Swiss Government SharePoint Breach Compromises ~200 Accounts

Attackers used SharePoint vulnerabilities fixed in the July Patch Tuesday updates, either CVE-2026-56164 (actively exploited privilege escalation) or CVE-2026-50522 (critical remote code execution used to steal machine keys), to breach Switzerland's federal SharePoint platform. The intrusion was detected on July 28; by then attackers had compromised login credentials for roughly 200 accounts. The Federal Office for IT blocked external access, patched, reset passwords, and is reinstalling servers; no data theft beyond credentials has been confirmed and no actor claimed the breach.

A government SharePoint compromise exposing 200 accounts is not a routine credential leak. The attackers retained persistence through stolen machine keys, a mechanism that survives patching and would have kept the federal environment exposed even after the July updates were applied. That explains why the BIT chose full server reinstallation rather than a simple reset, and why other government entities running unpatched SharePoint should treat this as an active, persistent threat rather than a one-time breach.

Patch SharePoint immediately against CVE-2026-50522 and CVE-2026-56164, audit for machine-key theft (the post-patch persistence mechanism mentioned in the event), and restrict external access to the platform as a temporary control. Hunt for evidence of the machine-key extraction and any subsequent authentication using stolen credentials; the event notes no data theft beyond credentials, so defenders should watch for anomalous SharePoint service account usage and unexpected external connections.

Watch for an updated vendor advisory confirming which of the two CVEs was the initial entry point, and any attribution or telemetry linking this breach to a broader campaign against government SharePoint instances. If machine-key theft is confirmed in additional victims, the assessment should shift from isolated breach to sustained infrastructure compromise requiring broader network segmentation.