Mathspace breach exposes data on over a million students and parents

Mathspace has confirmed that attackers broke into its internal reporting system through an unpatched Metabase vulnerability and stole data belonging to more than a million students, parents, and school staff.

The Sydney-based maths education company said the breach affected 1,079,819 people in Australia and New Zealand. Exposed data included usernames, names, email addresses, country, time zone, user type, email-verification status, last-active date, last-login date, and date joined. No academic records, passwords, or authentication tokens were exposed.

The attackers gained administrator access without a legitimate login via a vulnerability in Mathspace’s self-hosted Metabase installation. Unauthorised access dates back to 10 August 2026, with data downloaded on 27 August. The affected system has been taken offline.

Mathspace is not requiring a password reset but warns that leaked names and email addresses could be used for phishing. Similar Metabase vulnerabilities were exploited against Framework, Tally, and Kilo Code in August 2026.