Swiss Government SharePoint Breach Compromised 200 Accounts

Swiss Federal IT Confirms SharePoint Exploitation

Switzerland's Federal Office of Information Technology, Systems and Telecommunication (FOITT) has confirmed that attackers successfully exploited vulnerabilities in its Microsoft SharePoint infrastructure to compromise approximately 200 government accounts. The incident is currently under active investigation.

The breach targeted SharePoint servers used by Swiss federal agencies, with the FOITT stating that hackers leveraged known SharePoint vulnerabilities to gain unauthorized access. The compromise of 200 accounts raises concerns about potential access to sensitive federal documents, internal communications, and government operational data.

What Happened

According to FOITT's official disclosure, attackers exploited one or more vulnerabilities in the Microsoft SharePoint platform to gain a foothold on federal servers. From there, the attackers were able to access and compromise approximately 200 employee accounts across Swiss federal government systems.

Key details from the disclosure:

• Attack vector: Exploitation of SharePoint vulnerabilities (specific CVEs not yet confirmed)
• Accounts affected: Approximately 200 federal government accounts
• Systems involved: Microsoft SharePoint servers operated by the Swiss federal government
• Current status: Under investigation; FOITT and Swiss security authorities are responding

SharePoint has been a recurring target for nation-state and criminal threat actors in recent years. Multiple critical SharePoint vulnerabilities have seen active exploitation in 2025–2026, including authentication bypass and remote code execution flaws that allowed attackers to compromise organizations without credentials.

Significance of a Government SharePoint Breach

SharePoint serves as a central collaboration and document management hub for most government organizations. A breach of SharePoint infrastructure — and the 200 accounts associated with it — means attackers may have had access to:

Switzerland's federal government handles a wide range of sensitive data including financial regulation (as a major global financial hub), diplomatic communications, and law enforcement coordination within the European context.

Context: Government SharePoint Attacks in 2026

This breach is not isolated. SharePoint has emerged as a high-value target for threat actors in recent years:

• CVE-2023-29357 and CVE-2024-38094 (Microsoft SharePoint RCE) were listed among CISA's most exploited vulnerabilities
• The European Commission confirmed a breach via SharePoint exploitation earlier in 2026
• Nation-state actors — including Chinese and Russian APT groups — have systematically targeted government SharePoint deployments as part of broader espionage campaigns

The pattern suggests that attackers are systematically scanning for and exploiting unpatched SharePoint servers across Western government infrastructure.

Microsoft SharePoint Vulnerabilities — Recent History

Organizations running on-premises SharePoint deployments are advised to verify patch status immediately. Cloud-hosted SharePoint (Microsoft 365 / SharePoint Online) receives automatic patching from Microsoft.

What Organizations Should Do

Immediate Actions

1. Verify SharePoint patch level — ensure all critical and important Microsoft patches are applied, particularly those from 2023–2026 addressing SharePoint RCE and authentication bypass
2. Audit account activity — review sign-in logs for all SharePoint-connected accounts for unusual access patterns
3. Check for persistence — look for unauthorized web shells, new admin accounts, or modified SharePoint configurations
4. Review Microsoft Secure Score — SharePoint security baselines should be assessed in Microsoft Defender for Office 365

Detection Guidance

# Review SharePoint ULS (Unified Logging Service) logs for anomalies
Get-SPLogEvent -StartTime (Get-Date).AddDays(-30) | Where-Object {$_.Level -eq "Critical" -or $_.Level -eq "High"}
 
# Check for unauthorized web shells in SharePoint hive
Get-ChildItem -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\" -Recurse -Filter "*.aspx" | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-30)}
 
# Review recent site collection and user permission changes
Get-SPAuditLog -Type SecurityChange -Days 30

For Microsoft 365 (Cloud SharePoint)

• Review Microsoft Purview audit logs for unusual download or access activity
• Enable Microsoft Defender for Office 365 alert policies for bulk data download
• Enforce Conditional Access policies requiring MFA for all SharePoint access

Response and Investigation

The FOITT has confirmed that an investigation is underway, coordinating with the Swiss National Cybersecurity Centre (NCSC) and relevant federal authorities. No attribution has been made public at this stage.

This incident follows a broader pattern of Swiss government digital infrastructure being targeted by threat actors — in 2023, the Play ransomware group attacked Swiss IT provider Xplain and exfiltrated significant volumes of Swiss federal police and federal office data.

References

• BleepingComputer — Swiss Government SharePoint Breach
• Swiss FOITT Official Communications
• CISA Advisory on SharePoint Vulnerabilities

Related Articles

• European Commission Confirms Data Breach After Europa.eu Hack
• Critical SharePoint Flaw Under Active Exploitation