Mathspace student data breach hits 1.08 million people
Maths learning platform Mathspace says attackers exploited its self-hosted Metabase reporting tool in August 2026. Data on 1,079,819 students, parents and staff in Australia and New Zealand was taken.
Key facts
- OrganisationMathspace, an online maths platform founded in Sydney and used by schools.
- What happenedAttackers used a Metabase flaw to get administrator access to an internal reporting system from 10 August. They downloaded data on 27 August.
- Data affectedUser IDs, usernames, first and last names, email addresses, country, time zone, user type and login dates. Not every field exists for every person.
- Not affectedMathspace says passwords and hashes, SSO and API credentials, and academic records and results were not exposed.
- Cause or entry pointMetabase issued a critical advisory and patch on 6 August. Mathspace says its process did not escalate it and it patched on 29 August.
- ClaimedMathspace calls the attackers unknown. BleepingComputer links the case to a wider Metabase campaign that ShinyHunters claimed, without confirming who hit Mathspace.
- AuthoritiesMathspace notified the OAIC, ASD's ACSC, New Zealand's Privacy Commissioner and NCSC, and state education departments on 4 September.
Timeline
- 6 Aug 2026Metabase publishes a critical security advisory and patched versions. Mathspace
- 10 Aug 2026Unauthorised access to Mathspace's internal reporting system begins. Mathspace · BleepingComputer
- 27 Aug 2026Data is downloaded from the Australian reporting database. Mathspace · BleepingComputer
- 3 Sep 2026Mathspace confirms the breach and takes Metabase offline. Mathspace · BleepingComputer
- 4 Sep 2026Mathspace notifies schools, regulators and cyber security agencies in both countries. Mathspace
- 6 Sep 2026Mathspace begins notifying affected people directly. Mathspace
Affected organisations
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
| ✅ ConfirmedMathspace | Australia | 3 Sep 2026 | Education | Data leak | None | Confirmed. Mathspace said attackers exploited its self-hosted Metabase system and stole data on 1,079,819 students, parents and staff in Australia and New Zealand. | BleepingComputer✓ 7 Nov |
| ✅ ConfirmedMathspace (NZ users) | New Zealand | 3 Sep 2026 | Education | Data leak | None | Confirmed. Mathspace said stolen data covered students, parents and staff in Australia and New Zealand, 1,079,819 people in total. | BleepingComputer✓ 7 Nov |
What to do
- Treat unexpected emails that use your or your child's name with care, even if they mention this breach.
- Change any password you reused elsewhere. Mathspace says a Mathspace password reset is not required.
- Ask [email protected] whether your details were included, including for old accounts.
- Report scams to Scamwatch (scamwatch.gov.au) in Australia or the NCSC (ncsc.govt.nz) in New Zealand.
FAQ
Was my child's data in the Mathspace breach?
1,079,819 students, parents, teachers and staff in Australia and New Zealand were affected. Mathspace is notifying people and answers queries at [email protected].
Were Mathspace passwords or grades leaked?
Mathspace says passwords, login tokens and academic records were not exposed.
How did the Mathspace breach happen?
Attackers exploited a known flaw in Mathspace's self-hosted Metabase reporting tool, which had not been patched in time.
Related stories
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
- Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- M1 customer data breach Singapore · 6 Nov 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0