Mathspace Confirms Data Breach Affecting 1,079,819 People

Summary

Mathspace said attackers exploited a vulnerability in its self-hosted Metabase system and stole personal data affecting 1,079,819 people in Australia and New Zealand. The company said passwords and other credentials were not exposed.

Key points

Mathspace said attackers exploited a vulnerability in its self-hosted Metabase reporting system to gain administrator access without a legitimate login.
The attackers accessed the system on August 10, 2026, downloaded data on August 27, and the breach was confirmed on September 3.
Mathspace reported that 1,079,819 students, staff, parents, and guardians in Australia and New Zealand were affected.
The exposed information did not include academic records, passwords, authentication tokens, SSO credentials, or API credentials.
Mathspace warned affected people to watch for suspicious account-related activity, including account-detail changes and password-reset messages.
The article links the Metabase intrusions to a wider campaign associated with ShinyHunters and reports breaches at Trezor, Framework, and Tally.

Article Details

Victim Organization: Mathspace
Incident Type: Unauthorized access to a self-hosted Metabase internal reporting system, followed by theft of personal data
Incident Date: 2026-08-10
Data Types Exposed: Personal information of students, school staff, parents, and guardians
Affected Records: 1,079,819 people
Operational Impact: Attackers gained administrator access to the internal reporting system and downloaded data from Mathspace’s Australian reporting database. No system outage was reported.
Ransom Or Extortion: No ransom or extortion activity involving Mathspace was reported.
Claim Status: confirmed