2026 Swiss FOITT — SharePoint servers exploited; ~200 federal administration accounts compromised (Aug 4)
Data compromised
Around 200 federal administration accounts were compromised. FOITT states there are no indications of any further data breach; internet-facing access to the affected SharePoint environment was blocked for users outside the federal administration.
Technical writeup
Agency-confirmed intrusion — the Federal Office of Information Technology, Systems and Telecommunication (FOITT / BIT), the Swiss federal government IT provider, said on Tuesday, August 4, 2026 that unknown attackers had compromised SharePoint servers it operates in federal data centres, and that around 200 accounts were affected. FOITT attributed the intrusion to vulnerabilities in Microsoft SharePoint that the vendor reported in mid-July 2026, and said it started deploying the security updates as soon as they were available. As a containment measure, internet access to the affected collaboration environment was blocked for anyone outside the federal administration. The office said there are no indications of further data breaches beyond the compromised accounts. recordsAffected is recorded as 200 accounts — the attested figure from the agency statement — rather than a count of individuals, and no data-theft volume has been published. SharePoint is used across the administration for collaboration and file storage, which is why account compromise at this scale matters even without a confirmed exfiltration: valid federal credentials are directly reusable for phishing inside government and for pivoting into other admin services.
Root cause
Exploitation of Microsoft SharePoint Server vulnerabilities that Microsoft disclosed in mid-July 2026, against SharePoint servers FOITT operates in the Swiss federal government own data centres. FOITT says it began installing the vendor security updates immediately after they were published.