Swiss authorities urge calm amid fears over SharePoint credential leak

The Swiss government has confirmed that its federal IT department has been hacked, with some 200 accounts compromised.

In an advisory, the Federal Office of Information Technology, Systems and Telecommunication (BIT) said it spotted irregular activity on its SharePoint servers on Tuesday, 28 July and immediately blocked access.

Three days later, the team discovered that the credentials of both user and technical accounts had been compromised, and immediately reset the relevant passwords.

No other data was accessed, BIT said, and there's no confidential information or valuable personal data stored on the SharePoint platform.

"Currently, BIT is pre-emptively reinstalling the affected SharePoint servers. Access to SharePoint for external users over the internet remains blocked until the work is completed," BIT said.

"Persons from the Federal Administration can continue to access their documents and exchange them with the affected persons via alternative routes."

BIT said it's informed the Federal Office for Cybersecurity (BACS) and the State Secretariat for Security Policy (SEPOS) about the incident. It's not known who carried out the attack.

SharePoint flaws behind leaks

BIT is linking the breach to several vulnerabilities in the widely used Microsoft SharePoint platform, which is used for collaboration and file storage. BIT said it operates several SharePoint servers in the federal government’s own data centers.

The vulnerabilities concerned appear to have been CVE-2026-56164, an actively exploited SharePoint privilege escalation vulnerability, and CVE-2026-50522, a critical remote code execution flaw, described by Microsoft as relatively easy to exploit.

It was later exploited to steal SharePoint machine keys and maintain access after servers were patched.

Both flaws were fixed as part of the July 2026 Patch Tuesday updates. BIT said it took immediate action to patch the vulnerabilities, but was apparently too late.

Leaked credentials a "pathway" for hackers

Michael Centrella, head of public policy at SecurityScorecard, said the incident once again highlights the growing risks faced by government agencies and public sector organizations.

"Government agencies rely on platforms like SharePoint to facilitate communication, manage sensitive documents, and support day-to-day operations across departments. When these systems are compromised, attackers can use stolen accounts to conduct reconnaissance, escalate privileges, and move deeper into government networks," he said.

Centrella noted that a single compromised account can often be a “pathway to sensitive information or broader operational access”, underlining the need for robust identity security practices and continuous monitoring.

"That visibility must extend beyond an agency’s own environment to the third-party and technology ecosystem it depends on, where a single exposure can create risk across multiple interconnected organisations,” he said.

Cybersecurity strategies need to extend beyond protecting individual systems and focus on securing the entire ecosystem of users, applications, and connected infrastructure that support public operations, according to Centrella.

"To reduce exposure, government agencies must maintain continuous visibility into their attack surface, rapidly patch known vulnerabilities, enforce multi-factor authentication (MFA), and monitor for unusual account activity," he said.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.