Security Experts:

Connect with us

Hi, what are you looking for?



Railway Vehicle Maker Stadler Hit by Malware Attack

Railway rolling stock manufacturer Stadler Rail is currently investigating a malware attack that forced some of its systems offline.

Railway rolling stock manufacturer Stadler Rail is currently investigating a malware attack that forced some of its systems offline.

Headquartered in Bussnang, Switzerland, the company produces a variety of trains (high-speed, intercity, regional and commuter heavy rail, underground, and tram trains), and trams, and has roughly 11,000 employees at over 40 locations.

Last week, the Swiss manufacturer announced that what appears to be a professional threat actor was able to compromise its network with malware and to exfiltrate an unknown amount of data.

“Stadler internal surveillance services found out that the company’s IT network has been attacked by malware which has most likely led to a data leak. The scale of this leak has to be further analyzed,” the company said in a press release.

The company did not provide details on the type of malware used in the attack, but revealed that the miscreants were attempting to extort money from Stadler by threatening to make stolen data public, in an attempt to “harm Stadler and thereby also its employees”.

The company said it immediately took the necessary steps to contain the incident and that it also engaged with an external team to launch an investigation into the matter. Authorities were also alerted.

Stadler also revealed that the affected systems were being rebooted, and underlined that its backup systems are functioning.

The company’s mentioning of systems having to be restored and of backup data suggests that ransomware might have been used in the attack.

Ransomware operators such as those behind Maze have been stealing victim data and have attempted to extort more money by threatening to make it public in the event a ransom is not paid, and the attack described by Stadler fits the pattern.

Contacted by SecurityWeek, the Swiss manufacturer refrained from providing additional details on the incident, given the ongoing investigation.

Related: Maze Ransomware Caused Disruptions at Cognizant

Related: Australian Shipping Giant Toll Hit by Ransomware for Second Time

Related: Shade Ransomware Authors Release Decryption Keys

Related: Human-Operated Ransomware Is a Growing Threat to Businesses: Microsoft

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...