Mathspace breach exposes data of 1,079,819 users

Mathspace has disclosed a data breach that exposed personal information belonging to more than 1 million students, staff, and parents or guardians.

Attackers accessed the company's Metabase internal reporting system. The breach was confirmed on September 3, 2026 after unauthorized parties gained access on August 10 and downloaded data from the Australian reporting database on August 27. Mathspace CTO Alvin Savoy stated that attackers exploited a security vulnerability in the self-hosted Metabase installation to obtain administrator access without a legitimate login.

The company took the affected system offline after discovery. Savoy said the exposed data included names and email addresses along with user ID, username, country, timezone, user type, verification status, and last active, login, and joined dates. No academic records, learning activities, results, assessment records, passwords, authentication tokens, SSO credentials, or API credentials were exposed.

Only users in Australia and New Zealand were impacted. A total of 1,079,819 people were affected, according to Savoy. The company, founded in Sydney in 2010, is used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom. In 2023 it reported 3,432 schools in Australia and 3,557 abroad.

Savoy noted that while records did not directly link user accounts to their schools, for schools with identifiable email domains this may be possible. The company has notified affected individuals, authorities, and education departments. There is no evidence the data has been published, sold, or misused.

Mathspace warns of potential phishing and account takeover risks. Savoy advised affected students and school staff to watch for suspicious activity such as changes to account details or password-reset messages. He urged users to change passwords if they reuse them elsewhere and apologized for the incident, accepting full responsibility.

The breach is part of a wider campaign targeting Metabase instances. Over the last month, threat actors have exploited a critical Metabase SQL injection zero-day vulnerability to breach multiple companies worldwide. ShinyHunters has claimed responsibility for several of these incidents, including those affecting laptop maker Framework, online form-building platform Tally, and shipping provider ShipMonk, which saw customer data stolen from nearly 81,000 individuals. Mathspace has not attributed the attack to a specific group.