Cyberattack hits company behind Brenner Base Tunnel, hackers accessed internet-reachable data

The attack and how it came to light

BBT SE, the company building and managing the Brenner Base Tunnel, was the target of a targeted cyberattack in which unauthorized people reached data accessible over the internet. The Austrian daily Tiroler Tageszeitung first reported the intrusion, and the company then confirmed it to ANSA and other outlets. Il Sole 24 Ore dates the attack to 17 October, while other reports place it in mid-October. Il Messaggero gives 6 November as the date of the public confirmation. In its statement, the company described how it responded.

“As soon as the incident was detected, the company activated IT security protocols, immediately isolating the affected systems.”

According to the company, it brought in outside cybersecurity specialists for forensic analysis and informed the competent authorities. Investigations into the details of the attack are still under way. La Repubblica reported that it remains unclear which data was compromised and how deeply the attackers penetrated the network.

Operations and the tunnel's scope

BBT said the incident has not affected its operational activities so far. A company spokesperson told the German news agency dpa that the attack posed no danger to the construction or later operation of the 64 km long tunnel, and that high-security data was not affected. The spokesperson gave no information on possible perpetrators or motives. The company is based in Bozen in South Tyrol, so Italian authorities are leading the investigation. The tunnel is priced at 11.7 billion euros and is due to cut travel times between Germany and Italy from 2034.

The company's assessment, as quoted by La Repubblica, is that the incident did not affect the work.

“The incident has had no impact on the construction of the tunnel.”

The Everest group and extortion claims

The Austrian broadcaster ORF reported that Everest, a Russian-speaking group active in cyber extortion, could be behind the attack. Under the method described, attackers steal data and threaten to publish it to extract money. ORF said BBT did not answer questions about negotiations or payments, while La Repubblica reported that the company declined to say whether it was negotiating with extortionists. Il Fatto Quotidiano, citing Tiroler Tageszeitung, said Everest had claimed the attack, a claim documented in a report by the information security firm Telsy. There has been no official attribution. The security firm ZeroFox has tracked Everest since 2021, and in a February analysis it described an organization focused on ransomware and extortion, warning that claims about stolen data may be inflated to pressure victims.

Wider context: the Fehmarnbelt project

Watson reported that the Fehmarnbelt tunnel project between Germany and Denmark was also hit by a cyberattack in mid-October. The attack on contractor Femern Link Contractors (FLC) temporarily affected several IT systems at the construction site, according to the parent company Femern A/S. That tunnel, about 18 km long, will connect the German island of Fehmarn with the Danish island of Lolland and is set to cut train travel between Hamburg and Copenhagen to about two and a half hours.