Cyberattack Hits Graubünden Cantonal Administration’s SharePoint Servers
Summary
Graubünden says its SharePoint servers were attacked, with no initial indication of compromised accounts or data loss. It planned an emergency update that would make the cantonal website unavailable for several hours.
Key points
- The cantonal IT office detected an attack on SharePoint servers responsible for the administration’s website.
- Initial analysis found no indication of compromised accounts or data loss; detailed analysis is ongoing.
- The office said confidential information and particularly sensitive personal data were not affected because they are not stored on those SharePoint servers.
- An emergency update to address security vulnerabilities was scheduled, with the cantonal website expected to be unavailable for several hours.
- The e-portal and specialized cantonal applications were not affected and were expected to remain operational.
- The article compares the incident with a separate attack on federal SharePoint servers, where about 200 accounts were reportedly compromised; officials said there was no indication of further data leaks.
- The source of the attacks was unknown. Federal officials said the attacker probably exploited Microsoft SharePoint vulnerabilities disclosed in July.
Article Details
- Victim Organization
- Canton of Graubünden administration
- Incident Type
- Cyberattack against the canton administration's SharePoint servers, which support its website; the attack vector is not confirmed.
- Disclosure Date
- 2026-08-05
- Operational Impact
- A temporary outage of the cantonal website was planned for several hours during an emergency update. The e-Portal and specialist applications were reported unaffected and would remain operational. Initial analysis found no indication of compromised accounts or data loss; detailed analysis was ongoing.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed