Mathspace Breach Exposes Data of Over 1 Million Students, Parents and Teachers

Mathspace, an online maths learning platform used in schools across Australia and New Zealand, has confirmed a data breach affecting 1,079,819 people, including students, parents, guardians, teachers and staff. The company said attackers exploited a vulnerability in Metabase, an internal reporting tool it self-hosts, gaining administrator access as early as 10 August and downloading data on 27 August. Mathspace confirmed the incident publicly on 3 September.

Exposed information included names, usernames, email addresses and account details. Mathspace said no academic records, passwords, authentication tokens or single sign-on credentials were affected, and it has found no evidence the stolen data has been published or sold.

Security experts say the breach highlights a common weak point: internal systems such as reporting tools and dashboards are often not patched or secured as tightly as customer-facing systems. Keeper Security's Takanori Nishiyama pointed to industry research showing vulnerability exploitation is now the leading cause of breaches, and warned that exposed children's data can be especially damaging because fraud using a minor's identity can go undetected for years.