BBT SE

Summary

BBT SE, the firm constructing the 64-kilometre Brenner Base Tunnel between Austria and Italy, confirmed a targeted cyberattack in which attackers accessed some data reachable via the internet. The company isolated the affected systems, engaged external cybersecurity specialists for forensic analysis, and notified relevant authorities, while stating that tunnel construction, operational processes, and high-security data were not affected.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

BBT SE, the company responsible for constructing the Brenner Base Tunnel between Austria and Italy, confirmed that it was the target of a targeted cyberattack. The Brenner Base Tunnel is 64 kilometres long. The cyberattack occurred on 17 October 2026, and dpa international reported on the incident on 7 November 2026. Attackers accessed some data that was reachable via the internet. BBT SE stated that the incident did not affect tunnel construction or operational processes. A company spokesperson told Deutsche Presse-Agentur that high-security data was not affected. Anadolu Agency also carried the story, reporting that the company behind the tunnel project was hit by a cyberattack. The company confirmed that attackers reached some data that was available over the internet.

As soon as the incident was detected, BBT SE activated its IT security protocols. The company immediately isolated the affected systems. BBT SE engaged the support of external cybersecurity specialists to conduct the necessary forensic analyses. All required procedures were initiated, and the relevant authorities were informed. BBT spokesperson Julia Gruber, as reported by Bluewin, stated that attackers partly gained access to data that could be reached from the internet. La Repubblica quoted BBT SE as saying the incident had not affected the construction of the tunnel. The company’s statement in the English-language Unione Sarda report described detection, containment, investigation, and notification steps as having been taken.

The company has not disclosed how much data the attackers saw, what kind of data it was, or how deeply they penetrated the network. BBT SE has not specified which system the attackers touched or how long the attackers had access. Claims that the Russian-speaking group Everest was behind the attack, that Noname057(16) played a role, or that anyone demanded a ransom remain unconfirmed. No source confirms a ransom demand, a ransom amount, or negotiations. BBT SE has not named a regulator, a police unit, or a completion date for the forensic work.

Sources

Sources available to members: 2 sources.