Swiss Federal IT Office Confirms SharePoint Breach, ~200 Accounts Compromised

What happened

Switzerland's federal IT office has disclosed that attackers exploited vulnerabilities in its Microsoft SharePoint servers, compromising approximately 200 accounts, according to a report from BleepingComputer. Further technical details — including which vulnerabilities were exploited, the exact timeline, and the extent of data accessed — have not yet been made public.

Why it matters for defenders

SharePoint remains a high-value target because it typically sits at the intersection of identity, document storage, and internal collaboration workflows — a breach can expose sensitive files and provide a foothold for lateral movement into connected Microsoft 365 and on-premises environments. A confirmed compromise of a national government's SharePoint infrastructure underscores that SharePoint continues to be actively targeted, and organizations running on-premises or hybrid SharePoint deployments should treat this as a reminder to review their exposure.

Who is affected

Directly, the Swiss federal government and the ~200 compromised accounts. More broadly, any organization running Microsoft SharePoint — particularly internet-facing or hybrid-connected instances — should consider this relevant to their threat model until more specifics emerge.

What defenders should watch for now

• Inventory and patch status: confirm all SharePoint servers (on-prem and hybrid) are current on security updates, and prioritize any internet-exposed instances.
• Account monitoring: watch for anomalous authentication activity, unusual privilege escalation, or mass document access/download patterns tied to SharePoint service accounts and user accounts.
• Web shell and persistence hunting: review SharePoint server logs and IIS logs for unexpected file writes to web-accessible directories, a common post-exploitation technique in prior SharePoint incidents.
• Credential hygiene: if any of the ~200 accounts had reused or shared credentials elsewhere, treat those as potentially compromised and rotate accordingly.
• Network egress: monitor for unusual outbound connections from SharePoint infrastructure that could indicate data exfiltration or C2 activity.

Because no CVE or specific exploitation technique has been confirmed publicly at this time, these are general hardening and hunting priorities rather than a response to a named vulnerability.

Developing story

This is early-stage, developing intelligence based on a single report, and further details from the Swiss government or Microsoft may refine or change the picture. For the latest reporting, see the original coverage at BleepingComputer.