[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1i31jWTt3Ij_1wwQlBsuvW4rd0XYbzwcJKgq1fXJY1w":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"5f2027d7-6ef7-47fc-aa42-15454c99861e","swiss-government-sharepoint-breach-200-accounts-compromised-via-unpatched-vulnerabilities","d2efc080-d9eb-4b88-8ead-d7d7732e3cd7","Swiss Government SharePoint Breach: 200 Accounts Compromised via Unpatched Vulnerabilities","Attackers exploited known vulnerabilities in Microsoft SharePoint servers hosting Swiss government systems, compromising approximately 200 accounts before detection. The core failure was a lag between Microsoft releasing critical SharePoint patches and their deployment on government infrastructure — a classic patch management gap that left internet-facing systems exposed. This incident highlights that public sector organizations are high-value targets, and delays in patching widely-used platforms like SharePoint can result in broad credential compromise. Timely patch application, especially for internet-facing services, is a non-negotiable baseline control for any organization managing sensitive government data.","**Immediate Actions:**\n- Apply all available Microsoft SharePoint security patches immediately, prioritizing internet-facing instances.\n- Audit and reset credentials for any accounts with access to affected SharePoint servers.\n- Block or restrict external access to SharePoint environments until patch status is fully verified.\n\n**Long-Term Improvements:**\n- Establish a formal emergency patching SLA (e.g., critical patches applied within 24–72 hours) for all internet-facing government systems.\n- Maintain a continuously updated asset inventory that flags unpatched versions of high-risk platforms like SharePoint.\n- Implement network segmentation to isolate SharePoint and other collaboration platforms from core government infrastructure.\n\n**Detection Measures:**\n- Deploy continuous vulnerability scanning on all external-facing services to detect unpatched systems before attackers do.\n- Enable centralized logging and alerting for SharePoint authentication events to detect anomalous login patterns early.\n- Conduct regular threat hunting exercises focused on known exploitation paths for critical Microsoft vulnerabilities.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 17: Incident Response Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST IR-4: Incident Handling","NIST AC-2: Account Management","ISO\u002FIEC 27001:2022 – A.8.8: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (technical and organizational measures)","ITIL 4: Change Enablement (emergency change procedures)",{},"published","2026-08-06T20:20:56.929301+00:00","2026-08-06T20:20:56.845+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fswiss-government-sharepoint-breach-compromised-200-accounts\u002F","swiss-government-sharepoint-breach-compromised-200-accounts-453404","Swiss government SharePoint breach compromised 200 accounts",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[51,55,58],{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":34,"name":56,"problem":57},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":59,"problem":60},"Automated patch management","Known holes get closed in days, not months."]