Hackers Breached the Swiss Government's SharePoint Servers — Here's What Happened

What Happened

On July 28, 2026, Switzerland's Federal Office for Information Technology, Systems and Telecommunication (BIT) noticed unusual activity on its Microsoft SharePoint servers. Three days later, on July 31, BIT confirmed that login credentials for roughly 200 accounts had been stolen — both regular user accounts and technical "machine" accounts used by automated systems.

BIT immediately blocked internet access to the affected SharePoint platform, closed the vulnerabilities being exploited, and reset every affected password.

How They Got In

The attackers exploited flaws in on-premise Microsoft SharePoint Server — the kind of self-hosted SharePoint many governments and businesses run on their own infrastructure instead of the cloud-hosted version. Microsoft disclosed and patched the relevant bugs in its July Patch Tuesday update, but BIT's servers were compromised in the window around that disclosure.

Two vulnerabilities are believed to be involved:

• CVE-2026-56164 — a privilege escalation flaw that was already being actively exploited in the wild before BIT was hit.
• CVE-2026-50522 — a remote code execution flaw that attackers reportedly used to steal SharePoint "machine keys."

Machine keys matter because they let attackers forge trusted requests to the server. Stealing them is a known trick for keeping access even after a system gets patched — the front door gets locked, but the attacker already made a copy of a key that still works.

What Was Taken

BIT says no confidential information or sensitive personal data is permitted to be stored on the affected SharePoint platform under its own policy, and so far there is no evidence any data was actually leaked beyond the compromised login credentials themselves.

That is a real distinction worth sitting with: no citizen data breach has been confirmed here. What was compromised is credential and infrastructure access — arguably the more dangerous kind, because it is what attackers use to get everything else next.

Why This Matters Beyond Switzerland

This was not a phishing attack or a leaked password. It was a straight technical exploit against unpatched, internet-facing software — the same category of flaw that has taken down small businesses, hospitals, and school districts long before it reached a national government's IT office.

If your business runs its own SharePoint, Exchange, or similar on-premise Microsoft server:

• Patch immediately when Microsoft ships a security update — especially anything flagged as actively exploited. The gap between disclosure and exploitation is now measured in days, not months.
• Rotate credentials and machine keys after any patch for a known-exploited flaw, not just after a confirmed breach. A patched server can still be carrying a stolen key from before the patch.
• Take internet-facing admin panels offline the moment something looks wrong. BIT's fastest and most effective move here was cutting off external access the moment they spotted the anomaly — before they even knew the full scope.

You don't need to run a government agency's IT office to learn from how a government IT office got hit.

Sources

• bleepingcomputer.com
• helpnetsecurity.com