Mathspace

Profile narrative

Mathspace is an education technology organisation that operates an online mathematics learning platform used by schools, students, and educators, primarily in Australia and New Zealand. Its core service involves delivering interactive, adaptive mathematics instruction through a digital environment designed to support classroom teaching, independent study, and student progress tracking. The platform serves students across multiple year levels, along with their teachers and school administrators, and it also holds accounts for parents or guardians and its own staff members. Its market focus is concentrated in Australia and New Zealand, where it has built a substantial user base within the school education sector.

The scale of the organisation is most clearly reflected in the scope of its Australian reporting database, which was exposed in a security incident in August 2026. According to the available record of that event, the database contained records for roughly 1.08 million students, parents or guardians, school staff, and Mathspace's own employees located in Australia and New Zealand. The breadth of this user base indicates a significant footprint in the Australasian education market, with the company supporting a large number of schools and families across both countries. No further quantitative details about revenue, employee count, or school partnerships are provided in the available material.

Mathspace distinguishes itself through its specialisation in mathematics education and its use of internal business intelligence tooling to manage its reporting infrastructure. The organisation was running a self-hosted installation of Metabase, a widely used open-source analytics platform, which it relied on for internal reporting purposes. The incident revealed that the company maintained detailed user records including names, email addresses, user types, account activity timestamps, and date-joined information, suggesting a structured approach to user account management. Its position within the education sector means it handles data subject to privacy regulations governing student and family information, and it reported the incident to regulators following discovery.

Structurally, Mathspace operates as an independent organisation, with no parent company or subsidiary relationships identified in the available material. It functions as the data controller for the Australian reporting database that was compromised, and it assumed direct responsibility for disclosing the incident to affected individuals and relevant authorities. The company publicly disclosed the breach after a gap of approximately three weeks during which a vendor patch for the exploited vulnerability went unapplied, and it initiated individual notifications to those affected. No information is available regarding its corporate ownership structure beyond its independent status.

Incidents

1 incident linked to this organisation.