{"id":"mathspace-student-family-breach-sep-2026","category":"breach","status":"closed","title":"Mathspace breach exposes personal information of 1.08 million students, parents and staff","tldr":"Attackers stole names, emails and account details for 1,079,819 Mathspace users in Australia and New Zealand. Passwords and academic records were not exposed. Verify unexpected school or Mathspace messages independently.","summary":"Attackers exploited an unpatched Metabase reporting system at Mathspace and downloaded information about 1,079,819 people in Australia and New Zealand, including students, parents or guardians, teachers and company staff. Exposed information included names, email addresses, usernames, internal user IDs, country, time zone and account activity dates; not every field existed for everyone. Mathspace says academic records, results, passwords and authentication credentials were not exposed. A software fix had been available since 6 August, but Mathspace updated on 29 August, after the theft. It subsequently disabled the reporting system while allowing lessons and assignments to continue. Its latest statement, dated 8 September, still described notifications and recovery checks as ongoing and the attacker as unidentified. No later public update confirming completion or subsequent misuse was found in the search through 3 November.","action":"Verify unexpected school or Mathspace messages using contact details obtained independently, and never send passwords or verification codes in reply. Ask your school or email data-breach-response@mathspace.co whether your family was affected, including former users. Mathspace does not require a password reset; change passwords reused across services.","product":"Mathspace online maths learning service","audience":"both","severity":"high","patch":"na","exploited":true,"cves":["CVE-2026-72898"],"tags":["mathspace","metabase","data-breach","education","australia","new-zealand"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Mathspace data breach: what happened and what affected users should know","url":"https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/","by":"Mathspace","date":"2026-09-08"},{"kind":"advisory","title":"SQL injection using an unauthenticated endpoint leading to admin access","url":"https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf","by":"Metabase","date":"2026-08-06"},{"kind":"advisory","title":"Security update available for Metabase - Please upgrade now","url":"https://www.metabase.com/blog/security-update-6-aug-2026","by":"Metabase","date":"2026-08-06"},{"kind":"news","title":"Breached! Tutoring platform Mathspace says 1m-plus Aussies implicated by data breach","url":"https://www.cyberdaily.au/security/14148-breached-tutoring-platform-mathspace-says-1m-plus-aussies-implicated-by-data-breach","by":"Cyber Daily","date":"2026-09-07"},{"kind":"news","title":"More than 1 million users affected in Mathspace data breach across Australia and New Zealand","url":"https://www.abc.net.au/news/2026-09-07/mathspace-data-breach/107124894","by":"ABC News","date":"2026-09-07"},{"kind":"news","title":"More than 1m caught in Mathspace data breach","url":"https://ia.acs.org.au/article/2026/more-than-1m-caught-in-mathspace-data-breach.html","by":"Information Age","date":"2026-09-10"}],"started":"2026-08-03","closed":"2026-09-08","created":"2026-11-03T20:39:44.077Z","updated":"2026-11-03T20:39:44.077Z","cve_notes":[{"cve":"CVE-2026-72898","name":"Metabase SQL injection allowing administrator access","what":"A SQL injection flaw in Metabase’s password-reset handling lets an attacker without a login gain administrator access and steal information accessible through connected databases.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-09-08","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"The updated notice acknowledged account details omitted from earlier communications. Notifications and recovery checks remained unfinished; Mathspace reported no evidence of subsequent data misuse.","url":"https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/","by":"Mathspace","patch":null},{"at":"2026-09-06","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Direct notifications to affected individuals began earlier than initially planned, following requests from schools.","url":"https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/","by":"Mathspace","patch":null},{"at":"2026-09-05","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Mathspace published its public breach notice.","url":"https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/","by":"Mathspace","patch":null},{"at":"2026-09-04","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"School notifications began. Mathspace reported the incident to privacy and cyber security authorities in Australia and New Zealand.","url":"https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/","by":"Mathspace","patch":null},{"at":"2026-09-03","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Mathspace confirmed the breach, took Metabase offline and revoked its access to connected databases.","url":"https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/","by":"Mathspace","patch":"na"},{"at":"2026-08-29","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Mathspace updated Metabase after missing the vendor’s 6 August advisory. It did not complete the recommended checks for an existing compromise.","url":"https://www.cyberdaily.au/security/14148-breached-tutoring-platform-mathspace-says-1m-plus-aussies-implicated-by-data-breach","by":"Cyber Daily","patch":null},{"at":"2026-08-27","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Attackers downloaded personal information from Mathspace’s Australian reporting database.","url":"https://www.cyberdaily.au/security/14148-breached-tutoring-platform-mathspace-says-1m-plus-aussies-implicated-by-data-breach","by":"Cyber Daily","patch":null},{"at":"2026-08-10","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Mathspace traced the first unauthorised access to its Metabase reporting system to this date.","url":"https://www.cyberdaily.au/security/14148-breached-tutoring-platform-mathspace-says-1m-plus-aussies-implicated-by-data-breach","by":"Cyber Daily","patch":null}],"url":"https://hard.fyi/live/mathspace-student-family-breach-sep-2026/","json":"https://hard.fyi/api/live?id=mathspace-student-family-breach-sep-2026"}