Mathspace Metabase breach (1.08 million students, staff and parents)

On 7 September 2026, Mathspace, an online mathematics learning platform founded in Sydney and used by schools in Australia, New Zealand, the United States and the United Kingdom, disclosed a data breach affecting 1,079,819 people, including students, school staff, parents and guardians.

The company said attackers exploited a security vulnerability in Metabase, a self-hosted internal reporting and analytics tool, which let them obtain administrator access without a legitimate login. The initial access dates back to 10 August 2026, data was downloaded on 27 August, and Mathspace confirmed the breach on 3 September. Only residents of Australia and New Zealand were affected.

What was exposed

The stolen data consisted of names and contact information and, in some cases, school affiliations. Mathspace said passwords, authentication credentials, academic records and assessment data were not taken. The company notified affected users and advised them to watch for suspicious activity. Reporting noted that the intrusion matched a wider pattern of Metabase exploitation against several companies, which some researchers linked to ShinyHunters, although the attack was not definitively attributed.

Why it matters

Internal business intelligence tools are often connected directly to production databases but receive less hardening and patching attention than customer-facing systems. For an education provider, a single exposed reporting server was enough to reveal data about more than a million people, a large share of them minors.