Loading story…
Stadler Rail said a cyberattack targeted a data-exchange platform operated by one of its suppliers after attackers obtained compromised login credentials, allowing access to certain technical data. The company said its own internal IT systems were not breached, production continued normally, and no sensitive personal data was stolen; it also reported that the incident did not create any safety risk and later indicated the situation was under control.
The attackers were identified as the Everest group, which reportedly demanded 10 million Swiss francs in ransom after the data theft. Stadler said it would not pay, filed a criminal complaint, and stated that no confirmed data loss had been established beyond the accessed supplier-platform information.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On July 21, 2026, reporting indicated Stadler gave the all-clear following the cyberattack. This marked a public statement that the situation had stabilized after the incident.
Stadler publicly refused to pay the 10 million Swiss franc ransom demanded by Everest and said it had filed a criminal complaint. The company also stated that production was continuing normally.
Following the data theft, the Everest cybercriminal group demanded a ransom of 10 million Swiss francs from Stadler. The company said the stolen material did not include sensitive personal data and posed no safety risk.
In mid-July 2026, cybercriminals used compromised login credentials for a data-exchange platform operated by one of Stadler's suppliers to access certain technical data. Stadler said its own internal IT systems were not compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourcehelpnetsecurity.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceinside-it.ch
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Svenska kraftnät, Sweden’s state-owned power grid operator, confirmed a data breach after the Everest ransomware group claimed responsibility for stealing approximately 280 GB of internal data. The incident was limited to an external file transfer system and did not impact the country’s electricity supply or mission-critical systems. The company is collaborating with police and national cybersecurity authorities to assess the scope of the breach and determine what information may have been exposed, while refraining from attributing the attack until further confirmation is available. Everest threatened to publish the stolen data unless its demands were met, posting the claim on its leak site. The group has previously claimed responsibility for attacks on other major organizations, though these claims have not always been independently verified. Svenska kraftnät’s Chief Information Security Officer emphasized that immediate action was taken and reassured the public that the electricity supply remains unaffected. The investigation is ongoing, and the company has not commented on the perpetrators or their motives at this stage.
Jul 12, 2026
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026
Stiftung Wagerenhof in Uster, Zurich, disclosed that a ransomware attack hit its virtual IT environment, blocking access to multiple systems and encrypting data. The attackers later issued a ransom demand after the intrusion, disrupting the foundation’s operations and prompting the organization to publish ongoing public updates about the incident. The foundation said it shut down all systems and connections immediately after detecting the attack and brought in external ICT and cybersecurity specialists to support containment and recovery. Cantonal police were involved, the incident was reported to Switzerland’s Federal Office for Cybersecurity (**BACS**), and a criminal complaint was filed; Wagerenhof also said it would not pay the ransom.
Jul 23, 2026