# Stadler Rail Stands Firm Against Ransom Demands After Supplier Breach **Stadler Rail**, a leading Swiss train manufacturer, has confirmed it will not yield to a $12.3 million ransom demand after cybercriminals exfiltrated technical data from one of its supplier's file-sharing platforms. The company's steadfast refusal underscores a critical stance in the face of increasing ransomware threats. ## Incident Details and Impact The breach, which occurred in mid-July, involved the compromise of credentials for a data exchange platform used by a third-party supplier. **Stadler Rail** clarified in a recent statement that its own systems were not affected, and all production sites remain fully operational. The stolen information consisted exclusively of technical documents belonging to the supplier, with no loss of Stadler's proprietary data or relevant personal information. The company asserts the breach has no impact on its global train operations. ## The Ransom Demand and Stadler's Response The **Everest** ransomware group claimed responsibility for the incident, demanding 10 million Swiss francs (approximately $12.3 million USD) in an extortion letter. **Stadler Rail** has filed a criminal complaint and unequivocally stated its position: "Under no circumstances will Stadler pay a ransom and therefore cannot be extorted." As of Thursday, **Everest** had not listed **Stadler Rail** on its dark web leak site, nor had it begun releasing any of the stolen supplier data. **Stadler Rail** declined to provide further comment on the ongoing incident. ## A History of Resilience Against Extortion This is not the first time **Stadler Rail** has faced extortion attempts. In 2020, unknown attackers infiltrated some of the company's systems, stole internal data, and demanded roughly $6 million in Bitcoin. **Stadler Rail** similarly refused to pay, even after the attackers published samples of the stolen files, which reportedly included financial and administrative documents. The company's consistent refusal to negotiate highlights a firm, long-standing policy. ## The Threat of Everest Ransomware **Everest** is a Russian-speaking ransomware and extortion group that has been active since at least 2020. The group has a history of targeting organizations within critical infrastructure sectors, including energy, transportation, and telecommunications. Last year, **Everest** claimed responsibility for a cyberattack involving an external file transfer system used by Sweden's state-owned electricity grid operator, **Svenska kraftnät**, though power supplies remained undisrupted. More recently, the group also took credit for a breach affecting a contractor for Japanese automaker **Nissan**, where systems operated by a third-party vendor were compromised. ## The Perils of Paying Ransoms Cybersecurity experts widely advise against paying ransoms, as it often emboldens attackers and can lead to further demands. Research by **Proofpoint** published this week, based on a survey of 953 organizations, found that 54% of victims paid ransoms. Of those, over one-third subsequently faced a second extortion demand, underscoring the risks associated with capitulating to cybercriminals.