Switzerland's Federal Office for Information Technology and Communications (FOITT), the primary IT service provider for the federal administration, has confirmed that attackers exploited vulnerabilities in Microsoft SharePoint to compromise approximately 200 user and technical accounts. The incident, detected on July 28, led to the confirmation of account compromise by July 31.
The FOITT stated that the cyberattack was carried out by previously unknown actors, who are believed to have leveraged SharePoint vulnerabilities that Microsoft had disclosed in mid-July. The agency operates its SharePoint servers within the federal government's own data centers and had initiated the installation of security updates immediately upon their release.
Upon discovering anomalous access, FOITT blocked external internet access to its SharePoint environment and began patching the systems. Experts identified on July 31 that login details for around 200 accounts had been compromised. In response, the FOITT promptly reset the passwords for all affected accounts.
Investigations, supported by the National Cybersecurity Centre (NCSC) and Microsoft, are ongoing. To date, there is no evidence of further data leakage, though the analysis is not yet complete. As a precautionary measure, FOITT is entirely reinstalling the affected SharePoint servers. Federal employees are currently accessing and sharing documents through alternative channels while external internet access to SharePoint remains blocked.
The timing of the attack aligns with Microsoft's July 14 Patch Tuesday release, which included multiple serious SharePoint vulnerabilities. One notable flaw, tracked as CVE-2026-50522 with a CVSS score of 9.8, could allow an attacker to achieve remote code execution over a network with low complexity. Cybersecurity experts have highlighted that attackers exploiting such vulnerabilities often aim to steal machine keys, which are cryptographic secrets used by IIS to sign session tokens. The theft of these keys could enable attackers to forge legitimate-looking requests that even fully patched servers would accept, potentially granting long-term access.
The FOITT emphasized that its SharePoint platform is not intended for storing confidential information or highly sensitive personal data. The agency has shared all relevant technical indicators with Swiss critical infrastructure operators via the national cybersecurity agency's platform.
Cybersecurity advisories, including one from CERT-EU, have strongly recommended that organizations update affected SharePoint servers promptly, rotate credentials for any assets that may have been vulnerable and exposed to the internet, and conduct a compromise assessment. Given the increasing number of critical vulnerabilities affecting SharePoint, organizations are also advised to reconsider direct internet exposure of their Microsoft SharePoint servers.
Neither Microsoft nor the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have publicly attributed the exploitation to any specific threat group. The NCSC reported 28 cyberattacks targeting the Swiss Federal Administration in 2025 and 325 incidents affecting critical infrastructure, with approximately one in four impacting public administration.
