The bottom line: Stadler Rail rejects a $12.3 million extortion demand from the Everest hacker group and files a criminal complaint; operations and vehicle systems are not affected.
The Swiss rail vehicle manufacturer Stadler Rail was targeted in July 2026 via a data exchange platform shared with a supplier. The Everest hacker group subsequently demanded 10 million Swiss francs (approximately $12.3 million) in ransom—the company declined and filed a criminal complaint.
Stadler Rail confirmed that attackers gained access through a data exchange platform operated jointly with a supplier. Technical information was stolen in the attack. The company’s internal IT systems and global production operations were not affected. According to Stadler, no relevant personal data was stolen, and the rail vehicles deployed worldwide by the manufacturer are not at risk.
Following the security incident, the train manufacturer received an extortion letter from the Everest hacker group demanding 10 million Swiss francs in ransom. Stadler refused to pay and filed a criminal complaint with the Thurgau cantonal police. The company has made a public statement on its position regarding extortion attempts: “Stadler will under no circumstances pay ransom and is therefore not susceptible to extortion.”
Everest has been active as a hacker group since 2020, but has moved away from ransomware attacks involving system encryption and now focuses on data theft and extortion without encryption. Stadler Rail employs approximately 18,000 employees at eight production and six development sites and generates annual revenue exceeding $4.9 billion. The systems of delivered locomotives, streetcars, subways and signalling technologies operate independently of the affected exchange platform. A previous cyberattack on the group’s IT infrastructure occurred in 2020.
Source: www.it-daily.net · Published 23 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.