Swiss government SharePoint breach compromised 200 accounts

Switzerland’s federal IT office (BIT) detected unusual activity on its Microsoft SharePoint servers and found that attackers had exploited SharePoint vulnerabilities disclosed in mid‑July (potentially CVE‑2026‑56164 or CVE‑2026‑50522) to compromise roughly 200 accounts; BIT blocked external access, patched servers, reset credentials, is reinstalling compromised servers as a precaution, and is investigating with Swiss cyber authorities and Microsoft, with no evidence so far of data exfiltration.