Contained High impact Data breach Checked 23h ago

Mathspace breach exposes 1 million student records

Mathspace said attackers used an unpatched Metabase flaw to download personal data on 1,079,819 students, parents, guardians, teachers and staff in Australia and New Zealand. The affected reporting system was taken offline, while lessons and assignments remained available. Passwords and login credentials were not exposed.

Started
Sep 3, 2026
Latest activity
Sep 10, 2026
Attributed to
Not confirmedNo credible attribution yet
Where
Australia, New Zealand
Sectors
Education
Scale
more than 1 million students, parents, guardians and school staff

Current status

On September 8, Mathspace said the affected reporting system was offline and its learning service remained available; September 10 reporting added no evidence of publication or misuse.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Impact

Attackers accessed an internal Metabase reporting system and downloaded names, email addresses and account details for 1,079,819 users. Passwords, SSO tokens, academic records and other authentication credentials were not taken. No misuse of the data has been confirmed.

What to do

Affected users should watch for phishing emails that use their real name or school. Do not share passwords or verification codes, and use unique passwords for other accounts.

Timeline

  1. Sep 10, 2026

    Information Age reported that Mathspace had not identified any new misuse or publication of the stolen data. It said the company had not disclosed how many of its school clients were affected.

    Containedia.acs.org.au
  2. Sep 8, 2026

    iTnews reported that Mathspace patched its Metabase system on August 29 and notified the Australian and New Zealand privacy and cyber authorities. The attacker remained unknown.

    Containeditnews.com.au
  3. Sep 8, 2026

    Help Net Security reported that Mathspace took the affected internal reporting system offline and said users could continue lessons and assignments. The company still had no evidence that the data had been published, sold or misused.

    Containedhelpnetsecurity.com
  4. Sep 4, 2026

    BleepingComputer reported the stolen data covered students, staff and parents, with no evidence of public leak or sale.

    Containedbleepingcomputer.com
  5. Sep 3, 2026

    Mathspace confirmed a data breach affecting 1,079,819 people after attackers accessed its internal Metabase reporting system.

    Containedthecyberexpress.com

Sources

Related reports