> Don’t Hand Propaganda a Gift: Reading the Brenner Base Tunnel SE Breach Calmly

Brenner Base Tunnel SE confirms a breach and Everest claims 812 GB. What we know, what we don’t, and why overblown alarm helps propaganda more than the attackers. Brenner Base Tunnel (BBT) SE, the company building the Brenner Base Tunnel between Italy and Austria, has confirmed that unauthorized people accessed some of its data. The extortion group Everest claims it took 812 GB of files. Nobody has verified that, and a criminal bragging about file sizes isn’t an audited source. The timeline is thin. The intrusion reportedly dates to mid-October, Everest’s claim to 17 October, and the Austrian press broke the story on 6 November. On 7 November BBT SE told ANSA that operations are unaffected, the systems involved are isolated, and outside forensic experts and the authorities are on the case. If real and current, drawings, surveys and site procedures would save an attacker a lot of reconnaissance. Together they could show how the infrastructure fits together, and fraudsters could borrow project names to fool contractors. Those are scenarios, not sightings. Dates matter too. The tunnel won’t open before 2034, at a projected cost of about €11.7 billion, so older drawings may describe a design that has since changed. Knowing how a tunnel is built does not mean being able to control it. Sabotage requires access to operational systems and weaknesses that attackers can exploit. So far, there is no evidence that attackers accessed industrial systems or tampered with the tunnel’s control functions. BBT SE has not confirmed any encryption of its systems either. Claims that ransomware could stop the tunnel therefore have no factual support. Everest is a Russian-speaking cybercriminal group. ZeroFox has also noted that the group tends to exaggerate the amount of data it steals. Speaking Russian and operating within a Russian-speaking cybercrime environment does not prove that the group is directed by the Russian state. In July, the same group demanded CHF 10 million from Stadler Rail after using stolen credentials to access a supplier’s data platform. Production continued despite the incident. The response should focus on practical security measures. Organizations need to identify which information was exposed, revoke potentially compromised credentials, keep document management systems separate from industrial control networks, and warn suppliers about fraudulent requests. Whether NIS2 applies to a project company that is still under construction depends on its activities and the relevant national legislation. There is no benefit in creating unnecessary alarm. It only helps the attackers and anyone trying to exploit the incident for an influence campaign. Blaming Moscow without evidence would play directly into propaganda efforts. There are three key questions that need clear answers: which files were actually stolen, how recent and relevant they are, and who might still be able to use them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Brenner Base Tunnel)