In brief
BBT SE confirmed a cyber intrusion on 17 October and isolated the affected systems; no operational impact on the Austria‑Italy Brenner Base Tunnel was reported. Analysts link the threat to the Russian‑speaking group Everest, a known member of an international cyber‑extortion network. BBT SE has not disclosed whether negotiations or payments took place, and the exact scope of data compromised remains unknown.
On 17 October, BBT SE, the company managing the Brenner Base Tunnel that connects Austria and Italy, confirmed a cyberattack targeted at its systems. The intrusion was quickly detected and isolated, and authorities were notified. Despite the breach, the tunnel’s daily operation was not affected.
In a statement to the Tiroler Tageszeitung, BBT SE said it had activated its cybersecurity protocols immediately after discovering the attack and had already begun investigating the details of the breach. The company declined to comment on whether it had entered negotiations or made any payments to the attackers.
Analysts from U.S. cybersecurity firm ZeroFox, cited in the report, linked the assault to a Russian‑speaking hacking group known as Everest. ZeroFox described Everest as part of an international cyber‑extortion network, gathering intelligence, threatening to publish stolen data, and demanding payment.
Everest has been active in other high‑profile cyber incidents across Europe and the United States, though no payment or ransom demand has been publicly confirmed by BBT SE. The company stated that, based on its current assessment, no operational processes had been affected by the intrusion.
The company’s chief information officer emphasized that critical infrastructure protection teams were engaged and that data integrity checks were underway. BBT SE also coordinated with the German and Italian data protection authorities to assess possible regulatory implications.
Meanwhile, the Austrian and Italian transport ministries issued statements reassuring the public that construction and maintenance schedules for the tunnel, which is a key freight corridor, would remain on track. No delays were indicated at this stage.
The investigation continues to identify the specific malware and methods used by the attackers. While Everest’s involvement is suspected, no direct evidence has yet been publicly shared that conclusively ties the group to the BBT SE attack.
BBT SE has not released a formal security audit, nor has it confirmed any data loss beyond the isolated systems. The company’s CEO noted that the organization has a resilient cybersecurity framework designed to prevent widespread compromise.
In the broader context, this incident adds to a series of cyber threats against critical European infrastructure that have drawn attention from both governmental security agencies and the private sector.
Uncertainties
Heaters remain on the identities of those responsible. The organization has not confirmed any payment or negotiation and the true extent of information accessed by the attackers is still unknown. Future assessments will clarify whether there will be any operational or regulatory consequences for the Brenner Base Tunnel project.
