Swiss government SharePoint breach compromised 200 accounts

Hackers breached the Swiss federal government's Microsoft SharePoint servers by exploiting a vulnerability disclosed in mid-July 2026, compromising approximately 200 user accounts. The Federal Office for Information Technology and Telecommunication (BIT) detected suspicious activity on July 28 and confirmed the breach by July 31, leading to immediate mitigation steps including blocking external access and resetting passwords. The attack likely leveraged either CVE-2026-56164 or CVE-2026-50522, both critical SharePoint flaws patched in the July 2026 updates, though the exact vulnerability used remains unconfirmed. No evidence of data exfiltration beyond credentials has been found, and no threat actor has claimed responsibility.

AI-extracted · verify before operational use