Stadler Rail refuses $12.3 million ransom demand after supplier data breach
The Everest ransomware gang demanded $12.3 million from Stadler Rail $SRAIL after breaching a data-exchange platform shared with one of its suppliers, using stolen credentials. Stadler refused to pay and filed a criminal complaint with police.
The Everest ransomware gang has demanded $12.3 million from Swiss train manufacturer Stadler Rail (SIX: SRAIL) after breaching a data-exchange platform the company shares with one of its suppliers. The attackers gained access using stolen supplier login credentials and exfiltrated technical data, though Stadler says none of it was safety-critical. Stadler has refused to pay, citing a longstanding policy against negotiating with threat actors, and has filed a criminal complaint with police. The company says its internal IT systems, global production lines and rail vehicles already in service remain unaffected. This is not the first time Stadler has faced this kind of extortion: in 2020, hackers demanded roughly $6 million after a separate breach, which Stadler also refused, leading attackers to leak internal documents including bank contracts and tax records. The pattern points to a wider shift in how ransomware groups operate: rather than attacking a well-defended manufacturer directly, they target smaller suppliers with weaker security and use that access as a way in. Per BleepingComputer.