cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Mathspace Confirms Breach Affecting 1.08 Million People After Metabase Exploit

· Original article ↗

Summary

Mathspace says hackers exploited a Metabase vulnerability and downloaded data belonging to 1,079,819 people in Australia and New Zealand. The company took the instance offline, revoked access, and began notifying affected individuals.

Key points

  • Mathspace says unauthorized access to its self-hosted Metabase instance began on August 10, 2026, and information was downloaded from its Australian reporting database on August 27.
  • The company says the breach affected 1,079,819 students, teachers, staff, and parents or guardians in Australia and New Zealand.
  • Exposed information included names, user IDs, usernames, email addresses, verification status, time zones, country, and account activity dates.
  • Mathspace says academic records, passwords, authentication tokens, SSO credentials, API credentials, and links between accounts and schools were not exposed.
  • The attackers reportedly exploited CVE-2026-72898, an SQL injection vulnerability in Metabase, after it was exploited as a zero-day and patched on August 6.
  • Mathspace says it upgraded Metabase on August 29, did not complete recommended compromise checks, and is reviewing why the advisory and checks were not handled sooner.
  • The company took the instance offline, revoked API keys, disabled database access accounts, changed passwords, preserved logs, reported the incident to Australian authorities, and began notifying affected people.

Article Details

Victim Organization
Mathspace
Incident Type
Exploitation of a Metabase SQL injection vulnerability, followed by unauthorized access and data exfiltration
Incident Date
2026-08-10
Data Types Exposed
  • Names
  • User IDs
  • Usernames
  • Email addresses
  • Email verification status
  • Time zone
  • Country
  • Date joined
  • Last login and active dates
Affected Records
1,079,819 students, teachers, staff, and parents/guardians
Operational Impact
Mathspace took its Metabase instance offline, revoked API keys, disabled database access accounts, changed passwords, and exported logs for investigation. It reported that no academic records, learning activities, results, assessment records, password hashes, authentication tokens, SSO credentials, API credentials, or records linking user accounts to schools were exposed.
Ransom Or Extortion
ShinyHunters claimed responsibility for hacking Metabase. The article does not report a ransom demand or payment.
Claim Status
confirmed

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe attackers exploited a known SQL injection vulnerability in Mathspace's self-hosted Metabase instance.

CVE

CVE-2026-72898The security defect, tracked as CVE-2026-72898 (CVSS score of 10/10) and described as an SQL injection issue, was patched on August 6, after it had been exploited in the wild as a zero-day.

Threat Actors

ShinyHuntersThe extortion group claimed responsibility for hacking Metabase shortly after patches were released; the article does not independently confirm the group's responsibility for the Mathspace breach.

Products

MetabaseThe incident, it says, was discovered last week, roughly three weeks after hackers compromised its self-hosted Metabase instance using a known vulnerability.

Countries

AustraliaThe data breach impacts 1,079,819 students, teachers, staff, and parents/guardians from Australia and New Zealand.New ZealandThe data breach impacts 1,079,819 students, teachers, staff, and parents/guardians from Australia and New Zealand.

Related Articles