Swiss Federal SharePoint Breach Exposes 200 Accounts in Credential Theft Incident Switzerland’s Federal Office for Information Technology and Telecommunication (BIT) revealed a network intrusion targeting its federal SharePoint platform, resulting in the compromise of approximately 200 user accounts. Unusual activity was detected on July 28, with security specialists confirming the credential theft by July 31. No ransomware group has claimed responsibility, and BIT has not disclosed the specific vulnerability exploited. Investigators suspect the attack leveraged one of two SharePoint flaws patched in Microsoft’s July 2026 Patch Tuesday updates: CVE-2026-56164, a privilege escalation vulnerability actively exploited in the wild, or CVE-2026-50522, a critical remote code execution flaw that could allow attackers to steal SharePoint machine keys and maintain persistence. BIT has not confirmed which flaw was used, but the latter’s ability to enable long-term access raises concerns. While the breach exposed login credentials, BIT stated that the affected SharePoint platform does not store confidential or highly sensitive personal data, and no evidence suggests data exfiltration beyond the stolen credentials. The incident’s impact is thus limited to credential compromise rather than broader data theft. BIT responded swiftly to contain the breach, blocking external internet access to the SharePoint servers, applying patches, resetting affected account passwords, and reinstalling compromised servers. Federal employees have temporarily shifted to alternative file-sharing methods while remediation continues. The investigation involves collaboration with the Swiss Federal Office for Cyber Security and Microsoft. The breach underscores the high-value nature of government collaboration platforms, which often integrate with federal identity systems and shared documents. Even when data theft is not confirmed, credential compromise can pose political and supply-chain risks. The incident also highlights the urgency of applying critical patches attackers exploited flaws addressed in routine updates, demonstrating that delayed deployment can leave systems vulnerable. For other SharePoint deployments, the Swiss case serves as a cautionary example: rapid detection and containment limited the breach’s scope, preventing a potential full-tenant takeover. The ability to steal machine keys linked to CVE-2026-50522 could have allowed attackers to maintain persistent access, reinforcing the need for heightened monitoring of administrative accounts and key-management systems. The incident also reveals broader challenges in public-sector cybersecurity, including reliance on a single commercial platform and difficulties in detecting subtle credential abuse within large-scale collaboration environments. Other national administrations running SharePoint are now advised to verify the July 2026 patches, audit machine key storage, and ensure elevated accounts receive the same scrutiny as standard users.

The data systems of a Swiss mobile phone operator were breached late last year. The contact details of about 800,000 customers were compromised. The names, addresses, telephone numbers and dates of birth of customers were accessed by an unknown party.