A stolen supplier credential put Stadler's name on a CHF 10 million extortion demand

The compromise ran through a single credential set. It was tied to the supplier's side of the relationship, and it opened a data-exchange platform that Stadler Rail and that supplier both used, according to the dev.to account of the incident ^[8][1]. Stadler said its IT systems, production lines and rail vehicles were never touched ^[3].

What the account does not say is whose identity provider issued that login, which party the platform records as the account owner, or how long the supplier's technical files had been sitting in the shared workspace.

The dev.to write-up breaks the incident into five boundary questions and argues that most incident response models assume they collapse to one ^[11]. Tally the answers and they do not collapse. Data ownership and credential origin both land on the supplier ^[7][8]. Receipt of the demand and the public response both land on Stadler ^[9][10]. The fifth, the location of the compromise, lands on a platform described as sitting outside Stadler's own IT environment ^[12][15].

The legal exposure here is smaller than the reputational exposure. The only proceeding in the record is the criminal complaint Stadler itself filed with the Thurgau cantonal police ^[3][16]. The account does not mention any notification duty. No contract clause or supplier claim appears either. Stadler carried the press and the demand, and the write-up describes it making the public "we will not pay" statement ^[10].

Everest then claimed to have published the material, reportedly an archive of more than 271,000 files ^[5]. The count is the group's own; the write-up notes it has not been independently verified ^[6]. At the time Stadler disclosed the extortion, its name was not on Everest's leak site and nothing had been posted ^[4].

It also ships as an eight-slide carousel PDF ^[13]. For the model to transfer to your shop, two things have to be true: a shared platform where a partner's credentials can reach data whose loss you would be asked to explain, and a programme the outside world knows by your name and not the partner's. Stadler had both, and the write-up is careful to separate this from the commoner shape where a supplier's compromise becomes a route into your own network ^[14].