Teams Should Learn About Shared Project Files | CADChain | CAD DRM & IP

BBT SE, the company building the Brenner Base Tunnel between Austria and Italy, has confirmed that attackers reached a server it used to exchange data with Italian contractors and that it received a ransom demand. The intrusion took place in mid-October 2026 and became public on 6 November. The extortion group Everest is suspected and claims to hold 812 GB of data, a figure nobody has verified.
BBT SE says construction continues, its internal IT systems were not affected and no stolen data has been published so far. The company isolated the server, brought in outside security experts and informed the authorities. It has not said which files were taken, how much was copied or whether it is talking to the attackers.
The case matters well beyond tunnelling. The server that was hit is the kind of system almost every engineering project runs: a place where drawings, tender documents and survey data are shared with external partners. It is the second attack on a major European rail tunnel project in a few weeks, and it follows the same pattern as Everest's extortion of Swiss train maker Stadler Rail in July, which also started on a platform for exchanging technical documents with a supplier.
TL;DR: attackers went for the file-sharing server, not the tunnel

In mid-October 2026, attackers accessed a BBT SE server used for data exchange with Italian contractors. According to t-online, it held tender documents and survey data, and BBT SE says much of that data was already public. BBT SE confirmed a ransom demand, reported it to investigators and says construction and internal IT were not affected. The Everest group is suspected and claims 812 GB, but the attribution and the volume are not confirmed. Weeks earlier, a cyberattack hit the IT systems of the main contractor building the Fehmarnbelt tunnel. Lesson for engineering teams: shared project platforms hold your most portable data, and the protection has to travel with each file.

What happened at Brenner Base Tunnel SE?

The first reports came from the Tiroler Tageszeitung on 6 November 2026, picked up by Austrian broadcaster ORF the same evening. A BBT SE spokeswoman confirmed that the company had been the target of a hacker attack. According to the reports, BBT SE reacted immediately after discovering it, isolated the affected data source and informed the responsible authorities. It said that, as far as it knew, no operational processes were affected.
On 7 November BBT SE told the Italian news agency ANSA that attackers had gained access to some data reachable over the internet in mid-October, that security protocols were activated, the systems involved were isolated and external forensic experts were investigating.
The most specific account came on 9 November. t-online reported that the attackers reached a server used for data exchange with Italian contractors, holding 812 GB including tender documents and survey data. BBT SE confirmed to t-online that a ransom demand was made and that it reported the demand to the investigating authorities. It would not disclose its contents because the investigation is ongoing. Italian authorities are investigating too.

What was on the contractor data-exchange server?

BBT SE has not published a list. What we know comes from t-online: tender documents and survey data, on a server built for exchanging files with Italian contractors. BBT SE also told t-online that much of the data was already publicly accessible, and that it is unclear how much was actually stolen.
That point deserves care. Tender documents for public works are often published so that bidders can price the job, and a lot of project information on a public infrastructure scheme is meant to be seen. But a data-exchange server rarely holds only the public set. It also tends to hold working versions, contractor responses, contact lists, internal comments and files that were uploaded for one partner and never removed. Analysts at Security Affairs noted on 8 November that older drawings may no longer reflect the current design, and that the real questions are which files were taken, how recent they are and who could still use them.
Even data that is public one file at a time can become more useful when an attacker holds all of it in one place. Project names, contractor names and document formats are what a fraudster needs for convincing fake invoices or change requests, which is why Security Affairs also advised warning suppliers about fraudulent requests. Our guide to architecture and BIM file security covers these document types.

Who is Everest and how sure is the attribution?

Everest is a Russian-speaking extortion group active since 2020. It used to run ransomware but now mostly steals data and threatens to publish it unless paid. The Tiroler Tageszeitung linked it to the BBT SE attack based on an analysis by US security company ZeroFox, and Bluewin reported that the group listed the tunnel company on its dark web site on 17 October, claiming 812 GB.
None of that is an official attribution. Every report we checked says the perpetrator has not been confirmed. ZeroFox has also observed that Everest tends to exaggerate how much it steals, and as Security Affairs pointed out, operating in a Russian-speaking criminal scene does not by itself mean a state is directing the attack. There is no public evidence that the attackers reached industrial systems or the tunnel's control functions, and BBT SE has not reported any encryption of its systems.

Is this a pattern on European rail projects?

Three incidents in four months point in the same direction. In mid-July, Everest gained access to a third-party platform that Stadler Rail used to exchange technical documents with one of its suppliers, using compromised login credentials, and demanded CHF 10 million. Stadler confirmed the access on 20 July, said its own internal IT had not been breached, refused to pay and filed a criminal complaint.
Then, overnight into Monday 12 October, a cyberattack hit the IT systems of Femern Link Contractors (FLC), the main contractor building the Fehmarnbelt tunnel between Denmark and Germany. In its update of 16 October, project owner Femern A/S said some IT systems at the construction site were still affected, that work had resumed in several areas and that the Danish National Special Crime Unit was investigating. No group has been publicly tied to the Fehmarnbelt attack, and there is no public link to Everest.
What connects the three cases is not one attacker. It is the shape of a modern engineering project: a large group of owners, contractors and suppliers working from shared platforms, each with its own logins. That is also what we saw in the 23 leak-site claims against Korean manufacturers, where gangs now list drawings and design databases among the data they say they took.

Why do data-exchange platforms keep getting hit?

Shared project servers sit at the edge of the network by design. They must be reachable from the internet, they have many external users with different security habits, and their accounts often outlive the work they were created for. A single stolen password from one subcontractor can open folders that belong to the whole project, which is why our guide to controlling CAD files beyond first-level partners starts with knowing who can reach what.
The second problem is that the protection usually belongs to the server, not to the files. Once an attacker is through the login, every file on the share opens normally on the attacker's machine. File-level encryption and information rights management for engineering files change that: a copied file stays encrypted and only opens for users whose permissions are still valid. That does not stop a breach, but it changes what the attacker can do with the data and what an extortion threat is worth.
What projects shareWhy it matters if it leaksControl that helps
Tender documents and specificationsOften partly public, but working versions and contractor answers are notSeparate public tender sets from working files; time-limited sharing for the rest
Survey and site dataReveals site layout and conditions; useful for reconnaissance and fraudNeed-to-know folders and view-only permission levels
Design drawings and CAD modelsCore engineering know-how; older versions may still show critical detailsFile-level encryption so copies stay locked off the server
Contractor and supplier contactsBasis for fake invoices and change requestsWarn partners; confirm payment changes through a second channel
Logins of external usersOne compromised account can open project-wide foldersMFA, per-project accounts, removal at contract end
Access logsNeeded to prove what was taken and to answer regulatorsTamper-proof audit trails kept outside the shared server
Keep shared project files locked, even when a server is breached. CADChain encrypts CAD files at file level, lets you set and revoke permissions for every partner, logs each access and records ownership on a blockchain, across CAD systems.

👉 Protect your CAD files with CADChain

What do EU rules expect after a breach like this?

Which rules apply depends on who the company is and what was taken. Under NIS2, the EU's cybersecurity directive, rail infrastructure managers and many transport operators must send an early warning of a significant incident within 24 hours, a notification within 72 hours and a final report within a month. Whether a project company still building a tunnel falls under NIS2 depends on its activities and on national law, as Security Affairs noted.
If the files include personal data, such as names and contact details of contractor staff, the GDPR requires notifying the data protection authority within 72 hours unless the breach is unlikely to put people at risk. Our article on GDPR compliance for CAD DRM systems explains how access logs help answer that question quickly.
For contractors and suppliers, the commercial question is trade secrets. Under the EU Trade Secrets Directive, information is only protected if its holder took reasonable steps to keep it secret. If design files end up on a leak site, it becomes much harder to argue that they are still secret, which is why the controls on shared files matter before an incident, not after it.

What should engineering and project teams do now?

  1. Map your exchange platforms. List every server, cloud share and portal used to swap files with contractors and suppliers, who runs it and who has an account. Shadow shares count too.
  2. Clean out old projects. Remove files and accounts that are no longer needed. Data that is not there cannot be stolen. Our guide to revoking CAD file access after it is shared covers files that already left.
  3. Separate the public set. Keep published tender documents apart from working files, contractor answers and internal comments, so "it was public anyway" is actually true.
  4. Protect the files, not just the server. Encrypt sensitive drawings and models at file level so a copied file stays locked. See our complete guide to CAD file security.
  5. Fix partner logins. One account per person, MFA everywhere, removal at contract end, and checks for stolen credentials. The Stadler case started with a compromised login.
  6. Watch access in real time. Real-time access monitoring for supply chain partners shows bulk downloads and unusual logins while they happen.
  7. Prepare the partner warning. Decide now how you will tell contractors about a breach and how they should verify payment and change requests.
  8. Keep evidence ready. Logs, file inventories and dated proof of ownership make it possible to answer regulators, insurers and courts with facts instead of an attacker's claims.

How does this fit the bigger picture?

Our sister sites covered other routes engineering data takes this week:

Conclusion

According to BBT SE, the Brenner Base Tunnel breach did not stop construction. What it hit was the quieter part of a big engineering project: the server where the owner and its contractors swap tender documents and survey data. Months earlier, Everest used the same route against Stadler Rail, through a supplier document platform and a stolen login.
Shared project platforms will stay, because large projects cannot run without them. The lesson is to treat every shared file as something that may one day sit on an attacker's machine: keep less on the server, give each partner only what they need, encrypt what matters at file level, and keep the logs that show what really happened. That turns an extortion claim of 812 GB into a question you can answer with facts.
Share drawings with partners without losing control of them. CADChain gives every CAD file a verifiable ownership record, file-level encryption, granular permissions you can revoke at any time and a full access log, so your designs stay protected wherever they are copied.

👉 See how CADChain protects CAD files

FAQ: Brenner Base Tunnel cyberattack

What happened at Brenner Base Tunnel SE?

Attackers accessed a server that BBT SE used to exchange data with Italian contractors in mid-October 2026. BBT SE confirmed the attack in early November, isolated the server, brought in outside experts, informed the authorities and confirmed it received a ransom demand.

Was the tunnel construction affected?

According to BBT SE, no: construction continues and internal IT systems were not affected. There is no public evidence that attackers reached control systems.

What data was stolen?

BBT SE has not said. t-online reported that the server held 812 GB including tender documents and survey data, and BBT SE said much of it was already publicly accessible. How much was actually copied is unclear, and no publication of stolen data had been detected as of 9 November 2026.

Who is behind the attack?

The Russian-speaking extortion group Everest is suspected, based on an analysis by ZeroFox cited by the Tiroler Tageszeitung, and the group claims 812 GB. The attribution has not been officially confirmed.

Is the Fehmarnbelt attack linked?

There is no public link. The Fehmarnbelt incident hit the IT systems of main contractor FLC overnight into 12 October 2026, and the Danish National Special Crime Unit is investigating. No group has been publicly named.

Why are data-exchange servers a common target?

They must be reachable from the internet, they have many external users, and old files and accounts often stay after the work is done. One compromised partner login can open project-wide folders, as the Stadler Rail case showed.

Does file-level encryption help if a server is breached?

Yes. A file encrypted at file level stays locked when it is copied, and only opens for users whose permissions are still valid. It does not stop the intrusion, but it limits what an attacker can read and makes leak threats less damaging.

How does CADChain help protect shared engineering files?

CADChain encrypts CAD files at file level, lets you set and revoke permissions per user and partner, logs every access and records ownership on a blockchain. It works alongside, not instead of, secure servers, partner contracts and incident plans.