A SharePoint vulnerability enabled criminals to hack Swiss government servers in June.
Swiss SharePoint government servers were the target of a cyberattack at the end of July. Approximately 200 accounts, both user and technical, were compromised. There are currently no indications that sensitive data has been leaked.
At the end of July, Microsoft reported multiple vulnerabilities in SharePoint, a widely used web application for collaboration and document management. The Swiss Federal IT Office (BIT) manages several SharePoint servers and immediately began applying the security updates. On July 28, security experts noticed suspicious activity on the SharePoint servers. After confirming the attack, the BIT blocked internet access and closed the vulnerabilities.
Compromised accounts and response
Analysis on July 31 showed that the login credentials of approximately 200 accounts, including both user and technical accounts, were compromised. The BIT immediately reset the passwords of the affected accounts. According to the current status, there are no indications that any data other than the login credentials was stolen.
The SharePoint platform must not contain confidential information or particularly protected personal data. The BIT is working with the Federal Office for Cybersecurity (BACS) and Microsoft for further analysis.
Measures and future
As a preventive measure, the BIT is reinstalling the affected SharePoint servers. Internet access remains blocked for external users until the work is completed. Internal users can still access their documents and exchange them via alternative channels.
In accordance with the reporting obligation under the Information Security Act, the BIT has informed the BACS and the State Secretariat for Security Policy (SEPOS). To protect critical infrastructure in Switzerland, the BIT proactively shares all relevant technical indicators via the BACS platform.