Stadler Rail refuses a 10 million franc demand after a supplier-platform breach
July 21, 2026 (Mid-July 2026)
The Swiss rail manufacturer said criminals used compromised login details to reach a data-exchange platform shared with a supplier in mid-July, exposing the supplier's technical information. The Everest group demanded about 10 million Swiss francs (roughly $12.3 million). Stadler refused, filed a criminal complaint and said its own IT systems, production and trains in service were not affected. Everest later listed Stadler on its leak site, according to SOCRadar.
Why it matters
It shows the current extortion pattern: steal data, skip the encryption, and go through a partner's platform rather than the victim's own network.
What defenders can take from it
- Require multi-factor authentication on shared partner portals.
- Decide your ransom policy before an incident, as Stadler had.