Mathspace, a Sydney-based online mathematics learning provider, has revealed a major data breach that compromised the personal data of 1,079,819 users across Australia and New Zealand. The compromised group includes students, parents, guardians, teachers, and school personnel. The platform confirmed that attackers accessed its internal reporting system and downloaded sensitive user records. The incident ranks among the largest education-sector breaches in the region this year.
How the Breach Happened
The attackers exploited a recent, critical vulnerability in Mathspace’s self-hosted instance of Metabase, an open-source business intelligence tool used for internal reporting. This security gap, tracked as CVE-2026-72898, involved an unauthenticated SQL injection via Metabase’s password-reset API, enabling attackers to execute arbitrary SQL commands and gain administrator access without needing valid credentials.
Metabase publicly disclosed the flaw on August 6, 2026, assigning it the highest severity rating (CVSS 10.0), and released patches the same day. Despite the availability and notoriety of the exploit—being added shortly afterwards to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities list—Mathspace failed to apply the patch promptly. The company acknowledged that its internal vulnerability-notification process did not escalate the advisory in time.
Timeline and Scope of Exposure
Access by unauthorized actors began on August 10—just four days after public patch availability—and continued until August 27, when data extraction occurred. Mathspace finally updated its Metabase installation on August 29, after another reminder brought the issue back to their attention. The breach went unnoticed until September 3, following a retrospective review of historical logs that confirmed unauthorized access.
The exposed data included user IDs, usernames, full names, email addresses, account creation dates, last login and activity timestamps, country, time zone, account type, and email verification status. Mathspace clarified that not all fields applied to every individual. Importantly, more sensitive data—passwords, password hashes, single-sign-on tokens, academic records, grades, or learning activity—were not accessed. While school identification wasn’t directly included, inferences could be made via identifiable email domains.
Response and Mitigation Efforts
Mathspace has disabled the affected reporting system, alerted schools, education authorities, and cybersecurity regulators, and overhauled its advisory-escalation and patch verification workflows. The company has also urged anyone impacted to be wary of breach-related communications, avoid reusing passwords across services, and monitor their accounts for unusual login or password-reset activity.
To date, there is no evidence that the stolen data has been published, sold, or otherwise misused. The identity of the attacker remains unknown.
From a technical standpoint, the breach shows how critical it is for organizations to not only track publicly disclosed vulnerabilities—but also to promptly act on them. For education tech platforms that handle large volumes of personal data, delays in patching or insufficient change control can have severe consequences. Moving forward, stakeholders should look for stronger internal security governance, more rigorous monitoring of software dependency reports, and faster, more transparent responses when flaws are discovered.
