Swiss authorities investigate SharePoint credential leak incident involving Microsoft

The Swiss federal IT department was hacked, with approximately 200 accounts compromised, in mid-July. The Federal Office of Information Technology, Systems and Telecommunication (BIT) discovered irregular activity on its SharePoint servers on Tuesday, July 28, and immediately blocked access. BIT attributed the breach to vulnerabilities in Microsoft's widely used SharePoint platform, specifically CVE-2026-56164 and CVE-2026-50522, which were actively exploited by hackers. The attackers managed to steal SharePoint machine keys, allowing them to maintain access after servers were patched. As a result of this incident, BIT is reinstalling the affected SharePoint servers, blocking external internet access until completion, while personnel from the Federal Administration can continue accessing documents via alternative routes.