Mathspace Breach Exposes Data of 1.1 Million Users
A critical vulnerability in a self-hosted reporting tool allowed unauthorized access to student and parent data across Australia and New Zealand.
Australian edtech provider Mathspace has confirmed a significant data breach that exposed the personal information of over one million users. The incident underscores the persistent risks associated with self-hosted internal infrastructure in the education sector.
According to company disclosures, the breach affected 1,079,819 individuals, including students, staff, and parents or guardians across Australia and New Zealand. Attackers gained administrator access to an internal reporting system by exploiting a critical security vulnerability in a self-hosted installation of Metabase. Unauthorized access to the system began on August 10, 2026, and the attackers successfully downloaded data on August 27, 2026.
The exposed data includes user IDs, usernames, first and last names, and email addresses. Additionally, the breach leaked country and time zone information, user types, email-verification status, and dates regarding when users joined, last logged in, and were last active. Mathspace confirmed that more sensitive information—including passwords, SSO tokens, authentication credentials, and academic records—was not exposed during the incident.
The Patching Failure
The breach resulted from a breakdown in internal security protocols. Metabase had published a critical security advisory regarding the vulnerability on August 6, 2026. However, Mathspace's vulnerability-notification process failed to escalate the warning, leaving the system exposed for weeks. The company eventually patched the installation on August 29, 2026, but only after the data had already been exfiltrated.
Industry Implications
This incident highlights a critical weakness in how edtech companies manage the lifecycle of their internal tools. While primary platforms often receive rigorous security audits, secondary reporting and analytics tools—like self-hosted Metabase instances—can become overlooked entry points for attackers. Because the breach involves a massive volume of data belonging to minors and their families, the risk of targeted phishing and impersonation attacks is significantly heightened.
Current Status
Mathspace stated that protecting the information entrusted to them by students, families, and schools is their responsibility. While the vulnerability has been closed, the company is managing the aftermath of the exposure of over a million records. It remains to be seen if the stolen data will appear on dark web forums or be used in coordinated social engineering campaigns against the affected educational communities.