![\"Swiss](\"https:\/\/www.europesays.com\/ch\/wp-content\/uploads\/2026\/08\/data_breach-1.webp\" "\\"Data")
<\/p>\nHackers exploited vulnerabilities in Microsoft SharePoint servers belonging to Switzerland\u2019s Federal Office of Information Technology, Systems and Telecommunication (BIT), compromising the login credentials of around 200 accounts.<\/p>\n
<\/p>\n
On July 28, BIT\u2019s security specialists noticed unusual activity on the SharePoint servers. Once the intrusion was confirmed, BIT blocked internet access to the platform and closed the vulnerabilities being exploited.<\/p>\n
Three days later, on July 31, security specialists discovered \u201cthat the login credentials for several accounts had been compromised,\u201d noting that both user and technical accounts were affected. BIT says it immediately reset the passwords for all affected accounts. <\/p>\n
The agency believes the attackers exploited SharePoint vulnerabilities disclosed by Microsoft in mid-July and fixed in the July Patch Tuesday updates<\/a>. <\/p>\n \u201cThe cyberattack was carried out by previously unknown actors,\u201d the agency said in its statement, adding that they most likely got in \u201cby exploiting these vulnerabilities in the SharePoint software.\u201d <\/p>\n However, it has not disclosed which flaw was used.<\/p>\n The attack potentially involved either CVE-2026-56164, an actively exploited SharePoint privilege escalation vulnerability, or CVE-2026-50522, a remote code execution flaw <\/a>later exploited to steal SharePoint machine keys and maintain access after servers were patched.<\/p>\n BIT is being supported in its analysis by the Federal Office for Cybersecurity (BACS) and Microsoft. The agency states that no confidential information or particularly sensitive personal data is permitted to be stored on the affected SharePoint platform, and so far there is no evidence that data was leaked beyond the compromised login credentials.<\/p>\n Under Switzerland\u2019s Information Security Act, BIT reported the incident to BACS and the State Secretariat for Security Policy within the required deadline. It also shared technical indicators from the attack with operators of essential infrastructure through the BACS platform.<\/p>\n