Mathspace data breach exposes over 1 million people

Mathspace, an online mathematics programme for students, has disclosed a data breach affecting 1,079,819 students, teachers, staff and parents in Australia and New Zealand. The attackers accessed a self-hosted Metabase instance via a known SQL injection vulnerability, CVE-2026-72898, which had been exploited as a zero-day before a patch was released on August 6.

Mathspace said it failed to escalate the critical advisory and only upgraded its instance on August 29, more than two weeks after the initial compromise. Unauthorised access dated back to 10 August, with data downloaded on 27 August. The company has taken the Metabase instance offline, revoked API keys and disabled database accounts.

Exposed information includes names, user IDs, usernames, email addresses, email verification status, time zone, country, date joined, and last login and active dates. No academic records, passwords, authentication tokens or credentials were taken. Mathspace has notified authorities and is warning affected individuals to be alert for phishing attacks.