Full Report
The Federal Office for Information Technology and Communications (BIT) said specialists detected anomalies in on-premises Microsoft servers. The Swiss agency could not confirm exactly how the hackers got in.
Analysis Summary
# Incident Report: Swiss Federal Office (BIT) SharePoint Compromise
## Executive Summary
In late July 2026, Switzerland’s Federal Office for Information Technology and Communications (BIT) detected a cyberattack targeting its on-premises Microsoft SharePoint servers. The attackers compromised approximately 200 user and technical accounts, likely by exploiting critical vulnerabilities disclosed in July 2026. While no sensitive data exfiltration has been confirmed, the agency has initiated a full server reinstallation to eradicate the threat and prevent persistent access through forged session tokens.
## Incident Details
- **Discovery Date:** Late July 2026 (Reported August 4, 2026)
- **Incident Date:** July 2026
- **Affected Organization:** Federal Office for Information Technology and Communications (BIT)
- **Sector:** Government / Public Sector
- **Geography:** Switzerland
## Timeline of Events
### Initial Access
- **Date/Time:** July 2026 (following July Patch Tuesday)
- **Vector:** Exploitation of known vulnerabilities in on-premises Microsoft SharePoint.
- **Details:** Attackers targeted SharePoint servers exposed to the internet, likely utilizing flaws recently added to CISA’s Known Exploited Vulnerabilities catalog.
### Lateral Movement
- **Details:** Attackers compromised approximately 200 accounts, including both user-level and technical (service) accounts, to gain a foothold within the SharePoint environment.
### Data Exfiltration/Impact
- **Details:** Currently, analysis indicates only login credentials were accessed. The agency reports no evidence that confidential information or sensitive personal data was compromised, noting such data is generally not stored on this specific platform.
### Detection & Response
- **Detection:** Specialist teams detected "anomalies" on the on-premises servers.
- **Response:** Upon discovery, BIT blocked internet access to the SharePoint servers and applied necessary security patches.
## Attack Methodology
- **Initial Access:** Exploitation of SharePoint vulnerabilities (CVEs from July 2026 Patch Tuesday).
- **Persistence:** Suspected extraction of IIS machine keys to sign and forge session tokens, allowing access to persist even after patching.
- **Credential Access:** Compromise of 200 user and technical account credentials.
- **Impact:** Unauthorized access to the SharePoint environment and potential credential harvesting for downstream attacks.
## Impact Assessment
- **Financial:** Undisclosed; costs associated with incident response and server reinstallation.
- **Data Breach:** Compromise of 200 account credentials; no sensitive document loss reported to date.
- **Operational:** Disruption of SharePoint services due to internet access being blocked and subsequent server rebuilds.
- **Reputational:** Public disclosure of a government-level breach, though mitigated by rapid response and transparency.
## Indicators of Compromise
- **Network indicators:** Anomalous traffic patterns from SharePoint servers to the internet (Defanged: hxxp[://]sharepoint[.]admin[.]ch - *example representative URL*).
- **Behavioral indicators:** Unauthorized access to technical accounts; extraction of machine keys from Microsoft Internet Information Services (IIS).
## Response Actions
- **Containment:** SharePoint servers were disconnected from the internet immediately upon detection.
- **Eradication:** Applied Microsoft security patches and initiated a full reinstallation of the affected SharePoint servers to ensure no persistent backdoors remained.
- **Recovery:** Rotating machine keys and credentials for all 200 compromised accounts.
## Lessons Learned
- **Patch Management Latency:** Even rapid patching may not be enough if attackers exploit vulnerabilities within the same window as the release.
- **Persistence Risks:** Closing a vulnerability does not necessarily remove an attacker if they have stolen cryptographic secrets (like IIS machine keys) during the initial compromise.
- **Exposure:** Directly exposing SharePoint servers to the internet significantly increases the attack surface for government agencies.
## Recommendations
- **Architecture:** Avoid exposing Microsoft SharePoint servers directly to the internet; utilize VPNs or Zero Trust Network Access (ZTNA).
- **Hardening:** Implement CISA and CERT-EU guidance regarding SharePoint hardening, specifically the rotation of machine keys and restarting IIS following a suspected compromise.
- **Credential Security:** Implement Multi-Factor Authentication (MFA) across all user and technical accounts to mitigate the impact of credential theft.
- **Monitoring:** Enhance logging for IIS and SharePoint anomalies, specifically focusing on unauthorized machine key access.