Data breach: Production and industrial SMEs, Switzerland 2026
In mid-July 2026, attackers used compromised login data to gain access to a data exchange platform that Stadler uses with a supplier.
- Incident · 07.2026 · Canton of Thurgau, Switzerland
- Evidence: confirmed by an authority
- Data breach
- Attack via a supplier
As of
What happened
In an extortion letter, the group Everest demanded 10 million francs. According to Stadler, its own IT systems were not affected and the supplier’s documents were not security-relevant; the company did not pay and filed a criminal complaint.
- Affected
- Stadler Rail
- Industry
- Production and industrial SMEs
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / no
- Data affected
- Documents of the supplier, according to Stadler not security-relevant
- Bankruptcy
- no
- Entry point
- Data exchange platform with a supplier, access with compromised login data
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Shared platforms with suppliers need dedicated logins with a second factor.
Sources
- Ransomware-Attacke: Stadler Rail hat nicht gezahlt (opens in a new window) IT-Magazine · 21.07.2026
- Revue mensuelle des cybermenaces, Juillet 2026 (opens in a new window) Kanton Waadt, Sicherheitszentrum SOC der DGNSI · 2026-08
«Stadler ne paiera en aucun cas de rançon et n'est donc pas exposée au chantage»