Ministry of Education's Leak Hunt Reveals Critical Software Configuration Failure
The Ministry of Education's investigation into multiple leaks to RNZ has uncovered a fundamental security failure: the leaked documents were stored on Microsoft SharePoint (a commonly used collection of enterprise content management and knowledge management software) sites accessible to any of the Ministry's approximately 5,000 employees, according to documents released under the Official Information Act.
The revelation emerges from internal emails, which show that at least the two leaked documents about the government's plans to disestablish the $118 million Kāhui Ako scheme were stored in Microsoft SharePoint sites "that were open to access and download by any Ministry person."
The security breach prompted Secretary for Education Ellen MacGregor-Reid to issue urgent directives on May 9, 2025, ordering all senior leaders to review their Microsoft SharePoint sites and restrict access where necessary. The discovery came during the investigation of leaks that had seen four separate Budget-related documents reach RNZ in just five weeks.
"Our ability to keep official information safe and secure is critical to trust and confidence," MacGregor-Reid wrote in an email marked "High Importance" to senior leadership. The email outlined immediate actions including reviewing all SharePoint security settings and arranging refresher training for staff handling sensitive information.
The SharePoint security failure points to broader challenges within the public service, as Microsoft SharePoint has a high market share in the New Zealand Public Service. Acting Deputy Secretary Rob Campbell acknowledged concerns in communications to staff, noting that the leaks "compromised the integrity of the public service" and created mistrust within teams.
The investigation documents also reveal that the Chief Information Security Officer was tasked with implementing additional security measures, though specific details were redacted under section 6(c) of the Official Information Act.
