Swiss federal authorities confirm a cyberattack targeting SharePoint servers operated by the Federal Office for Information Technology and Telecommunication (BIT). Approximately 200 user and technical accounts were compromised due to login credentials being exposed. Security specialists quickly investigated the anomalies and confirmed that the servers may have been targeted through recently disclosed Microsoft SharePoint vulnerabilities.
BIT utilizes several SharePoint servers in Swiss federal data centers to support government services and employee workflows. The technical investigation remains ongoing, and authorities have not ruled out additional findings as forensic work continues. External internet connectivity will be temporarily restricted until the remediation efforts are fully completed and officials confirm that the environment is secure.
Federal administration employees can still access documents internally and share information with external personnel through alternative means. This incident underscores the persistent risks organizations face when using internet-accessible collaboration platforms like SharePoint. The platform's vulnerability lies in its ability to store business documents, provide internal access, and integrate with other Microsoft services.
Prompt patching, credential monitoring, network restrictions, and server rebuilding remain crucial steps for addressing potential exploitation attempts. The agency shared relevant technical indicators from the attack on critical infrastructure with operators via the BACS platform, aiding in identifying potential signs of related intrusion activity.
