Swiss Federal IT Agency Hacked via SharePoint Flaws
200 accounts compromised, servers being rebuilt.
1Incident Overview
Switzerland's Federal Office for Information Technology and Communications (FOITT) disclosed that unknown attackers compromised around 200 accounts on its on-premises SharePoint servers. The attackers allegedly exploited vulnerabilities in Microsoft's SharePoint software. FOITT detected anomalies on July 28 and confirmed the account breach on July 31. The affected servers are currently being reinstalled as a precautionary measure.
2SharePoint Vulnerabilities
Microsoft reported multiple critical SharePoint vulnerabilities in mid-July. One flaw, CVE-2026-50522 (CVSS score 9.8), allows remote code execution over a network. Microsoft stated exploitation requires low complexity, meaning attackers don't need deep system knowledge. Researchers warned attackers are stealing machine keys to maintain persistent access, enabling them to forge legitimate-looking requests even on patched servers.
3FOITT's Role and Response
FOITT is the largest IT service provider in Switzerland's Federal Administration, supporting 50,000 workstations and operating over 1,000 specialized applications. Upon detecting the attack, FOITT blocked external internet access to SharePoint and began applying security patches. The agency reset compromised passwords and initiated an investigation with support from NCSC and Microsoft, finding no evidence of further data leaks so far.
4Security Measures Taken
FOITT immediately reset passwords for approximately 200 compromised user and technical accounts. As a precaution, the agency is completely reinstalling affected SharePoint servers and sharing technical indicators with critical infrastructure operators through Switzerland's cybersecurity platform. Federal employees continue accessing documents via alternative channels during the restoration process.
5SharePoint Security Risks
SharePoint's deep integration with Microsoft authentication makes it a prime target for cybercriminals and nation-state actors. Attackers can exploit vulnerabilities to compromise wider networks, making internet-exposed SharePoint servers a growing security concern. CERT-EU strongly recommends updating affected servers immediately and reconsidering direct internet exposure for any SharePoint instances.
6Switzerland's Cybersecurity Landscape
Switzerland's National Cybersecurity Centre (NCSC) recorded 28 cyberattacks targeting the Federal Administration and 325 critical infrastructure incidents in 2025, with about 25% involving public administration. A notable case involved state-owned defense contractor Ruag, whose US subsidiary suffered a ransomware attack by the Akira group, resulting in data theft and a ransom payment.
7Organizational Takeaways
Organizations running internet-exposed on-premises SharePoint should immediately apply July patches, rotate machine keys, and restart IIS in that specific order. While complete server reinstallation (like FOITT's approach) is ideal, at minimum they should verify elimination of external internet exposure. In this campaign, the window between vulnerability disclosure and active exploitation was measured in days.
8Conclusions and Recommendations
The FOITT breach underscores the critical importance of timely patch management for SharePoint servers. CERT-EU advises against direct internet exposure for SharePoint instances and recommends regular compromise assessments. Cybersecurity experts call for proactive measures to prevent similar breaches, emphasizing that patching alone isn't sufficient - organizations must also change cryptographic keys to fully secure their systems.
Original article: Security Affairs — İsviçre Federal BT Ajansı SharePoint Açıklarıyla Hacklendi