Major Cyberattack

Ransom Demand Following Brenner Tunnel Cyberattack

The operating company BBT SE has been affected by the attack.(Bild: WOLFGANG GOLLMAYER, Krone KREATIV)

New details were released on Monday following the cyberattack on BBT SE, the operating company of the Brenner Base Tunnel. According to the report, unauthorized access was gained to a data exchange server. Internal IT systems and construction operations were not affected, based on current information, the company said. A ransom demand has also already been received. Investigations are ongoing.

The cyberattack took place on October 17. As the company itself officially announced on Monday, unknown individuals gained unauthorized access to a server used for data exchange between BBT SE and Italian contractors.

Affected data source isolated
“The volume of data stored on the server amounts to 812 gigabytes,” the statement said. Immediately after the incident came to light, BBT SE “initiated the necessary security measures. The affected data source was disconnected from the network and isolated, IT security protocols were activated, and external cybersecurity experts were commissioned to conduct a forensic analysis,” the company said.

BBT SE can confirm that a ransom demand was received in connection with the cyberattack.

Die BBT SE in einer Aussendung

Perpetrators Demand Ransom
Experts are also monitoring whether stolen data is being published online. To date, no such publications have been detected. “Any attempt by the hackers to contact BBT SE has been—and will continue to be—reported to the relevant investigative authorities,” the company emphasized in a press release.

The perpetrators have, in fact, already attempted to make contact: “BBT SE can confirm that a ransom demand has been received in connection with the cyberattack.” Since the investigation is ongoing, “no information can currently be provided regarding the content of the demand or further details,” the statement continued.

The Brenner Base Tunnel is turning into a test of patience! The opening of this once-in-a-century project has been postponed yet again, as was recently announced.(Bild: BBT SE)

No Impact on Construction Operations
Based on current information, the incident is not expected to have any operational consequences for the major Brenner Base Tunnel project. According to BBT SE, the attack was limited to the external data exchange server. The company’s internal IT systems were not affected.

Construction work is also continuing without restrictions. The safety of ongoing construction operations was not compromised at any time. Likewise, there is no risk to future rail operations.

Technical Documents and Tender Data
The affected BBT SE data consists of technical and administrative documents, most of which were already publicly available, including, for example, tender documents and surveying data. The Italian contractors involved have been informed. Based on current information, Austrian contractors are not affected.

BBT SE is currently unable to provide further details regarding the scope and nature of the contractors’ data. This is the subject of the investigation.

BBT SE has informed the relevant Italian authorities and initiated the necessary legal steps.