Australian maths learning platform Mathspace has confirmed that unauthorised parties accessed an internal reporting system and downloaded personal data belonging to 1,079,819 students, parents or guardians, school staff and Mathspace employees across Australia and New Zealand. The company confirmed the intrusion on 3 September 2026 and published a disclosure notice on its blog, last updated 6 September, attributing the incident to an unpatched, self-hosted installation of Metabase, the business intelligence tool it uses for internal reporting. All eight reviewed sources, including ABC News and Cyber Daily, cite the same figure of 1,079,819 affected people, so there is no meaningful dispute over scale. Mathspace says it does not know who is responsible, and states it has no evidence so far that the data has been published, distributed, sold or otherwise misused.
What Happened
The timeline Mathspace publishes is unusually granular for a breach disclosure of this size, and the outlet reporting tracks it closely.
Metabase published a critical security advisory and patched versions on 6 August 2026. Mathspace says its existing vulnerability-notification process did not identify and escalate that advisory for action, leaving its self-hosted instance exposed. Unauthorised access to that instance began on 10 August, Australian Eastern Standard Time. On 27 August, the attacker downloaded information from Mathspace's Australian reporting database. Mathspace updated its Metabase instance on 29 August, after seeing a subsequent notice, meaning the patch landed two days after the data was already gone.
The critical gap is what happened at patch time. Mathspace acknowledges that it did not complete the additional compromise checks recommended for potentially affected systems when it applied the update. As a result, the intrusion went undetected for a further five days until a historical log review on 3 September confirmed unauthorised access that predated the patch. ABC News reports the attacker window as 10 to 27 August, consistent with the company's own account.
One point where accounts differ: ABC News reports that the compromised reporting system has been taken offline, while kobaran.com states more broadly that "Mathspace has taken its platform offline while remediation continues." The company's own notice and the security press describe containment as scoped to the internal reporting system, and that is the reading defenders should work from. Mathspace began sending breach notifications to school contacts on 4 September and says it has notified regulators in both Australia and New Zealand.
What Was Taken
The exported dataset is broader than the headline "names and email addresses" framing suggests. Per Mathspace's disclosure and corroborating coverage in The Cyber Express and ABC News, the exported fields included:
- User IDs and usernames
- First names and last names
- Email addresses
- Country and time zone
- User type (student, parent or guardian, school staff, Mathspace staff)
- Email-verification status
- Last-active date, last-login date and joining date
Mathspace notes that not every field appeared for every affected person. Critically, the company states that customer passwords, single sign-on (SSO) tokens and other customer authentication credentials were not exposed. That claim comes from the victim's own investigation and has not been independently verified by a third party at time of writing.
The sensitivity here is not credential loss. It is the population. A verified, deduplicated list of over a million identities in Australian and New Zealand schools, segmented by user type and enriched with activity recency, is an unusually well-structured targeting dataset. The user-type field alone lets an attacker separate children from the adults with financial and administrative authority over them.
Why It Matters
Education platforms sit on data belonging to people who never chose the vendor and often cannot meaningfully consent to how it is held. Students in this dataset may be minors whose email addresses and school affiliations are now circulating outside any system they control, with a data lifetime measured in decades rather than the months a stolen payment card stays useful.
The second-order risk is phishing, and Mathspace appears to understand this. Its notice explicitly warns that while the incident is real, that fact "does not establish that every message referring to it is genuine," and directs recipients to verify through a dedicated address, [email protected], or through support channels reached by navigating to the Mathspace site directly rather than following links. That is the correct instinct: a breach dataset containing verified email addresses, real names and the name of the affected service is precisely the raw material for a convincing follow-on campaign aimed at parents and school administrators.
UNDERCODE NEWS reports that Have I Been Pwned founder Troy Hunt highlighted the disclosure on 6 September as an example of urgency and transparency not often seen. That commentary appears in a single lower-tier source and should be treated as attributed opinion rather than established fact. The substance is nonetheless assessable from the primary notice itself: Mathspace published the vulnerable component by name, the exact access window, the specific field list, and an admission that its own process failed twice, at advisory triage and at post-patch compromise assessment. Vendors rarely publish the second admission.
The Attack Technique
The vector is a self-hosted, internet-reachable Metabase instance running a version vulnerable to a flaw addressed in the vendor's 6 August 2026 critical advisory. Both Mathspace and The Cyber Express describe the vulnerability as permitting administrator access to the reporting system without a legitimate login, that is, a pre-authentication path to full administrative control.
Once inside, the attacker did not need to escalate laterally or break encryption. Metabase is a business intelligence front end wired directly into production reporting databases by design. Administrator access to the tool inherits the tool's own database connectivity, and the export functionality that makes Metabase useful to analysts is the same functionality that produced a structured dump of the Australian reporting database on 27 August. This is living off the trusted tooling, not malware.
Two process failures turned a 23-day patch delay into a month-long undetected compromise: the advisory never reached anyone with authority to act, and the eventual patching was treated as remediation complete rather than as the trigger for a compromise assessment. The exploitation window between 6 August disclosure and 10 August first access was four days, which is a realistic assumption for any internet-facing BI, ticketing or admin tool with a public critical advisory.
What Organizations Should Do
- Inventory every self-hosted BI and internal admin tool and confirm its patch level now. Metabase, Grafana, Superset, Jenkins, Confluence and similar internal tools are routinely excluded from the patch cadence applied to customer-facing production. Check version against the vendor's current advisories today, not at the next cycle.
- Fix advisory triage as a named, owned process. Mathspace's root cause was that a vendor advisory arrived and no one escalated it. Subscribe to advisory feeds for every self-hosted component, route them to a named owner with a defined SLA for critical severity, and audit that the routing actually delivers rather than assuming it does.
- Treat patching a possibly exposed system as the start of an investigation, not the end. Mathspace explicitly admits skipping the compromise checks Metabase recommended at update time, and that omission cost five additional days of exposure. When you patch a pre-auth RCE or auth-bypass on an internet-reachable box, immediately pull authentication logs, query logs and export or download history covering the full window from public disclosure to patch.
- Remove internal tooling from the public internet. A reporting console used by internal staff has no reason to accept connections from arbitrary IPs. Put it behind SSO with an identity-aware proxy or VPN so that a pre-authentication vulnerability in the application is not directly reachable by an unauthenticated attacker.
- Constrain what BI tools can read and log what they export. Grant the reporting service account read access to reporting views rather than full production tables, and alert on bulk export or unusually large query result volumes. A million-record download from a reporting console should generate an alert on the day it happens, not seven days later in a retrospective log review.
- Pre-plan breach communications for the phishing wave. Publish a single verification channel, tell recipients to reach it by navigating to your site rather than clicking, and brief schools and downstream partners that lookalike notification emails are the predictable next step. Mathspace's dedicated response address is a reusable pattern.
- Push your edtech and SaaS suppliers on their own self-hosted dependencies. Vendor questionnaires that cover the supplier's primary application often miss the internal analytics stack sitting behind it, which is exactly where this breach originated.
Sources: More than 1 million users affected in Mathspace data breach across... | Breached! Tutoring platform Mathspace says 1m-plus Aussies implicat... | Mathspace data breach: what happened and what affected users should... | Mathspace Data Breach Affects 1.07M Users: What Happened | Mathspace Data Breach Exposes Info of Over 1 Million Students, Pare... | Mathspace: Over a million Aussies' data stolen in major hack to lea... | More than 1 million users affected in Mathspace data breach - Gener... | Mathspace Data Breach Exposes More Than 1 Million Records as Transp...