Swiss Government Says SharePoint Breach Compromised About 200 Accounts

Summary

Switzerland’s federal IT office says attackers breached its SharePoint servers and compromised about 200 accounts. BIT blocked external access, patched suspected flaws, reset passwords and is reinstalling servers; it has found no evidence of data theft.

Key points

BIT detected unusual activity on its SharePoint servers on July 28 and later found credentials for several accounts had been compromised.
The office estimates about 200 accounts were affected.
BIT blocked external SharePoint access, patched suspected vulnerabilities and reset affected passwords.
The vulnerability used has not been identified. BIT said the attack may have involved CVE-2026-56164 or CVE-2026-50522, but another flaw is also possible.
BIT is investigating with the Swiss Federal Office for Cyber Security and Microsoft and is reinstalling the servers as a precaution.
BIT has found no evidence that data beyond compromised login credentials was stolen; external access will remain blocked until reinstallation is complete.

Article Details

Victim Organization: Federal Office for Information Technology and Telecommunication (BIT)
Incident Type: SharePoint server breach involving exploitation of an undisclosed vulnerability and compromise of account credentials
Data Types Exposed: Login credentials
Affected Records: Approximately 200 accounts were affected; credentials for several accounts were reported compromised.
Operational Impact: BIT blocked external SharePoint access, patched suspected vulnerabilities, reset affected passwords, and is reinstalling the compromised servers. External access will remain blocked until the work is completed; employees can use alternative methods to access and share documents.
Ransom Or Extortion: No ransomware or data extortion group had claimed responsibility. BIT reported no evidence of data theft beyond the compromised login credentials.
Claim Status: confirmed