Stadler Rail supplier-platform breach and CHF 10 million Everest extortion

On 22 July 2026, Swiss rolling-stock manufacturer Stadler Rail confirmed a cyberattack in which intruders used compromised login credentials to access a data-exchange platform shared with one of its suppliers in mid-July. The attackers stole technical information that Stadler described as not security-relevant and belonging largely to the supplier, and the company said no relevant personal data was taken.

The Everest gang, which began as a ransomware operation in 2020 and has since shifted to data-theft extortion, demanded 10 million Swiss francs (about $12.3 million). Stadler rejected the demand outright, stating that it "will not pay any ransom under any circumstances," and filed a criminal complaint with the Thurgau cantonal police.

Impact

Stadler, which employs about 18,000 people and reports more than $4.9 billion in annual revenue, said neither its own IT systems nor its global production were affected and that operations continued normally. The company had previously been hit by a cyberattack in 2020.

Why it matters

The incident shows how shared collaboration platforms with suppliers create an attack surface that sits partly outside a manufacturer's own controls: a single set of stolen credentials was enough to reach engineering data. Stadler's public, unconditional refusal to pay also illustrates how a clear no-payment policy can blunt data-theft extortion when the stolen material has limited value to the attackers.