As reported by Security Affairs, Switzerland's Federal Office for Information Technology and Communications (FOITT/BIT) has disclosed a significant breach involving the exploitation of SharePoint vulnerabilities, resulting in the compromise of approximately 200 government accounts. The fact that servers are now being rebuilt — rather than restored — signals a high-confidence assessment by Swiss authorities that the environment could not be trusted after the intrusion.

Security Impact: As reported by Security Affairs, Switzerland's Federal Office for Information Technology and Communications (FOITT/BIT) has disclosed a significant breach involving the exploitation of SharePoint vulnerabilities, resulting in the compromise of approximately 200 government accounts.

Why This Incident Deserves Serious Attention

Federal IT agencies occupy a uniquely dangerous position in any nation's attack surface. They don't just hold data — they often hold the keys to interconnected systems across ministries, regulatory bodies, and critical national functions. A compromise at this level isn't just a data breach; it represents potential lateral movement opportunity into downstream government infrastructure.

What makes this incident particularly instructive is that it centers on on-premises SharePoint — not a cloud misconfiguration or a sophisticated zero-day supply chain attack, but a known attack surface that has been actively targeted by threat actors for years. Microsoft SharePoint has accumulated a significant CVE history, and on-premises deployments present a fundamentally different patching and hardening challenge compared to Microsoft 365 cloud tenants, where Microsoft handles patch deployment.

Shield53 Perspective: The decision to rebuild servers rather than remediate in place is the correct call. In nation-state or sophisticated criminal intrusions, forensic validation of system integrity is rarely sufficient. Assume-breach architecture demands clean-slate recovery when government systems are involved.

The On-Premises SharePoint Problem Is Systemic

Across both public and private sectors, on-premises SharePoint deployments represent a growing liability. Many organizations — especially in government, where procurement and migration cycles are slow — are running versions that are years behind on patches. SharePoint's attack surface includes:
The On-Premises SharePoint Problem Is Systemic
Server-side request forgery (SSRF) enabling internal network reconnaissance
Remote code execution (RCE) chains exploiting deserialization or unsafe file handling
Authentication bypass vulnerabilities that can be chained with privilege escalation
Pre-authentication vulnerabilities requiring no valid credentials to exploit

Several high-severity SharePoint CVEs have been observed in active exploitation campaigns, including by nation-state actors. CISA's Known Exploited Vulnerabilities (KEV) catalog includes multiple SharePoint entries, a signal that these are not theoretical risks.

Who Is at Risk

Any organization running on-premises SharePoint Server — particularly in government, defense, legal, financial services, and healthcare — should treat this breach as a direct warning. The highest-risk configurations include:

  • SharePoint deployments exposed to the internet (even partially)
  • Environments running SharePoint 2016 or 2019 without current cumulative updates
  • Organizations with no privileged access workstations (PAWs) or tiered admin models
  • Environments lacking network segmentation between SharePoint servers and core identity infrastructure (Active Directory, ADCS)

Shield53 Recommendations

Immediate Actions

  • Audit your SharePoint patch level immediately. Cross-reference your installed CUs against Microsoft's Security Update Guide and CISA's KEV catalog. Any CVE in the KEV list demands emergency remediation.
  • Restrict internet exposure. If SharePoint does not need to be externally accessible, place it behind VPN or Zero Trust Network Access (ZTNA). Remove it from public-facing DMZ configurations.
  • Review account activity logs. Look for unusual OAuth grants, abnormal admin activity, and service account behavior — particularly around times of any detected scanning or anomalous authentication events.
  • Enable and forward SharePoint ULS and IIS logs to your SIEM. Many organizations have SharePoint logging configured at minimal levels, creating detection blind spots.

Strategic Actions

  • Accelerate cloud migration assessments. Where feasible, migration to SharePoint Online / Microsoft 365 shifts patch responsibility to Microsoft and reduces on-premises attack surface significantly.
  • Implement Just-in-Time (JIT) admin access for SharePoint farm administrators to limit the blast radius of any future credential compromise.
  • Deploy deception technologies (honeypot SharePoint pages or fake credentials) to improve detection of early-stage reconnaissance.
  • Conduct tabletop exercises simulating SharePoint compromise as an initial access vector — include scenarios for lateral movement to Active Directory and domain controller compromise.

Broader Implications

This breach fits into a documented pattern of threat actors — including groups with nation-state alignment — specifically targeting government collaboration platforms as initial access vectors. The goal is rarely just the SharePoint data itself; it's the credential harvest, the network visibility, and the trust relationships that these systems hold.

Switzerland's disclosure and transparent rebuilding response sets a commendable precedent for government transparency. However, for defenders globally, the takeaway is clear: your on-premises collaboration infrastructure is a primary target, and patch currency is non-negotiable.