In brief
On 7 November 2026 a cyberattack hit BBT SE, the company overseeing the Brenner Base Tunnel. The Russian‑speaking group Everest is suspected, but BBT SE confirms that the incident was contained and operations remain unaffected. Investigations are underway as authorities seek further details.
On 7 November 2026 a cyberattack was reported on BBT SE, the operator of the Brenner Base Tunnel that links Austria with Italy. The incident was confirmed to the Austrian newspaper Tiroler Tageszeitung and later covered by Anadolu Agency.
The attack appears to have involved a Russian‑speaking hacking group known as Everest, linked by analysts at U.S. cyber‑security firm ZeroFox to an international cyber‑extortion network that selectively steals data, threatens to publish it and demands payment. The source indicated that while the group gained partial access to data “accessible via the internet,” no evidence of extortion or ransom demands was yet established.
In a statement to the press BBT SE said it was alerted to the breach and immediately isolated the compromised data source. The company notified relevant authorities as soon as the incident was detected, and no part of the tunnel’s operation was disrupted. BBT SE declined to comment on whether negotiations with the hackers had taken place or whether any payments had been made.
According to the same report, BBT SE’s assessment found that none of the operational processes for the tunnel were affected by the intrusion. The company has put in place investigation measures and is working closely with security analysts to uncover the full extent of the attack.
The cyberattack was also noted by Italian outlet La Repubblica, which highlighted that the attackers managed to gain partial access to internet‑exposed data. However, the article pointed out that the details of the hack were still being examined and the source could not confirm any damage or future threats.
Investigation underway
BBT SE is cooperating with both Italian and Austrian authorities to identify the attackers and assess any potential damage to the tunnel’s digital infrastructure. ZeroFox, cited in the Anadolu piece, stated that the suspected group frequently targets industrial infrastructure with the aim of extracting sensitive data, though no payment has been reported in this case.
Given the strategic importance of the Brenner Base Tunnel as a key transport corridor across the Alps, officials have stressed that the incident does not pose an immediate risk to the safety or efficiency of rail, road or freight traffic through the tunnel. The resilience of the project’s cyber‑defence systems was cited by BBT SE as a key factor that allowed the company to isolate the breach quickly.
Both the Austrian and Italian governments have ordered that the tunnel’s cyber‑security protocols be reviewed and upgraded in a bid to prevent future intrusions. BBT SE is scheduled to present a detailed report on security measures taken during a forthcoming press conference, the date of which has not yet been announced.
As investigations continue, stakeholders and journalists await definitive statements from BBT SE, the involved national authorities and the analysts at ZeroFox on the nature of the breach and how it may impact the tunnel’s long‑term security posture.
