Cyberattack on federal servers hits 200 accounts

The Federal Office for Information Technology and Telecommunications has detected and repelled a cyberattack on its SharePoint servers. Around 200 user accounts are compromised. According to the office, there is so far no indication pointing to a data breach.

The episode begins in mid-July, when Microsoft disclosed vulnerabilities in SharePoint. On 28 July security specialists identified anomalies on the federal office's servers. Internet access was blocked immediately afterwards.

The office is now reinstalling the affected servers. Third-party access remains suspended until the work is complete, while federal administration staff continue working through alternative channels.

The platform involved contains neither confidential information nor personal data requiring special protection.

Notifications and context

The office informed the Federal Office for Cybersecurity and the State Secretariat for Security Policy. Technical indicators from the attack were passed on as a precaution to all operators of critical infrastructure in the country.

The identity of the attackers has not been established.

The case fits a familiar pattern. Last year the Federal Office for Cybersecurity recorded 28 cyberattacks against the federal administration and 325 against critical infrastructure.

In 2025 the arms company Ruag, owned by the Confederation, paid a ransom to the Akira hacker group to recover stolen data.

The rapid sharing of indicators with private and cantonal operators is the most useful part of the response. It allows hospitals, electricity utilities and local administrations to check their systems before being hit by the same vulnerability.