Mathspace data breach exposes information of more than 1 million students, parents and staff

Mathspace, an online mathematics education platform founded in Sydney in 2010, has confirmed that unauthorized parties gained access to an internal reporting system and downloaded personal information belonging to more than 1.07 million students, parents, guardians and school staff. The company serves thousands of schools across Australia, New Zealand, the United States and the United Kingdom, with 3,432 schools in Australia and 3,557 abroad as of 2023.

Mathspace confirmed the intrusion on September 3, 2026, though the attackers first gained entry to company systems on August 10 and extracted data from the platform’s Australian reporting database on August 27. Chief Technology Officer Alvin Savoy said the attackers exploited a flaw in the company’s self-hosted deployment of Metabase, a software tool used internally for reporting, which granted them administrator-level access without a valid login.

A total of 1,079,819 individuals were affected, a figure that combines students, staff, parents and guardians. Savoy said only users in Australia and New Zealand were affected by the breach. The exposed information included names, email addresses, usernames, user identification numbers, countries, time zones, account types, and dates when accounts were created or last accessed. Not every affected account contained the full set of these details.

Mathspace said passwords, password hashes, authentication tokens, single sign-on credentials, API credentials, academic records, learning activity data and assessment results were not compromised. The company also said the stolen data did not directly link user accounts to specific schools, though it acknowledged that for schools with identifiable email domains, such connections could potentially be inferred. Savoy said the company has seen no evidence that the stolen data has been published, distributed, sold or otherwise misused, and said the attackers have not been identified.

Metabase issued a security advisory and released patched versions on August 6, but Mathspace acknowledged that its internal process for escalating vulnerability notifications failed to flag the warning for action before the breach occurred.

Savoy cautioned that affected students and staff could be targeted using the stolen information and urged them to watch for suspicious activity tied to their accounts, including unexpected changes to account details or password-reset messages. Mathspace said combinations of names, email addresses and account information could make impersonation attempts appear more convincing to recipients.

The company has taken the affected reporting system offline and notified impacted schools, education departments and cybersecurity authorities. "We’re truly sorry this happened and are taking steps to prevent similar breaches in the future," Mathspace said.

The Mathspace incident is one of several breaches tied to vulnerabilities in Metabase installations over the past month. Attackers exploited a critical SQL injection flaw in the software to gain administrator access to multiple companies’ systems and steal data. Hardware wallet maker Trezor disclosed on August 13 that nearly 14,000 customers were affected after its shipping and logistics provider, ShipMonk, was breached; that number later grew to 81,000 affected individuals. Laptop manufacturer Framework and online form-building platform Tally have also disclosed data breaches connected to compromised Metabase instances.