Swiss train builder Stadler Rail has refused to pay after receiving an extortion letter from the Everest ransomware group, which put a price of 10 million Swiss francs — roughly $12.3 million — on stolen data. The intrusion hit a data exchange platform that Stadler shares with one of its suppliers, and the manufacturer says its own IT estate and production lines were untouched. Everest has not publicly claimed the incident, and Stadler does not currently appear on the gang's leak site. The company has filed a criminal complaint with the Thurgau cantonal police.

What Stadler disclosed

Stadler dates the incident to mid-July. According to its disclosure, the attackers pulled data from a supplier via a jointly used data exchange platform, and what they took was technical information that is not security relevant. The company states that no relevant personal data was taken, that its rail vehicles in service around the world are unaffected by the theft, and that global production is running normally. Neither Stadler's IT systems nor its manufacturing operations were disrupted.

On the extortion demand itself, the company's position was blunt: "Stadler will not pay any ransom under any circumstances and is therefore not susceptible to extortion." Rather than negotiate, it went to the Thurgau cantonal police.

Stadler is one of the larger names in European rolling stock, producing locomotives, trams, metro and passenger trains, and railway signaling systems for operators worldwide. It runs 8 production facilities and 6 engineering sites, employs 18,000 people, and reports annual revenue above $4.9 billion — the kind of profile that makes it an attractive target for a data-leak extortion crew regardless of whether any encryption ever takes place.

Who Everest is

Everest surfaced in 2020 as a conventional ransomware operation, then dropped the encryption stage entirely. Its current model is theft plus a publication threat: pay, or the files go on the leak site. The group has also worked the other side of the market, reselling footholds in networks it compromised to other criminals as an initial access broker, and in some cases running extortion campaigns against data that other actors had already stolen.

The gang's infrastructure has had a rough year. Its original dark web leak site was defaced in April 2025 with the message:

Don't do crime CRIME IS BAD xoxo from Prague

Everest has since moved to a new domain. Stadler Rail has not been posted there so far, which is consistent with the extortion still being in its private-negotiation phase — or with the victim's refusal simply not having produced a listing yet.

This is not Stadler's first incident. In 2020 an unidentified group got into the company's IT systems, deployed malware across parts of the infrastructure, and stole data from compromised machines. That case had the shape of a ransomware attack, though Stadler never confirmed the classification at the time.

Technical background

The specifics of how the platform in this case was accessed have not been published, so what follows is general background on this class of incident rather than a description of the Stadler intrusion.

Encryption-less extortion — the model Everest and a number of peers now run — collapses the attack chain to access, staging, exfiltration, and a ransom note. There is no crypter to detect, no mass file-rename event, no ransom extension appearing across shares. Defenders lose the loudest signal in the entire kill chain, which is exactly the point: double extortion groups discovered that the leak threat, not the decryptor, was what actually moved money, and dropped the half that generated alerts.

Shared data exchange platforms are a favored entry point for the same reason. They sit between organizations by design, hold engineering documents, drawings, bills of material, and supplier correspondence in one place, and are frequently internet-exposed with credential-only authentication. A compromise of the supplier's account can yield the manufacturer's technical data without the manufacturer's own network ever being touched — which is why "our systems were not affected" and "our data was stolen" can both be true statements in the same disclosure.

Practical hardening for a shared transfer or collaboration platform, generically:

• Enforce phishing-resistant MFA on every external partner account, not just internal staff.
• Expire content by policy. A file-exchange workspace should not be an archive; anything that has sat untouched for 90 days is pure extortion inventory.
• Scope partner accounts to a single project folder, and audit that scoping on a schedule.
• Alert on bulk-download behavior rather than on individual accesses — the tell for exfiltration-only actors is volume and rate.

If the platform emits audit logs, a rate-based rule against the download events is usually the highest-value single detection. As an illustrative example against a generic JSON audit export:

jq -r 'select(.action=="download") | [.timestamp[0:13], .user, .file] | @tsv' audit.json \
  | awk -F'\t' '{c[$1"\t"$2]++} END {for (k in c) if (c[k] > 100) print c[k], k}' \
  | sort -rn

That is a template, not a tuned rule — the threshold and field names have to come from your own platform's schema and normal-day baselines.

Why the refusal matters

Public non-payment statements have become a common response among large industrial victims, and they are cheap to make when the stolen material is genuinely low-sensitivity. Stadler's framing does the work here: technical documents that are not security relevant, no relevant personal data, no impact on vehicles in service. If that assessment holds, the leverage Everest actually acquired is thin, and the 10 million franc figure is aspirational rather than negotiable.

The unresolved variable is the supplier. Stadler's disclosure covers Stadler's exposure; the partner whose platform data was taken has its own set of files in the same repository, and its own disclosure obligations. In shared-platform breaches, the second victim's assessment often lands weeks after the first one's.