Mathspace Data Breach Exposes Personal Data of Over 1 Million Students, Parents and Staff

Mathspace, an online mathematics learning platform used by schools in Australia and New Zealand, has reported a data breach affecting 1,079,819 students, parents or guardians, teachers, and staff members.

The company stated that attackers exploited a critical vulnerability in its self-hosted Metabase reporting environment, allowing them to gain administrator-level access without legitimate credentials.

Mathspace Data Breach

Mathspace confirmed the incident on September 3 after reviewing historical access logs. The investigation revealed that unauthorized access began on August 10, Australian Eastern Standard Time, and that data was downloaded from its Australian reporting database on August 27.

The identity of the threat actor remains unknown, and Mathspace indicated that there is no evidence that the data has been published, sold, distributed, or otherwise misused.

This data compromise occurred shortly after a critical advisory for Metabase was issued on August 6. Mathspace acknowledged that its vulnerability-notification process failed to identify and escalate this advisory.

Although the organization updated Metabase on August 29 after becoming aware of a subsequent notice, it did not perform the additional compromise checks that were recommended for potentially affected instances. Later log reviews confirmed that intruders had accessed the system before the patch was installed.

The exported dataset included user IDs, usernames, first and last names, email addresses, country and time zone information, user types, email verification status, and metadata regarding account activity, such as last active, last login, and account creation dates.

The records included both active and former users, meaning that an individual’s departure from a school or discontinuation of Mathspace use does not necessarily remove them from the affected population.

Mathspace emphasized that the incident did not expose academic records, learning activities, assessment results, passwords or password hashes, single sign-on (SSO) tokens, API credentials, or data that directly links accounts to schools. However, identifiable school email domains could lead criminals to infer a user’s school affiliation.

The combination of names, email addresses, internal identifiers, and account details could facilitate highly credible phishing, impersonation, password reset, and social engineering attacks targeting school communities.

In response to the breach, Mathspace took the affected Metabase instance offline, revoked all Metabase API keys, disabled database access accounts across its Australian and US Snowflake environments, and changed credentials for Metabase Cloud SQL databases.

The company also preserved the application database and access logs for forensic investigation. Metabase will remain offline while Mathspace removes unauthorized accounts and sessions and validates conditions for a safe restoration.

Mathspace began notifying school contacts on September 4 and started informing affected individuals on September 6. The breach has been reported to Australia’s Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Center (ACSC), New Zealand’s privacy and cybersecurity authorities, as well as Australian education departments.

Affected users should independently verify any breach-related messages, avoid unsolicited links or attachments, never share passwords or verification codes, and use unique passwords across different services. Schools can seek secure assistance as needed.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.