Government and public administration took three distinct hits this week — a Swiss cantonal leak-site claim, a Pegasus-infected MEP, and a US federal info-sharing breach

Three unrelated events this week share one thing: the victim is a public institution, and each demonstrates a different way government is reached — extortion branding, mercenary spyware, and inter-agency trust boundaries. For a Swiss federal SOC the value is the pattern across the target class, not any single incident.

A Swiss cantonal department on a leak site (unconfirmed). MedusaLocker listed a victim "Bd" with domain bd.zh.ch — the Baudirektion of the Canton of Zürich — on 2026-07-01, claiming 772 extracted emails, as part of a batch-style posting wave that also listed a French municipality and other European entities in immediate succession (Ransomware.live, 2026-07-01). This is a dark-web claim only: no cantonal statement, no NCSC.ch (BACS) advisory, no independent Swiss press coverage exists in-window. It is a situational-awareness signal for cantonal-government readers, not a confirmed breach — but batch-listing of European public bodies is itself the operational note (§ references).

A Pegasus-infected European Parliament oversight member. Citizen Lab confirmed with high confidence that the iPhone of former MEP Stelios Kouloglou — who sat on the Parliament's PEGA committee investigating commercial-spyware abuse — was infected with NSO Group's Pegasus twice (Oct 2022 and Mar 2023) via the zero-click PWNYOURHOME chain (a crafted NSKeyedArchive landing in the HomeKit daemon, then malicious content in MessagesBlastDoorService) (Citizen Lab, 2026-07-03). The targeting infrastructure overlaps a Pegasus operator also hitting Russian/Belarusian-speaking exiles in Europe. Infecting the person scrutinising spyware abuse is an EU parliamentary-privilege concern, and the defensive surface for high-risk officials is proactive mobile forensics plus enforced Lockdown Mode — not endpoint alerting.

A US federal information-sharing platform. DHS confirmed a breach of the Homeland Security Information Network — the platform federal/state/local/international/private-sector partners use to exchange sensitive-but-unclassified information — with intrusion believed to be late-May–early-June and a SharePoint collaboration system implicated; DHS says no classified networks were impacted (BleepingComputer, 2026-07-01). Both this and HSIN's 2023 incident trace to collaboration-platform trust boundaries rather than perimeter exploitation. Defender takeaway: government cross-org information-sharing portals are a recurring soft target — the transferable lesson for European public-sector SOCs running equivalent partner portals is to audit standing access and download-anomaly alerting on those platforms specifically. Detail on each event in § references.