Switzerland's Federal Office for Information Technology and Telecommunication (BIT) confirmed a cyberattack on its Microsoft SharePoint servers, detected on July 28 after unusual activity was noticed. Approximately 200 accounts had their login credentials compromised. BIT responded by blocking external internet access, patching vulnerabilities, and resetting affected passwords. The attack likely exploited SharePoint vulnerabilities disclosed by Microsoft in mid-July — either CVE-2026-56164 (a privilege escalation flaw) or CVE-2026-50522 (a critical RCE flaw used to steal machine keys) — both fixed in the July 2026 Patch Tuesday updates. No evidence of data theft beyond credentials has been found, and no ransomware group has claimed responsibility. BIT is reinstalling compromised servers and investigating with the Swiss Federal Office for Cyber Security and Microsoft.
Table of contents
Related Articles:Questions this post answers
What SharePoint vulnerabilities were exploited in the Swiss government breach?
The Swiss government SharePoint breach likely involved either CVE-2026-56164, an actively exploited privilege escalation vulnerability, or CVE-2026-50522, a critical remote code execution flaw used to steal SharePoint machine keys and maintain access after patching. Both were fixed in the July 2026 Patch Tuesday updates. The exact flaw used has not been officially confirmed by BIT. Teams running on-premises SharePoint track patch exposure like this on daily.dev before it becomes an incident.
How did Switzerland's BIT respond after discovering the SharePoint server compromise?
BIT immediately blocked all external internet access to SharePoint, patched the suspected vulnerabilities, and reset passwords for the approximately 200 compromised accounts. Servers are being fully reinstalled as a precaution, and external access remains blocked until that work is complete. No evidence of data theft beyond login credentials was found, and confidential data was not permitted on the affected platform. Staying ahead of government-level incident response patterns helps security teams sharpen their own playbooks on daily.dev.