Mathspace: Unpatched Metabase Flaw Exposes 1.08M Students, Parents and Staff

Mathspace is a Sydney-based online maths learning platform used by schools in Australia and New Zealand. It has confirmed that attackers stole personal data on 1,079,819 people from an internal reporting system. Those affected include students, parents or guardians, school staff and Mathspace's own employees. The company's incident notice, written by founder and CTO Alvin Savoy, says the attackers got administrator access to a self-hosted Metabase instance that had not been patched. The attackers were in the system from 10 August to 27 August 2026. Every source uses the same figure of 1,079,819 people, and the company says only people in Australia and New Zealand were affected. Mathspace says it does not know who the attacker is and has "no evidence so far" that the data has been published, sold or misused.

What Happened

Mathspace's timeline, as given in its own notice and reported by BleepingComputer, SecurityWeek and iTnews:

• ~6 to 7 August: Metabase released a fix for a critical flaw. SecurityWeek says it was patched on 6 August after being exploited as a zero-day. iTnews says Metabase issued its advisory on 7 August. The one-day gap may come from time zones or from a separate patch and advisory date.
• 10 August (AEST): The earliest unauthorised access to Mathspace's Metabase instance.
• 27 August: Data was downloaded from Mathspace's Australian reporting database.
• 29 August: Mathspace upgraded its instance after a later Metabase notice came to its attention. By then the attackers had already been in for more than two weeks.
• 3 September: Mathspace confirmed the breach.
• 4 September: Mathspace began notifying school contacts.
• 5 September: Mathspace published its public notice. It updated the notice on 8 September and says it has now finished scoping the exposure.

Secondary accounts give slightly different disclosure dates. Shattered.io says the notice was published on 3 September and last updated on 6 September. The company's own post is dated 5 September and updated 8 September, and this brief uses the company's dates.

Savoy said Mathspace's "existing vulnerability-notification process did not identify and escalate that advisory for action." SecurityWeek adds that the company also did not complete the compromise checks Metabase recommended, so it missed the intrusion when it applied the update. Mathspace says it is investigating both failures and changing both processes.

Containment steps reported by SecurityWeek: - taking Metabase offline - revoking API keys - disabling database access accounts - rotating passwords - exporting logs for forensic review

According to iTnews, Mathspace has notified Australia's OAIC and ACSC. In New Zealand, the Ministry of Education told The Post that Mathspace has notified the Office of the Privacy Commissioner and the National Cyber Security Centre. The Ministry also said it does not know how many New Zealand schools or students are affected. Mathspace is not a Ministry-procured product, so the Ministry keeps no central record of which schools use it. When Information Age asked whether Mathspace had received a ransom demand, the company pointed to its blog post and did not answer the question.

What Was Taken

Mathspace and the outlets covering the breach agree on the data fields that were exported:

• user IDs and usernames
• first and last names
• email addresses and email-verification status
• country and time zone
• user type (student, staff, parent or guardian)
• date joined, last-login date and last-active date

The company says not every field was held for every person. It says no academic records, learning activities, results, assessment records, password hashes, authentication tokens, SSO credentials or API credentials were exposed.

The stolen records do not directly link accounts to schools. However, Mathspace warned that in some cases accounts could be linked to a school through identifiable email addresses, such as school-domain student emails. BleepingComputer and Information Age both reported this warning.

The fields themselves are low-sensitivity, but many of the people affected are children. A verified email address combined with a real name, user type and school affiliation is enough for convincing targeted phishing.

Why It Matters

Education platforms are soft targets. Mathspace says it served about 3,400 Australian schools and about 3,500 overseas, based on its 2023 figures cited by BleepingComputer. Individual schools adopt tools like this, sometimes without procurement oversight. The New Zealand Ministry's admission that it cannot even count the affected schools shows how little visibility education authorities have into edtech vendors.

Reporting tools hold everything. BI platforms such as Metabase are built to query production data broadly. Once an attacker has admin access to one, they can reach across the user base without touching the main application at all.

This is part of a wider campaign. SecurityWeek reports that ShinyHunters claimed responsibility for attacks on Metabase instances shortly after the patch was released. iTnews names Framework, Anaconda and others among the victims. No source attributes the Mathspace intrusion to ShinyHunters, and Mathspace says the attacker is still unknown. Defenders should still treat Mathspace as one victim of mass exploitation rather than a targeted one-off.

Phishing will follow. Mathspace has already warned that knowing the incident is real does not make every message about it genuine. Expect fake breach notifications aimed at parents and school staff.

The Attack Technique

The attackers exploited a critical flaw in Metabase's self-hosted edition. SecurityWeek tracks it as CVE-2026-72898 (CVSS 10.0). iTnews describes it as an SQL injection in the /api/session/reset_password endpoint. It lets an unauthenticated remote attacker gain administrator access to a Metabase instance, and it affects versions x.58.0 through x.63.0. SecurityWeek reports that it was exploited in the wild before a fix existed.

With admin access, the attackers could use Metabase's own database connections to query Mathspace's Australian reporting database and export user records. They did not need to compromise the main learning platform. The main failure was operational: the patch had been out for about three weeks before Mathspace applied it, and no one checked for compromise afterwards.

What Organizations Should Do

1. Patch Metabase now and check for compromise. Upgrade any self-hosted Metabase instance out of the affected range. Then run the vendor's recommended compromise checks, because patching does not remove an attacker who is already in. Review /api/session/reset_password requests and admin account activity from early August onward.
2. Take BI tools off the internet. Put Metabase, Superset, Redash and similar tools behind SSO or VPN, or an identity-aware proxy. No internal reporting tool should have an unauthenticated endpoint reachable from the internet.
3. Give reporting tools least-privilege access. Connect BI tools through read-only accounts limited to the tables and columns they need. Use pseudonymised or aggregated datasets instead of raw user tables where you can.
4. Make sure vendor advisories reach someone who acts on them. Keep an inventory of every self-hosted third-party tool. Subscribe to its security channels and route critical advisories into your ticketing system with a patch deadline. Mathspace's failure was an advisory that nobody escalated.
5. Schools: check your vendors and warn families. Find out which edtech platforms students actually use, including ones they signed up to themselves. Tell parents and staff to verify breach-related emails by contacting the vendor directly (for Mathspace, [email protected]) and not to click links.
6. Alert on bulk exports. Monitor BI and database layers for unusually large queries or downloads. Mathspace's data left weeks after the first access, which was time a detection could have been triggered.

Sources: Mathspace Data Breach: 1.08M Students, Staff Hit 2026 | Mathspace discloses data breach affecting over 1 million people | More than 1 million users affected in Mathspace data breach | Mathspace Data Breach Exposes Over 1 Million People - SecurityWeek | Late patching of Metabase SQLi bug claims Sydney's Mathspace - iTnews | Mathspace data breach: what happened and what affected ... | More than 1m caught in Mathspace data breach Information Age ACS | Ministry does not know how many New Zealand schools were affected b...