Brenner Base Tunnel SE (BBT SE) has confirmed that attackers got into some of its data in mid-October. BBT SE is the Austrian-Italian company building the 55 km rail tunnel between Fortezza and Innsbruck. A company spokesperson told the Tiroler Tageszeitung that early investigations by the authorities point to Everest, a data-theft and extortion group. Everest says it took 812 GB of files, but nobody has verified that figure. In a separate incident, the gift-experience company Smartbox has told customers that names and email addresses may have been exposed after unauthorised access it found on 3 November. Some Italian coverage has grouped the two incidents together, but no one has publicly named who attacked Smartbox. La Repubblica reports that Europol will host a meeting next week with police from every country hit by the current wave of cyberattacks. Italian authorities are gathering evidence to share at that meeting.
What Happened
Brenner Base Tunnel. The Tiroler Tageszeitung was the first to report the attack. Security Affairs dates the first story to 6 November, and Krone and la Repubblica followed on 7 November. BBT SE then confirmed it in a statement carried by ANSA and Il Sole 24 Ore. The company says it called the attack "targeted" and that the attackers reached data "accessible via the internet." It says it activated its cybersecurity protocols as soon as the incident was found, isolated the affected systems, brought in outside forensic specialists and notified the authorities.
The timeline is still thin. Security Affairs puts the intrusion in mid-October and dates Everest's claim to 17 October. That means the claim appeared on the group's leak site about three weeks before the incident became public. Krone reports that the stolen data showed up on a dark web platform, and that the US security firm ZeroFox linked that platform to Everest.
BBT SE says the incident "has not affected the construction of the tunnel" or its operations. Several things remain unanswered: what data was taken, how far into the network the attackers got, and whether there has been any ransom negotiation or payment. La Repubblica reports that the company declined to say whether it was negotiating with extortionists, and Krone says it is unclear whether anything was paid.
Smartbox. Smartbox sells experience gift boxes and digital vouchers. Crimesite, citing the Danish outlet B.T. via Ritzau, says the company emailed customers on Saturday. In that email Smartbox said: "On 3 November 2026, we discovered unauthorised access to one of our platforms." It says the relevant authorities have been notified, including the Data Protection Commission and the police, and that it has opened a wider investigation.
How the two incidents connect. La Repubblica's headline puts the Everest attribution and the Smartbox theft side by side. However, its own reporting attributes only the BBT SE incident to Everest. Punto Informatico says outright that the Smartbox attackers are unknown, and Crimesite says it is unclear who was behind it. Readers should treat these as two separate confirmed incidents, with an attribution so far reported for only one of them.
What Was Taken
BBT SE: Everest claims 812 GB, according to Security Affairs and SC Media. That is the attacker's own figure. Security Affairs notes that "a criminal bragging about file sizes isn't an audited source," and cites ZeroFox's observation that Everest tends to exaggerate how much it steals. BBT SE has not said what kinds of data were involved. Its only description is "data accessible via the internet," and Forux points out that this wording does not show what was viewed or changed. Security Affairs says that if the leaked files include engineering drawings, surveys and site procedures, they would be useful for reconnaissance and for fraud aimed at contractors. It frames this as possible scenarios, not things that have been seen. BBT SE has not confirmed that any of its systems were encrypted.
Smartbox: The company says customer names and email addresses may have been exposed. It states that the attackers did not get payment card data or passwords. It has not said how many customers are affected. For scale, Crimesite cites the company's website as saying it handles about four million experience packages a year across ten countries.
Why It Matters
Supply-chain and fraud exposure is the real risk, not sabotage. The tunnel is not due to open before 2034, at a projected cost of about €11.7 billion. That means no live rail traffic depends on the systems involved. Security Affairs and SC Media both stress that there is no evidence the attackers reached industrial control systems or tampered with any tunnel control functions. Claims that ransomware could "stop the tunnel" have nothing behind them. The more realistic danger is downstream. A big multinational construction project has a long list of contractors, subcontractors and suppliers. Stolen correspondence, project names and contact lists can be used to send convincing invoice-fraud and phishing emails to all of them.
Everest keeps going after European transport targets. SC Media reports that the same group attacked Swiss rolling-stock maker Stadler Rail in July using stolen credentials. Security Affairs reports a CHF 10 million demand in that case. Two attacks on European rail-sector companies in four months suggests the group sees the sector as a worthwhile target. It may not be a deliberate campaign.
Criminal extortion is not the same as state direction. Italian and Austrian coverage has put the BBT SE breach under the heading of "hybrid warfare." It sits next to other recent events in Italy: hoax bomb threats against flights, attacks on supermarket refrigeration systems and blood banks, and a dark-web list of eighteen "enemies of the Russian Federation" published by the pro-Russian hacktivist group NoName. That list names Foreign Minister Antonio Tajani, Rome Prosecutor Francesco Lo Voi and Postal Police chief Ivano Gabrielli. Everest operates in the Russian-language criminal underground. As Security Affairs notes, that alone does not show the Russian state is directing it, and no investigator has publicly claimed that it is. Europol's coordination meeting may help clarify whether these incidents are connected or simply happening at the same time. Until then, defenders should treat the BBT SE breach as financially motivated data extortion.
The Attack Technique
Neither BBT SE nor investigators have said how the attackers got in. The company's description of the affected data as "accessible via the internet" hints at systems facing the outside world, such as a document portal, file-sharing service or collaboration platform. That is an inference, not a confirmed finding. Everest's usual pattern is to steal data and threaten to publish it, as Krone describes it. It does not always encrypt systems, and its access often starts with valid credentials that were stolen or bought, as in the Stadler Rail case SC Media describes. Smartbox has said only that unauthorised access hit "one of our platforms." It has not said how the access happened or who was responsible.
What Organizations Should Do
- Audit external file and document platforms. Infrastructure and construction firms should list every internet-facing document management system, file share and project collaboration portal. They should then enforce phishing-resistant MFA on all of them and remove old or orphaned accounts, especially accounts belonging to former contractors.
- Reset credentials after a supplier or partner breach. Everest has used stolen credentials before. If you work with BBT SE or other affected parties, rotate shared accounts, API keys and any federated access, and check logs for unusual bulk downloads since early October.
- Warn suppliers about invoice and impersonation fraud. Tell the contractors on your large projects that leaked project names and correspondence may show up in convincing fake emails. Require a call-back on a known number before any change to bank details or payment instructions.
- Watch for large outbound transfers. A claimed 812 GB theft that went unnoticed for weeks shows how much data-loss monitoring matters. Alert on large or unusual exports from document repositories and cloud storage, not only on encryption activity.
- Smartbox customers and similar consumer brands: expect phishing. Leaked names and emails are ideal for targeted phishing. Following Smartbox's own advice, do not click links in messages claiming to be from the company, and contact it directly. Brands in the same position should publish clear rules on how they will and will not contact customers.
- Keep IT and operational technology separate. For critical infrastructure projects heading toward operation, check now that corporate IT is strictly segmented from future control and signalling systems. That way a data breach like this one cannot become an operational incident later.
Sources: Hacker attack on the Brenner Tunnel: “Action by the Russian group E... | Don’t Hand Propaganda a Gift: Reading the Brenner Base Tunnel SE Br... | Brenner Base Tunnel SE confirms data breach as Everest group claims... | Guerra ibrida: attacco al tunnel del Brennero e Smartbox | Attacchi al tunnel del Brennero e a Smartbox | Smartbox hit by cyber attack: customer names and email addresses ma... | Daten im Darknet - Angriff! Brenner Basistunnel im Visier von Hacke... | Brenner Tunnel: hacker attack on the operating company Bbt Se - Il...