Swiss Government SharePoint Servers Breached in Cyberattack Switzerland’s Federal Office for Information Technology and Telecommunication (BIT) confirmed a cyberattack on its Microsoft SharePoint servers, compromising around 200 accounts. The breach was detected on July 28 after security teams observed unusual activity, prompting an immediate response. Following the discovery, BIT blocked external internet access to the affected servers, applied security patches, and reset passwords for the compromised accounts. On July 31, investigators found that attackers had exfiltrated login credentials but uncovered no evidence of additional data theft. The agency clarified that confidential or sensitive personal data was not stored on the breached platform. The attack likely exploited SharePoint vulnerabilities patched in Microsoft’s July 2026 Patch Tuesday updates, though the exact flaw remains unconfirmed. Possible candidates include CVE-2026-56164 (a privilege escalation bug) or CVE-2026-50522 (a critical remote code execution flaw), both of which were actively exploited in other attacks. BIT is working with the Swiss Federal Office for Cyber Security and Microsoft to determine the full scope of the incident. As a precaution, the agency is reinstalling compromised servers, with external access remaining restricted until completion. Federal employees can still access and share documents through alternative methods. No ransomware or data extortion group has claimed responsibility, and the investigation is ongoing.