The company responsible for building the Brenner Base Tunnel, a major railway link between Austria and Italy, has confirmed that it was hit by a targeted cyberattack.
The incident has raised concerns about the cybersecurity of European infrastructure, although the company says construction activities have not been disrupted.
Brenner Base Tunnel SE, commonly known as BBT SE, said unauthorised individuals gained access to data available through its internet-connected network. The attack took place on October 17, according to reports published on November 7.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
After detecting the intrusion, the company activated its cybersecurity procedures, isolated affected systems and brought in external specialists to conduct forensic investigations. Relevant authorities were also notified.
BBT SE has not disclosed what information was accessed, how much data may have been taken or how far the attackers penetrated its systems. Stolen information can create risks after an intrusion.
Confidential project documents, employee information, supplier records or internal communications could potentially be misused, although the company has not confirmed that these categories were compromised.
Initial media reports have pointed to the Russian-speaking cybercrime group Everest as a possible perpetrator. The group is associated with data theft and extortion campaigns in which attackers threaten to publish stolen material unless victims pay.
However, investigators have not publicly confirmed responsibility. BBT SE has also declined to comment on whether it has entered negotiations with the hackers or paid a ransom.
The company says the incident has not affected its operational processes or construction work. That distinction is important. The Brenner Base Tunnel is still being built.
So the immediate concern is not an interruption to passenger services but the protection of the engineering, commercial and administrative systems supporting the project. BBT SE says the attack does not pose a risk to ongoing works based on information currently available.
The tunnel is one of Europe’s major cross-border transport projects. It is designed to connect Innsbruck in Austria with Fortezza in Italy beneath the Alps. The main route is approximately 55 kilometres long, with an additional Innsbruck bypass.
Once completed, the link is expected to strengthen rail connections between northern and southern Europe, improve freight movement and shift freight from Alpine roads. BBT SE was established by Austria and Italy, which hold equal ownership, to plan and construct the project.
The attack highlights the vulnerability of infrastructure projects that depend on digital networks, contractors and cross-border coordination.
Even when operational technology remains untouched, stolen information can expose procurement arrangements, technical plans and business relationships. Such data may be valuable to criminals seeking ransom payments or other actors interested in disrupting strategic projects.
BBT SE must now determine what was accessed, secure its systems and assess any longer-term consequences. Authorities and cybersecurity experts will need to establish how the intrusion occurred, identify compromised information and decide whether further protective measures are necessary.
Until those findings are released, the full scale of the breach remains uncertain. The incident is a reminder that protecting major infrastructure requires more than physical security.
As Europe invests in strategic transport links, cyber resilience must remain central to project management, supplier oversight and public confidence for future generations across Europe.