Stadler Rail Rejects $12.3M Ransom Demand from Everest Ransomware Gang

Swiss rail manufacturer Stadler Rail confirmed a cyberattack by the Everest ransomware gang, which demanded a ransom of CHF 10 million ($12.3 million) after breaching a data exchange platform shared with a supplier. The attack, which occurred in mid-July 2026, involved the theft of non-security-relevant technical information. Stadler stated that its own IT systems and production operations were not affected and continue to function normally. The company has filed a criminal complaint with local authorities and emphasized its policy against paying ransoms. As of the latest reports, Stadler is not listed on Everest's data leak site, which is unusual given the typical extortion playbook. The Everest group has shifted from encryption-based attacks to data theft and extortion since its emergence in 2020. This incident follows a similar cybersecurity event that Stadler experienced in 2020, though details of that attack were not fully disclosed.

Key Points: • Stadler Rail refused to pay a $12.3 million ransom demand from the Everest ransomware gang. • The breach involved non-security-relevant technical data accessed through a supplier's platform. • Stadler's IT systems and production operations remained unaffected by the attack.