Mathspace breach exposes personal information of 1.08 million students, parents and staff
Attackers stole names, emails and account details for 1,079,819 Mathspace users in Australia and New Zealand. Passwords and academic records were not exposed. Verify unexpected school or Mathspace messages independently.
Verify unexpected school or Mathspace messages using contact details obtained independently, and never send passwords or verification codes in reply. Ask your school or email [email protected] whether your family was affected, including former users. Mathspace does not require a password reset; change passwords reused across services.
What’s happening
Attackers exploited an unpatched Metabase reporting system at Mathspace and downloaded information about 1,079,819 people in Australia and New Zealand, including students, parents or guardians, teachers and company staff. Exposed information included names, email addresses, usernames, internal user IDs, country, time zone and account activity dates; not every field existed for everyone. Mathspace says academic records, results, passwords and authentication credentials were not exposed. A software fix had been available since 6 August, but Mathspace updated on 29 August, after the theft. It subsequently disabled the reporting system while allowing lessons and assignments to continue. Its latest statement, dated 8 September, still described notifications and recovery checks as ongoing and the attacker as unidentified. No later public update confirming completion or subsequent misuse was found in the search through 3 November.
- What
- Breach
- Affects
- Mathspace online maths learning service
- Fixed in
- Nothing to patch
- Since
- 3 Aug 2026
- Closed
- 8 Sept 2026
Timeline
- Vendor revised
The updated notice acknowledged account details omitted from earlier communications. Notifications and recovery checks remained unfinished; Mathspace reported no evidence of subsequent data misuse.
- Update
Direct notifications to affected individuals began earlier than initially planned, following requests from schools.
- Made public
Mathspace published its public breach notice.
- Made public
School notifications began. Mathspace reported the incident to privacy and cyber security authorities in Australia and New Zealand.
- UpdateNothing to patch
Mathspace confirmed the breach, took Metabase offline and revoked its access to connected databases.
- Update
Mathspace updated Metabase after missing the vendor’s 6 August advisory. It did not complete the recommended checks for an existing compromise.
- Update
Attackers downloaded personal information from Mathspace’s Australian reporting database.
- Update
Mathspace traced the first unauthorised access to its Metabase reporting system to this date.
Sources
- Mathspace data breach: what happened and what affected users should knowMathspace · 8 Sept 2026
- SQL injection using an unauthenticated endpoint leading to admin accessMetabase · 6 Aug 2026
- Security update available for Metabase - Please upgrade nowMetabase · 6 Aug 2026
- Breached! Tutoring platform Mathspace says 1m-plus Aussies implicated by data breachCyber Daily · 7 Sept 2026
- More than 1 million users affected in Mathspace data breach across Australia and New ZealandABC News · 7 Sept 2026
- More than 1m caught in Mathspace data breachInformation Age · 10 Sept 2026