Mathspace, a Sydney-based online maths learning platform used by schools in Australia and New Zealand, confirmed on September 3, 2026 that attackers accessed an internal reporting system and downloaded information on 1,079,819 people. The affected records belong to students, parents or guardians, school staff and Mathspace employees, all located in Australia and New Zealand.
According to the company's incident notice, attackers exploited a vulnerability in Mathspace's self-hosted installation of Metabase, an open-source business intelligence tool the company used for internal reporting. The flaw let them obtain administrator access to that system without a valid login. SecurityWeek reports the vulnerability as CVE-2026-72898, a SQL injection issue rated CVSS 10.0 that was exploited as a zero-day before patches shipped.
Metabase published a critical advisory and patched versions on August 6, 2026. Mathspace says its vulnerability notification process did not identify and escalate that advisory. Its investigation found unauthorized access starting August 10, with data downloaded from the Australian reporting database on August 27. The company updated Metabase on August 29, after a later notice reached it, but did not run the additional compromise checks Metabase recommended for systems that had been exposed. A review of historical access logs confirmed the intrusion on September 3.
After confirming the breach, Mathspace took Metabase offline, revoked all Metabase API keys, disabled Metabase's database access accounts in its Australian and US Snowflake environments, and changed the passwords for the Metabase Cloud SQL databases. It began notifying school contacts on September 4 and individuals on September 6, and reported the incident on September 4 to Australia's OAIC and ASD's ACSC, and to New Zealand's Office of the Privacy Commissioner and National Cyber Security Centre.
Mathspace says the attacker's identity is unknown. SecurityWeek reports that the extortion group ShinyHunters claimed responsibility for hacking Metabase after the patches were released; no group has been confirmed as responsible for the Mathspace intrusion. Other organizations, including laptop maker Framework and form builder Tally, have disclosed breaches through the same Metabase flaw.
The exported records included user ID, username, first and last name, email address, country, time zone, user type, email verification status, last active date, last login date and date joined. Mathspace notes that not every field was present for every person, and that its earlier communications had described the exposure as names and email addresses only.
The company states that no academic records, learning activity, results, password hashes, authentication tokens, single sign-on credentials or API credentials were exposed, and that the records did not directly link accounts to schools. It acknowledges that school email domains may make that link possible in some cases. Mathspace says it has no evidence so far that the data has been published, sold or misused, and that former and inactive users can also be affected.
The patch existed three weeks before the data left the building. What failed was not the fix but the path from a vendor advisory to someone with the authority to act on it, and then the step most teams skip after patching: checking whether the system was already compromised during the exposure window. For any organization running self-hosted open-source tools, the question to ask this week is who receives security advisories for software that no one formally owns, and how long it takes one to reach a change ticket.
The second lesson is about where internal tools sit. A reporting dashboard sounds low risk, but this one held live connections to production data stores in two regions. Business intelligence and analytics platforms deserve the same asset ownership, access review and exposure monitoring as the systems they read from. Education providers carry an added burden, because a large share of the people affected are children and the information is well suited to convincing phishing aimed at families and schools.
Who carried out the intrusion, whether any regulator will take action, and the results of the post-incident review into why the August 6 advisory was not escalated. Mathspace says it will publish the changes it makes and their implementation status.
1. Mathspace data breach: what happened and what affected users should know, Mathspace, September 5, 2026 (updated September 8, 2026). Confirms timeline, affected population, data fields, containment steps and regulator notifications.
2. Mathspace Data Breach Exposes Over 1 Million People, SecurityWeek, September 8, 2026. Reports the CVE identifier, severity and zero-day exploitation of the Metabase flaw.
3. Mathspace discloses data breach affecting over 1 million people, BleepingComputer, September 2026. Reports other organizations breached through the same Metabase vulnerability.
4. Mathspace breach exposes data on over a million students and parents, Help Net Security, September 8, 2026. Corroborates company statements and the wider Metabase campaign.
