Mathspace Breach Exposes 1,079,819 Students, Staff, and Parents

For school IT administrators and edtech procurement leads, Mathspace's disclosure is a real-world failure in vendor security operations: a self-hosted analytics tool used for internal reporting became the entry point to the personal data of more than a million students and families. The breach didn't expose grades or assessment records, but the stolen metadata—emails, usernames, last active dates, and school-linked accounts—creates phishing and social engineering risks that schools now inherit. This is a case study in why K-12 institutions must extend data governance to third-party platforms.

Mathspace, a Sydney-founded online mathematics platform used by thousands of schools in Australia, New Zealand, the United States, and the United Kingdom, has disclosed that attackers breached its self-hosted Metabase reporting system and stole personal data belonging to 1,079,819 students, teachers, school staff, and parents or guardians in Australia and New Zealand. The breach, confirmed on September 3, 2026, and disclosed in a Saturday blog post by CTO Alvin Savoy, stemmed from a known vulnerability in Metabase that Mathspace failed to patch for more than three weeks after a fix was available. According to the company's incident notice, unauthorized access began on August 10, 2026, Australian Eastern Standard Time, and data was downloaded from its Australian reporting database on August 27.

“

The breach, confirmed on September 3, 2026, and disclosed in a Saturday blog post by CTO Alvin Savoy, stemmed from a known vulnerability in Metabase that Mathspace failed to patch for more than three weeks after a fix was available.

The security defect at the center of the incident is CVE-2026-72898, an SQL injection vulnerability in Metabase with a maximum CVSS score of 10.0. Metabase patched the flaw on August 6 after it had already been exploited in the wild as a zero-day. Shortly after the patches were released, the extortion group ShinyHunters claimed responsibility for hacking Metabase, although Mathspace has not publicly attributed its specific intrusion to that group. Crucially, Mathspace did not apply the update until August 29, more than two weeks after attackers first accessed its instance, and the company acknowledged that it failed to escalate Metabase's critical advisory internally. It also did not complete the compromise checks Metabase recommended and did not identify the intrusion when it applied the update. The gap between the August 6 patch and the August 29 upgrade created a large window in which a public, in-the-wild vulnerability could be leveraged against unpatched infrastructure.

Mathspace says the exposed data includes names, user IDs, usernames, email addresses, email verification status, time zone, country, date joined, and last login and active dates. It does not include academic records, learning activities, results, assessment records, password hashes, authentication tokens, SSO credentials, or API credentials. That distinction matters for damage assessment: the absence of grades and credentials lowers the immediate harm, but the combination of student names, email addresses, usernames, and school-linked account metadata still enables phishing, social engineering, and account enumeration. Because the affected population includes minors, the breach also carries heightened privacy sensitivity and obligations under Australian and New Zealand privacy regimes, including the Australian Privacy Act and the Notifiable Data Breaches scheme.

For edtech providers and their school customers, the incident is a reminder that internal data tools are not separate from student-data security. Metabase is a widely used open-source business intelligence platform, and self-hosted instances often sit outside formal patching and asset-inventory programs. Mathspace's admission that the critical advisory was not escalated points to a process failure rather than an obscure technical exploit. The company has taken its Metabase instance offline, revoked API keys, disabled database access accounts, changed passwords, and exported logs for investigation. It is also investigating why checks were not completed sooner and says it is changing both escalation and compromise-check processes. Those are appropriate containment steps, but the breach may still invite regulatory scrutiny, parent and school inquiries, and ongoing monitoring for misuse of the downloaded dataset.