← News
/DISPATCH · 2026-08-10

Swiss federal government SharePoint servers compromised: 200 account credentials stolen, same SharePoint exploit chain as Warlock ransomware

Swiss Federal Office of Information Technology BIT disclosed a SharePoint server intrusion detected 28 July and confirmed 31 July. Credentials for ~200 user and technical accounts were stolen. Attackers likely used CVE-2026-50522 RCE / CVE-2026-56164 privilege escalation, matching the Storm-2603 / Warlock ransomware exploit chain.

On 6 August 2026, the Swiss Federal Office of Information Technology (BIT / FOITT) issued a notice acknowledging anomalous activity on a Microsoft SharePoint Server it operates, detected 28 July. Three days later (31 July) it confirmed login credentials for about 200 user and technical accounts had been obtained by an unauthorized party. This is another government-class organization pulled into the July SharePoint exploitation wave, after NNSA, the Department of Energy, NIH, and other U.S. federal agencies. Switzerland's National Cyber Security Centre (NCSC) and Microsoft are assisting forensics.

Incident overview

BIT is the Swiss federal government's largest internal IT service provider, running about 50,000 workstations and more than 1,000 internal business systems. Timeline from the notice:

BIT did not disclose which CVE the attack chain used. Forensic consensus across BleepingComputer, SecurityAffairs, SwissInfo, and others: most likely CVE-2026-50522 (can steal IIS machine keys) and CVE-2026-56164 (unauthenticated privilege-escalation defect). If the machine key was stolen, attackers can still forge trusted tokens after patching—the reason BIT chose full server rebuilds.

Technical details

The Swiss incident's attack chain matches the SharePoint exploit chain Microsoft attributed to Storm-2603 (China-related threat actor tied to Warlock ransomware distribution). Typical characteristics:

Cert-EU accompanying guidance: any SharePoint Server that may have been internet-exposed during the exploit window must first be patched, then rotate machine keys, then restart IIS. Omitting any step leaves the server compromised even after patching.

Impact assessment

BIT stressed SharePoint should not store classified information or highly sensitive personal data per policy, so the gravest risk is stolen credentials rather than a direct classified leak. Risks remain significant:

Remediation

References