# Stadler Rail ransomware and extortion case

> Live situation record from CLSTR: https://clstr.news/situations/stadler-rail-ransomware-and-extortion-case
> Updated: 2026-08-17T05:09:13.000Z. Sources: 8. Developments: 2.

In mid-July 2026, Swiss train manufacturer Stadler Rail reported a data breach involving the Everest ransomware and extortion group. The attackers accessed a shared file-exchange platform used by a third-party supplier, stealing approximately 500 gigabytes of the supplier's technical documents. Everest demanded a ransom of 10 million Swiss francs, which Stadler refused, stating that “under no circumstances will Stadler pay a ransom and therefore cannot be extorted.”

By August 2026, legal proceedings began in the District Court of Zurich against a 52-year-old Ukrainian software developer. Prosecutors allege the individual was a central organizer of a criminal group responsible for several years of international ransomware attacks, including the breach at Stadler Rail. The defendant faces multiple charges, including professional extortion, serious data damage, and money laundering, with prosecutors seeking a twelve-year prison sentence.

## Timeline

### 2026-08-17: Ukrainian developer on trial for ransomware attacks on Stadler Rail

A Ukrainian software developer faces trial in Zurich for organizing ransomware attacks against companies like Stadler Rail, causing millions in damages and theft of confidential data.

8 sources. https://clstr.news/cluster/ukrainian-developer-on-trial-for-ransomware-attacks-on-stadler-rail

### 2026-07-21: Stadler Rail Rejects $12 Million Ransom Demand in Supplier Data Breach

Stadler Rail declined a $12.3 million ransom from ransomware group Everest after a supplier‑portal breach stole technical data; the firm filed a complaint and reported no operational impact.

4 sources. https://clstr.news/cluster/stadler-rejects-10-millionfranc-ransom-after-cyberattack-via-supplier-platform

---
Cite as: Stadler Rail ransomware and extortion case. CLSTR, https://clstr.news/situations/stadler-rail-ransomware-and-extortion-case