Swiss Train Manufacturer Stadler Rail Rejects $12.3 Million Ransom Demand

Key points

• Stadler Rail received a ransom demand of $12.3 million from the Everest ransomware group in mid-July 2023.
• Hackers accessed a data exchange platform shared with a supplier; Stadler's own IT and production were not disrupted.
• Stadler employs 18,000 people across 8 production facilities and 6 engineering sites, with annual revenue above $4.9 billion.
• Everest abandoned file encryption years ago and now threatens to publish stolen data unless victims pay.
• Stadler filed a criminal complaint with the Thurgau cantonal police and says it won't pay ransoms under any circumstances.

Stadler Rail has flatly refused a $12.3 million extortion demand from the Everest ransomware group, after attackers broke into a supplier-linked data exchange platform in mid-July 2023. The company's own IT systems and global production carried on without interruption.

Stadler builds locomotives, trams, metro trains and railway signaling systems. It employs 18,000 people, runs 8 production facilities alongside 6 engineering sites, and turns over more than $4.9 billion a year. None of that output was touched by the breach.

Everest sent an extortion letter demanding 10 million Swiss francs, roughly $12.3 million. Stadler's response was blunt: "Stadler will not pay any ransom under any circumstances and is therefore not susceptible to extortion." The company also filed a criminal complaint with the Thurgau cantonal police.

What was actually taken? According to Stadler's own disclosure, the stolen material came from a supplier's data and consisted of technical information that carries no security relevance. No meaningful personal data was part of the haul. Rail vehicles operating worldwide remained unaffected.

How did the hackers get in?

Everest reached Stadler through a shared data exchange platform that connected the manufacturer with one of its suppliers. It's a reminder that a company's security posture is only as strong as its weakest supply-chain link, and a third-party file-sharing channel is exactly the kind of target attackers look for.

Everest emerged in 2020 as a conventional ransomware operation, encrypting victim networks and demanding payment for the decryption key. It dropped that approach and shifted to pure data theft, threatening to publish files unless the ransom lands. The group has also sold network access to other criminal actors, effectively doubling its revenue from a single intrusion.

One detail from SOURCE worth noting: Everest's original dark web leak site was defaced in April 2025 with the message "Don't do crime CRIME IS BAD xoxo from Prague," and the gang subsequently moved to a new domain. Stadler does not appear on that site yet.

Should you worry about the 2020 incident too?

This isn't Stadler's first brush with attackers. In 2020, an unidentified group planted malware across parts of its infrastructure and walked off with data. That incident had the hallmarks of ransomware, though Stadler declined to confirm it at the time. The recurrence suggests the company remains a target of interest, and a second incident within three years is worth watching closely.

For security teams at manufacturers with similar supplier-linked platforms, the operational lesson is concrete: shared file-exchange services are high-value entry points that often sit outside the hardened perimeter. Audit them first.

We covered Everest ransomware for the first time on 22 July 2026. Readers tracking the broader data-theft trend may also want to read our report on the 542,377 patient records stolen from a New Jersey lab company, a case that shows how quickly exfiltrated data becomes use.