Hackers Breach Swiss Government SharePoint: 200 Accounts Compromised

Switzerland's Federal Office of Information Technology and Telecommunications (BIT) confirmed a cyberattack on its Microsoft SharePoint servers. The incident was detected on July 28, when security experts identified suspicious activity within the system. As a result, hackers gained access to approximately 200 employee accounts.

According to BIT, attackers exploited vulnerabilities in SharePoint that Microsoft had patched in its July security updates. The flaws are suspected to be critical CVEs CVE-2026-56164 (privilege escalation) or CVE-2026-50522 (remote code execution), though the exact vulnerability remains undisclosed.

Following the attack's discovery, BIT blocked external access to the platform, applied patches, and reset passwords for affected accounts. The investigation is being conducted in collaboration with Switzerland's Federal Cybersecurity Office and Microsoft. No evidence of data theft has been found beyond the compromised credentials, as no sensitive information was stored on the platform.

As a precautionary measure, BIT is reinstalling compromised servers. External access to SharePoint will remain blocked until the process is complete. Employees can continue accessing documents through alternative channels. No ransomware or data-leak groups have claimed responsibility for the attack.