Summary
Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot, our reportingEverest ransomware group claims Stadler Rail’s database was leaked, exposing about 201 GB of data and roughly 271,868 files. The leaked material is described as including passenger-information system materials, train-system components, and related onboard runtime components and train-system configuration files. The leak post identifies stadlerrail.com as the victim domain and lists Java, Python and PowerShell as platforms. ThreatCluster’s news reporting notes Stadler Rail reportedly rejected a ransom demand of CHF 10 million (about $12.3 million) after a breach of a supplier data-exchange platform, with the incident described as occurring in mid-July 2026.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Platforms
- FTP Java Python
What was taken
Stadler Rail Database Leaked
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- download_link
- https://fex.net/s/bxmnyyk
- Download full database
- https://fex.net/s/bxmnyyk
Leak-site images (11)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.