Mathspace Data Breach Exposes Over 1 Million Users' Information

• •Over 1 million users affected, including students, parents, and staff.
• •Attackers exploited an unpatched vulnerability in Metabase for unauthorized access.
• •No passwords or academic records were compromised, but user information was exposed.

On September 3, 2026, Mathspace confirmed a data breach affecting 1,079,819 individuals in Australia and New Zealand. Unauthorized parties accessed an internal reporting system, exploiting a vulnerability in their self-hosted Metabase installation, which had not been patched since a critical advisory on August 6. The attackers gained access on August 10 and downloaded user information, including names, email addresses, and user IDs, on August 27. No academic records or authentication credentials were compromised. Mathspace has taken the compromised system offline and is notifying affected users. The identity of the attackers remains unknown, and there is currently no evidence that the stolen data has been misused. The company is reviewing its security processes to prevent future incidents.