Account takeover: Public administration, Switzerland 2026
On 28 July 2026, specialists noticed anomalies on the FOITT’s SharePoint servers; unknown persons presumably exploited vulnerabilities about which Microsoft had issued information in mid-July.
- Incident · 07.2026 · Switzerland
- Evidence: confirmed by an authority
- Account takeover
As of
What happened
On 31 July, it emerged that login data of around 200 user and technical accounts had been compromised. The FOITT blocked access via the internet for persons outside the federal administration, installed updates, reset passwords and rebuilt the servers.
- Affected
- Federal Office of Information Technology, Systems and Telecommunication (FOITT)
- Industry
- Public administration
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Login data of around 200 accounts compromised; no signs of data exfiltration (as of 04.08.2026)
- Bankruptcy
- no
- Entry point
- Vulnerabilities in Microsoft SharePoint (FOITT servers)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Security updates for internet-facing servers must be installed within days, not weeks.
Sources
- Cyberangriff auf SharePoint-Server (opens in a new window) Der Bundesrat (Bundesamt für Informatik und Telekommunikation BIT) · 04.08.2026
«Es gibt bislang keine Anzeichen dafür, dass Daten abgeflossen sind.»