Switzerland's federal IT provider has confirmed that unidentified attackers breached its on-premises Microsoft SharePoint servers and compromised the login credentials of roughly 200 user and technical accounts. The agency, rendered in English variously as the Federal Office for Information Technology and Telecommunication, the Federal Office of Information Technology, Systems and Telecommunication, and the Federal Office for Information Technology and Communications, and known in Switzerland as BIT or FOITT, says it detected anomalies on July 28, 2026, confirmed the credential compromise on July 31, and disclosed the incident publicly on Tuesday, August 4. All eight sources reviewed agree on the approximately 200 figure; none reports a competing count. The agency attributes the intrusion to "previously unknown actors, presumably by exploiting these vulnerabilities in the SharePoint software," referring to flaws Microsoft disclosed and patched in its mid-July Patch Tuesday release.
What Happened
The timeline is consistent across the reporting. On Tuesday, July 28, BIT security specialists noticed unusual activity on SharePoint servers the agency operates inside Swiss federal data centres. On the same day the anomalous access was detected, BIT blocked internet access to the affected SharePoint systems and moved to patch the suspected vulnerabilities. Three days later, on Friday, July 31, investigators found that login credentials for a set of accounts had been compromised. BIT's own statement, as quoted by BleepingComputer and Help Net Security, describes this as "the login credentials for several accounts"; the roughly 200 figure and the breakdown into user accounts and technical (system or application) accounts comes from the agency's fuller account as reported by SWI swissinfo.ch, Security Affairs and The Record. Passwords for all affected accounts were reset immediately.
One detail on the patching gap comes from a single Swiss trade outlet and should be treated accordingly. IT Magazine reports that when the attack was noticed on July 28, BIT had the July patches in testing on pre-production systems, and quotes the office as saying those tests are "absolutely necessary, both for security reasons and to ensure compatibility with connected systems," and that the approach "corresponds to standard processes." No other source in this set independently confirms that the servers were still unpatched at the moment of compromise, though CybersecurityNews frames it similarly, writing that investigators believe threat actors "may have exploited the vulnerabilities before all defensive actions were completed."
BIT is now rebuilding the affected SharePoint servers from scratch as a precaution. Internet access for users outside the federal administration stays blocked until that work finishes. Federal administration staff can still reach their documents and share them through alternative channels. The investigation is being supported by Microsoft and by the Swiss national cyber authority, which appears in the sources under several names, the Federal Office for Cyber Security, the Federal Office for Cybersecurity (BACS) and the National Cybersecurity Centre (NCSC). Help Net Security adds that BIT reported the incident to BACS under Switzerland's Information Security Act.
What Was Taken
On the evidence available, the theft is limited to credentials. BIT says its initial analyses "have shown no indication that any data beyond the compromised login credentials" was accessed, and every source in this set repeats some version of that finding. The compromised set spans both human user accounts and technical accounts used by systems and applications, which matters more than the raw number of 200 suggests: service and application identities are typically non-interactive, long-lived, over-permissioned, and rarely covered by MFA.
Two caveats are worth stating plainly, because the sources state them. First, the analysis is explicitly ongoing, and "no evidence of exfiltration" at day seven of an investigation is not the same as "no exfiltration." Second, the reassurance about sensitivity is a policy claim, not a forensic one. The agency's line, as quoted by The Record, is that "no confidential information or particularly sensitive personal data may be stored on the SharePoint platform," meaning storage of such material is prohibited there. BleepingComputer and Help Net Security phrase it the same way, as a rule about what is permitted rather than a verified inventory of what was actually present. Swissinfo and IT Magazine report it more flatly, as a statement that such data is not stored on the affected server. That gap between "not permitted" and "not present" is the one worth watching as the forensics conclude.
Why It Matters
BIT is not a peripheral target. Security Affairs describes FOITT as the largest IT service provider in the Swiss Federal Administration, supplying around 50,000 workstation systems and operating more than 1,000 specialist applications, largely from its own data centres. A credential foothold in that estate is a foothold at the shared services layer beneath a national government, not at a single department.
The Record makes the structural point well: SharePoint is attractive both to financially motivated crews and to state-sponsored collectors, not only because it stores documents but because it is deeply wired into Microsoft's authentication stack. A sufficiently capable attacker with a SharePoint foothold has a path to burrow further into the surrounding network. That is precisely why the compromise of technical accounts, rather than the headline count of 200, is the part defenders should sit with.
There is also a patch-cadence lesson embedded here, and it is uncomfortable rather than damning. If IT Magazine's account is right, BIT was doing the orthodox thing, staging a Patch Tuesday release through pre-production compatibility testing, and the exploitation window closed on it first. Against a bug with public proof-of-concept code circulating within days of disclosure, standard change control is measured in the same units as the attacker's dwell time.
The Attack Technique
No source, primary or otherwise, identifies the specific vulnerability used. BIT has said only that the attackers presumably exploited the SharePoint flaws Microsoft disclosed in mid-July, and has declined to name one. The Record notes that several of the July SharePoint vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, and that neither Microsoft nor CISA has publicly attributed the exploitation to any named threat group. Identity, origin and motive of the attackers all remain unknown and are the subject of the ongoing investigation.
BleepingComputer and Help Net Security both name two candidates, framed explicitly as possibilities rather than findings:
- CVE-2026-56164, an actively exploited SharePoint privilege escalation vulnerability.
- CVE-2026-50522, a critical unauthenticated remote code execution flaw that Microsoft describes as deserialization of untrusted data, subsequently exploited to steal SharePoint machine keys and retain access after servers were patched.
Both were fixed in the July 2026 Patch Tuesday updates. BleepingComputer is careful to state that it remains unclear whether either was used against BIT, or whether the attackers exploited some other flaw from the same batch.
The wider exploitation context around CVE-2026-50522 is documented in earlier BleepingComputer reporting. Microsoft did not flag the bug as exploited at release but noted an increased likelihood of exploitation. Offensive security firm watchTowr says it identified public proof-of-concept exploit code on July 20 and that, "within hours," its Attacker Eye honeypot network captured exploitation attempts using that PoC that successfully compromised target systems. Threat intelligence firm Defused reported seeing an undocumented SharePoint deserialization vector in attacks as early as July 17, later assessing it was likely CVE-2026-50522. At least one demonstrative PowerShell exploit, delivering a malicious .NET BinaryFormatter payload, is public on GitHub from researcher Janggggg. Attackers exploiting that chain were harvesting machine keys, which let them forge valid authentication tokens, impersonate users, and reach SharePoint sites and documents with the privileges of the forged identity, persisting through patching.
That last property is the most plausible explanation for BIT's decision to rebuild the servers outright rather than patch and move on, though the agency itself has only called the rebuild precautionary.
What Organizations Should Do
- Confirm the full July SharePoint set is applied on every on-premises instance, including forgotten ones. Both CVE-2026-56164 and CVE-2026-50522 shipped in the July 2026 Patch Tuesday. Inventory-by-memory is how internet-exposed SharePoint farms survive patch cycles.
- Rotate SharePoint machine keys and restart IIS on any server that was exposed before patching. For CVE-2026-50522 specifically, patching alone does not evict an attacker who already stole the keys, they can keep forging authentication tokens. If key theft cannot be ruled out, rebuilding, as BIT chose to do, is the defensible option.
- Treat technical and service accounts as first-class incident scope. BIT reset passwords for both user and technical accounts. Enumerate application and system identities that touch SharePoint, rotate their secrets, and check whether any of them hold standing privileges they no longer need.
- Cut internet exposure of on-premises SharePoint immediately, then decide. BIT blocked external internet access on the same day it detected anomalies and has kept it blocked through remediation, while keeping internal staff productive via alternative channels. Availability for external users is a recoverable cost, a persistent forgery capability is not.
- Hunt back to mid-July, not just to your detection date. Defused observed the deserialization vector in use from July 17 and watchTowr saw PoC-driven compromise within hours of July 20. Any hunt window that starts at Patch Tuesday or at your own alert is likely to miss initial access.
- Reconcile change-control timelines with real exploitation timelines. BIT's pre-production compatibility testing, per IT Magazine, was in progress when the intrusion landed. Define an emergency lane for internet-facing collaboration platforms where public PoC code compresses the safe testing window to days or hours, and pair it with compensating controls such as isolation or WAF rules while testing runs.
- Assume credential-only findings are provisional. BIT is a week into an investigation supported by the national cyber authority and Microsoft, and has said the analysis continues. Treat your own early "no exfiltration" conclusions the same way, and verify what data actually sat on the platform rather than relying on what policy said should have been there.
Sources: Hackers Breach Swiss Government SharePoint Servers, Compromise 200... | Swiss IT agency hacked, 200 accounts compromised, SharePoint vulns... | Swiss government SharePoint breach compromised 200 accounts | SharePoint Flaws Used to Hack Switzerland's Federal IT Agency | 200 accounts compromised in Swiss government's Microsoft SharePoint... | Critical SharePoint RCE flaw exploited to steal machine keys | Swiss federal IT office hit by cyberattack - SWI swissinfo.ch | Sharepoint des BIT wurde gehackt