The company building the Brenner Base Tunnel between Austria and Italy has confirmed that unauthorised people gained access to some of its data in a cyberattack in mid-October. BBT SE, the European company behind the cross-border rail project, said the affected data source was isolated as soon as the attack was discovered and that the relevant authorities were notified.

The Austrian daily Tiroler Tageszeitung first reported the incident on 6 November, and the company then confirmed it to other outlets. On 7 November, BBT SE told the Italian news agency ANSA that tunnel operations were unaffected, that the systems involved had been isolated, and that outside forensic experts and the authorities were working on the case.

The Russian-speaking extortion group Everest has claimed responsibility and says it took 812 GB of files, threatening to publish them if talks with the company fail. That figure has not been verified by anyone independent of the group. Security researchers who track Everest have noted that the group tends to exaggerate how much data it steals, and the size of a claimed haul says nothing about what the files contain. They could include drawings, surveys and site procedures, or they could be low-value material inflated to put pressure on the victim.

BBT SE has not said which data was touched or how far the attackers got inside its network. It has also declined to answer questions about whether it entered negotiations with the extortionists or made any payment. What the company has said, based on its current assessment, is that no operational processes have been affected and work on the tunnel continues.

There is also no evidence so far that attackers reached the tunnel's industrial systems or interfered with its control functions. BBT SE has not confirmed any encryption of its systems, so claims that ransomware could halt construction of the tunnel have no factual support at this stage. A company spokesperson told the German news agency dpa that the attack posed no danger to the construction or later operation of the tunnel and that high-security data was not affected.

Everest began in 2020 as a ransomware operation and has since moved almost entirely to data theft and extortion, according to security researchers. In July, the same group demanded CHF 10 million from the Swiss train maker Stadler Rail after using stolen credentials to reach a supplier's data platform. Production continued despite that incident.

The Brenner Base Tunnel is one of Europe's largest infrastructure projects, with a projected cost of about 11.7 billion euros, and it is not expected to open before 2034. That long timescale matters for the data risk: drawings and designs that are several years old may describe a version of the project that has since changed. Even so, if project documents were taken, they could save an attacker a great deal of reconnaissance and could be used to craft convincing fraudulent requests to contractors and suppliers.

Three questions now need clear answers: which files were actually taken, how recent and relevant they are, and who might still be able to use them. Until BBT SE or the investigating authorities provide those details, the confirmed facts are limited to the unauthorised access itself, the isolation of the affected systems, and the absence of any known effect on tunnel operations. Attribution also remains unconfirmed: no authority has confirmed that Everest carried out the attack, and speaking Russian or operating in a Russian-speaking cybercrime environment does not prove that a group is directed by the Russian state.