Stadler Rail Cyberattack: Swiss Train Maker Rejects $12.3M Ransom

Stadler Rail has refused to pay a $12.3 million ransom following a cyberattack on a data exchange platform it shares with one of its suppliers. The Everest extortion group sent the Swiss train manufacturer a letter demanding 10 million Swiss francs. Stadler rejected the demand and filed a criminal complaint with the Thurgau cantonal police. The company confirmed that the cyberattack left Stadler production systems and vehicles in service untouched.

Inside the Stadler Rail Cyberattack

The intrusion happened in mid-July. Attackers obtained valid login credentials for a shared platform that Stadler and one supplier use to exchange technical files. They used those credentials to reach the data stored there. The attackers deployed no malware and needed no exploit.

The stolen material belongs to the supplier rather than to Stadler. It covers technical information the company describes as not security relevant, and it contained no personal data of consequence.

Investigators found no lateral movement into Stadler internal infrastructure. Production continues as normal across the company's global sites, and rail vehicles already in service carry no risk from the theft. The Stadler Rail cyberattack never reached the factory floor.

A Flat Refusal to Negotiate

Stadler's response left no room for interpretation. The company stated it will not pay any ransom under any circumstances and is therefore not susceptible to extortion. Reporting the case to cantonal police turned a private extortion attempt into a criminal matter.

Scale gives the manufacturer room to take that line. Stadler builds locomotives, trams, metro trains, passenger trains, and railway signaling systems for operators worldwide. The company employs roughly 18,000 people and posts annual revenue above $4.9 billion. A firm of that size can absorb a leak of supplier drawings more comfortably than the supplier itself can.

Refusal also drains the attacker's leverage. Everest holds files it calls valuable, but Stadler has already told the market what the cyberattack involved and what it did not.

Everest Dropped Encryption for Pure Extortion

Everest surfaced in December 2020 as a conventional ransomware operation, locking files and charging for decryption keys. The group later abandoned encryption. It now steals data and threatens publication, which lowers its operational risk while keeping pressure on victims.

Several revenue streams run in parallel. Everest has sold access to breached networks to other criminal groups, working as an initial access broker. Since October 2023 the group has advertised cash payments to employees willing to hand over remote access. It has also bought data stolen by other actors and built fresh extortion campaigns around it.

Analysts who track the group point to a habit of exaggeration. Everest has overstated the volume and sensitivity of stolen files before, and researchers judge some of its claims fabricated outright. Stadler has not appeared on the group's leak site, and Everest has made no public claim about the cyberattack beyond the letter it sent.

The group's original dark web leak site went dark in April 2025 after an unknown party defaced it with a taunting message. Everest now runs a replacement domain and continues to post victims. Its list has climbed into the hundreds since 2021, with healthcare, professional services, manufacturing, and technology firms taking the largest share.

Shared Platforms Widen the Attack Surface

Collaboration systems sit between organizations by design. Suppliers, contractors, and engineering partners need somewhere to exchange drawings, specifications, and test results, so companies build shared environments and issue credentials to people outside their own payroll. Everyone of those accounts becomes a possible way in.

Stolen credentials make that route cheap to use. An attacker holding a working login needs no exploit, and end point tools have no malware to catch. The session looks ordinary until data starts moving in volume.

The Stadler Rail cyberattack follows a pattern security teams have watched for years. Breaches land on infrastructure a company does not fully control, but the company still fields the ransom demand and the regulatory questions.

A Second Incident in Six Years

Stadler faced something similar in 2020. An unidentified group entered its IT systems, planted malware across parts of the infrastructure, and stole data from compromised devices. The case carried the hallmarks of ransomware, though the company never confirmed that publicly.

The two events differ in one important way. In 2020 the attackers operated inside Stadler's own network. This time they stopped at a shared platform, and the cyberattack cost Stadler no production time at all.

Lessons for Supplier Access

Vendor accounts deserve the same scrutiny as employee accounts. Multi-factor authentication on every external login raises the cost of a stolen password sharply. Access reviews should run on a fixed schedule, and dormant supplier accounts should close rather than linger.

Monitoring matters as much as gatekeeping. Bulk downloads from a file exchange platform outside working hours deserve an alert. Logging that covers third-party systems gives responders something concrete to examine when an extortion letter lands.

Contracts carry weight here too. Supplier agreements should set notification deadlines, define who investigates a shared platform, and spell out who speaks publicly. Manufacturers that settle those terms in advance avoid arguing about them during an active incident.

Stadler's handling of the cyberattack offers a usable template for other manufacturers. Refuse payment, involve law enforcement, and state plainly what attackers took and what they did not. Clear disclosure within days left Everest very little room to inflate the story.