Swiss Government SharePoint Breach Compromises Around 200 Accounts

Switzerland’s federal IT office says attackers breached its Microsoft SharePoint servers and compromised approximately 200 user accounts.

The Federal Office for Information Technology and Telecommunication, known as BIT, detected unusual activity on its SharePoint environment on July 28. After confirming the incident, the agency cut off external internet access, patched suspected vulnerabilities and reset passwords for affected users.

Officials say investigators have not found evidence that attackers stole data beyond the compromised login credentials.

Security teams found compromised credentials

BIT said its security specialists identified several compromised account credentials during their investigation on July 31.

The agency believes attackers exploited one or more Microsoft SharePoint flaws that Microsoft disclosed in mid-July. Microsoft included fixes for those issues in its July 2026 Patch Tuesday updates.

However, BIT has not identified the exact vulnerability behind the Swiss government SharePoint breach.

Investigators are considering whether attackers used CVE-2026-56164, an actively exploited SharePoint privilege-escalation vulnerability. They are also examining CVE-2026-50522, a critical remote code execution flaw that attackers later used to steal SharePoint machine keys and maintain access after patching.

Neither possibility has received confirmation. Attackers may have exploited a different flaw that Microsoft addressed in the same round of updates.

Switzerland blocks outside access

BIT blocked external access to the affected SharePoint servers as part of its response. The agency will keep that restriction in place while it rebuilds the compromised systems.

Reinstalling the servers gives the IT office a cleaner way to remove potential persistence mechanisms and restore the platform. Attackers sometimes use stolen machine keys, backdoors or altered configurations to regain access after administrators apply security updates.

Federal employees can still access documents and share files with external contacts through alternative methods.

BIT also said that its rules prohibit staff from storing confidential information and especially sensitive personal data on the affected SharePoint platform. That policy may limit the potential impact of any data exposure.

Agencies and Microsoft continue the investigation

The Swiss Federal Office for Cyber Security and Microsoft are helping BIT investigate the attack.

So far, no ransomware group or extortion operation has publicly claimed responsibility. The agencies have also not linked the incident to a specific threat actor.

The breach highlights the risk organisations face when attackers target widely used collaboration platforms. SharePoint servers often store internal documents, user credentials and connections to other business systems, making them valuable targets.

Organisations that run on-premises SharePoint should review Microsoft’s July security updates, check for unusual activity and reset credentials where compromise is possible. They should also consider restricting external access while they investigate suspected intrusions.