[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZUhJQL1fHgtZrTrCTj20HECtryvk8kj36xu5qwRrFcM":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"d2efc080-d9eb-4b88-8ead-d7d7732e3cd7","Swiss government SharePoint breach compromised 200 accounts","swiss-government-sharepoint-breach-compromised-200-accounts-453404","Switzerland's federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts. [...]","Hackers exploited vulnerabilities in Microsoft SharePoint servers used by the Swiss government, compromising approximately 200 accounts. The Federal Office for Information Technology and Telecommunication (BIT) detected the attack and has since blocked external access, patched vulnerabilities, and reset affected accounts. While the specific vulnerability is unconfirmed, it is believed to be one of several SharePoint flaws patched by Microsoft in July 2026.","Swiss government SharePoint servers breached, compromising ~200 accounts.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fswiss-government-sharepoint-breach-compromised-200-accounts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F06\u002F30\u002FSwitzerland-flag.jpg","2026-08-06T18:14:19+00:00","2026-08-06T20:00:21.017254+00:00",8,[17,20,23],{"name":18,"type":19},"SharePoint","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":19},"Microsoft SharePoint","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"cve","CVE-2026-56164","Potentially exploited SharePoint privilege escalation vulnerability",{"type":50,"value":54,"context":55},"CVE-2026-50522","Potentially exploited SharePoint remote code execution flaw",[21,18,24],{"controls":58,"vendors":142},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":89,"name":90,"problem":91,"products":92},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":118,"name":119,"problem":120,"products":121},"patch-management","Automated patch management","Known holes get closed in days, not months.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":118,"product_name":139,"url":140,"description":141},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[143],{"slug":144,"name":21,"logo_path":145,"roles":146},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":163},"swiss-government-sharepoint-breach-200-accounts-compromised-via-unpatched-vulnerabilities","Swiss Government SharePoint Breach: 200 Accounts Compromised via Unpatched Vulnerabilities","Attackers exploited known vulnerabilities in Microsoft SharePoint servers hosting Swiss government systems, compromising approximately 200 accounts before detection. The core failure was a lag between Microsoft releasing critical SharePoint patches and their deployment on government infrastructure — a classic patch management gap that left internet-facing systems exposed. This incident highlights that public sector organizations are high-value targets, and delays in patching widely-used platforms like SharePoint can result in broad credential compromise. Timely patch application, especially for internet-facing services, is a non-negotiable baseline control for any organization managing sensitive government data.",[153,154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 17: Incident Response Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST IR-4: Incident Handling","NIST AC-2: Account Management","ISO\u002FIEC 27001:2022 – A.8.8: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (technical and organizational measures)","ITIL 4: Change Enablement (emergency change procedures)",{}]