21st July 2025 Cyber Update: Australian Migration Authority Data Breach and Critical SharePoint Zero-Day

Update: OMARA disclosed on July 14, 2025, that a data breach occurred on May 5 and 6, 2025, when the agency's website search function incorrectly revealed internal documents to users. The breach affected six registered migration agents whose details became accessible through the OMARA Portal search feature. When users searched for a registered migration agent's name, certain internal documents became viewable and downloadable, including agent full names, migration agent registration numbers, related business contacts, and internal commentary collected by OMARA.

“​​The Office of the Migration Agents Registration Authority (OMARA) has been affected by a data breach concerning the OMARA Portal on the OMARA website,” an OMARA spokesperson said in a 14 July media release.

The portal was immediately shut down upon discovery, and departmental experts conducted an investigation confirming the breach was a small, isolated event not resulting from malicious or criminal attack. The matter has been reported to the Office of the Australian Information Commissioner under Privacy Act 1988 obligations, and all six affected individuals have been contacted and offered support.

Why it Matters: This incident highlights the vulnerability of government digital systems to configuration errors that can inadvertently expose sensitive regulatory information. While not a malicious attack, the breach demonstrates how technical oversights in search functionality can compromise personal and professional data of regulated individuals.

For Australia's migration sector, this incident underscores the importance of robust testing and security controls for government portals handling sensitive regulatory information. The two-month delay between discovery and public disclosure raises questions about notification timelines for government data breaches, particularly when they involve professional regulatory information that could impact individuals' livelihoods and reputations in the migration services industry.

Update: Microsoft has confirmed active exploitation of a critical zero-day vulnerability in SharePoint Server, tracked as CVE-2025-53770 with a maximum CVSS severity score of 9.8. The vulnerability, dubbed "ToolShell" by security researchers, allows unauthenticated remote code execution through deserialization of untrusted data in on-premises SharePoint installations. Active exploitation began on July 18, 2025, with more than 75 company servers already compromised across 29 organizations, including multinational firms and government entities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and issued urgent guidance for federal agencies.

Today, Microsoft released security patches, along with mitigation guidance for immediate protection. The vulnerability affects only on-premises SharePoint Server installations, while SharePoint Online in Microsoft 365 remains unaffected.

Why it Matters: This zero-day represents one of the most critical enterprise security threats of 2025, with the potential to compromise sensitive corporate and government data across thousands of organizations worldwide. The unauthenticated nature of the vulnerability means attackers can gain complete system access without any credentials, making it exceptionally dangerous for internet-facing SharePoint deployments.

The active exploitation by multiple threat actors creates an urgent security crisis for organizations relying on SharePoint for critical business operations. For enterprise security teams, this incident demonstrates the ongoing risks of complex enterprise software platforms and the need for robust network segmentation, monitoring, and incident response capabilities to detect and contain sophisticated attacks targeting collaboration infrastructure.