Mathspace Reports Data Breach Affecting More Than 1 Million Students, Staff, and Parents

494/69 Wednesday, September 9, 2026 Mathspace, an online mathematics learning platform, disclosed a data breach after attackers gained access to its internal reporting system running a self-hosted Metabase deployment and stole data belonging to students, school staff, parents or guardians, and Mathspace employees, affecting more than 1 million people in total. Mathspace was founded in Sydney, Australia, in 2010 and is used by thousands of schools in Australia, New Zealand, the United States, and the United Kingdom. The company stated that the incident affected only individuals in Australia and New Zealand. Mathspace stated that it confirmed the data breach on September 3, 2026. The investigation found that attackers exploited a vulnerability in the company’s self-hosted Metabase system, allowing them to gain administrator privileges on the platform without using a login. The attackers accessed the compromised system starting on August 10, 2026, and downloaded data from Mathspace’s Australian reporting database on August 27, 2026. A total of 1,079,819 individuals were affected, including students, staff, and parents or guardians. The exposed data did not include academic records, learning activities, results, assessment records, password hashes, authentication tokens, SSO credentials, or API credentials. It also did not directly link user accounts to schools. However, Mathspace stated that for schools with identifiable email domains, some accounts may be associated with specific schools. The company warned that affected individuals could be targeted in scams or follow-on attacks and should monitor for suspicious account-related activity, such as account detail changes or password reset messages. The incident occurred amid a broader campaign targeting Metabase instances at multiple companies worldwide, reportedly involving exploitation of a SQL Injection zero-day vulnerability to gain administrator privileges and steal data. Other affected companies reportedly include Trezor, Framework, and Tally.