Mathspace

Summary

Mathspace disclosed that an internal reporting system was accessed without authorization after an unpatched vulnerability in its self‑hosted Metabase installation was exploited, allowing attackers to download records linked to approximately 1.08 million individuals across Australia and New Zealand, including students, their parents or guardians, school staff, and the company’s own employees. The exposed data comprised names, email addresses, user IDs, usernames, country, time zone, user type, email‑verification status, last‑active and last‑login timestamps, and date joined, while passwords, authentication tokens, and academic or learning information were not compromised. The intrusion began before the data was extracted, and the breach was made public shortly after discovery; the company stated there is no evidence the stolen information has been misused.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Mathspace, an online maths tutoring platform used in schools across Australia and New Zealand, confirmed a data breach affecting 1,079,819 individuals, comprising students, their parents or guardians, school staff, and the company’s own employees. The company disclosed the incident on September 3, 2026, and last updated its public notice on September 6, 2026. Unauthorised parties gained access to an internal reporting system and downloaded records tied to accounts across Mathspace’s user base. According to Mathspace’s investigation, unauthorised access began on August 10, 2026 (Australian Eastern Standard Time) and the attacker downloaded information from the Australian reporting database on August 27, 2026. The breach was traced to an unpatched vulnerability in Mathspace’s self‑hosted installation of Metabase, an open‑source business intelligence tool used for internal reporting. Metabase issued a critical security advisory and released patches around August 6, 2026, and Mathspace applied the update on August 29, 2026, two days after the data had been extracted.

Mathspace stated that the exposed information included names and email addresses, along with specific fields such as user ID, username, first name, last name, email address, country, time zone, user type, email‑verification status, last‑active date, last‑login date, and date joined. The company emphasized that customer passwords, single sign‑on tokens, and other authentication credentials were not exposed, and that no academic or learning data such as grades, assignment history, or problem‑solving records were compromised. Mathspace reported the incident to regulators on September 4, 2026, and began notifying affected individuals on September 6, 2026. The company has said it has no evidence so far that the data has been published, distributed, sold, or otherwise misused. Mathspace published a dedicated breach notice on its blog and has been notifying affected users directly, opening its public statement with an apology: “We’re truly sorry this happened and are taking steps to prevent similar breaches in the future”. Mathspace has not disclosed a named executive quote beyond these company‑level statements or a technical root‑cause report detailing exactly how the Metabase instance was exposed to the public internet.

Sources

Sources available to members: 1 source.