Hundreds of organizations breached by SharePoint mass-hacks

Cybersecurity experts have revealed that hackers have successfully infiltrated more than 400 organizations by taking advantage of a zero-day vulnerability in Microsoft SharePoint. This alarming rise in breaches comes just days after the flaw was first identified. Eye Security, a cybersecurity firm based in the Netherlands, was the first to detect this critical vulnerability in SharePoint, which is widely used for storing and sharing internal documents. Their extensive internet scans uncovered hundreds of compromised SharePoint servers, a significant increase from the few dozen reported earlier this week. Among the affected entities is the National Nuclear Security Administration (NNSA), a key federal agency tasked with overseeing the U.S. nuclear arsenal. Despite inquiries, a representative from the Department of Energy, which oversees the NNSA, has not commented on the situation. Additionally, several other government agencies were also caught in the initial wave of attacks exploiting this dangerous bug. Evidence indicates that hackers began exploiting this vulnerability as early as July 7. The flaw, designated as CVE-2025-53770, affects self-hosted SharePoint versions that companies manage on their own servers. Once compromised, the vulnerability allows attackers to execute malicious code remotely, granting them access to sensitive files and potentially other connected systems within the organization’s network. This vulnerability is termed a zero-day because Microsoft had not released patches before it was exploited. However, the tech giant has since issued fixes for all affected SharePoint versions. Both Google and Microsoft have reported that multiple hacking groups, allegedly backed by the Chinese government, are actively exploiting this flaw. They also caution that organizations should prepare for an increase in cyberattacks as more groups are likely to take advantage of this vulnerability. The Chinese government has denied any involvement in these cyber activities.