Mathspace Data Breach Affects Over a Million People

Mathspace, the Australian online math-learning platform founded in Sydney in 2010 and used by thousands of schools in Australia, New Zealand, the United States and the United Kingdom, has disclosed a data breach. According to the company's chief technology officer, Alvin Savoy, unknown attackers gained access to an internal reporting system and downloaded the personal data of students, their parents or guardians, and school staff. Records on Mathspace's own employees were affected as well.

How the breach happened

The attackers exploited a vulnerability in a self-hosted, locally deployed installation of Metabase — the software the company uses for internal analytics. The vulnerability allowed them to obtain administrator privileges without a legitimate login. The timeline looks like this: the attackers gained access to the compromised systems as early as August 10, 2026, exfiltrated data from the Australian reporting database on August 27, and the company itself only confirmed the theft on September 3.

A total of 1,079,819 people were affected — students, staff and parents combined. Only users in Australia and New Zealand were impacted.

What exactly was leaked

The company stresses that academic records, learning results, grades, password hashes, authentication tokens, SSO credentials and API keys were not affected. The data on its own did not link accounts to specific schools, but for schools with recognizable email domains such a link is, Mathspace admits, still possible. Savoy warned those affected about the risk of targeted attacks using the stolen information and advised them to watch for suspicious activity — changes to account settings and password-reset emails.

Part of a larger campaign

The incident fits into a whole series of attacks on Metabase installations worldwide over the past month. As BleepingComputer reported earlier, the attackers exploited a critical SQL-injection zero-day vulnerability to gain administrator access and steal data. The ransomware group ShinyHunters claimed responsibility for the attacks on Metabase, having added the product to its list of victims on its dark-web site back on August 11.

Other victims include the hardware crypto-wallet maker Trezor (through its logistics contractor ShipMonk, the number of affected customers grew from nearly 14,000 to 81,000), the laptop manufacturer Framework and the form-building platform Tally. ShinyHunters has previously been linked to breaches of more than a dozen Snowflake customers, campaigns against Salesforce users, and attacks on enterprises through a vulnerability in Oracle PeopleSoft.

Source: Bleeping Computer