Online maths learning platform Mathspace has disclosed a data breach affecting more than 1.07 million students, parents, guardians, and school staff. Attackers exploited a known vulnerability in Metabase — an open-source business intelligence tool that Mathspace runs internally for reporting — to gain administrator access without a valid login, then downloaded records from the company’s Australian database.
According to Mathspace CTO Alvin Savoy, attackers first accessed the compromised Metabase instance on August 10 and exfiltrated the data on August 27. The company confirmed the breach on September 3. A total of 1,079,819 people were affected, all of them in Australia or New Zealand. No passwords, authentication tokens, SSO credentials, academic records, or learning results were exposed. For schools with identifiable email domains, however, it may be possible to link some affected accounts to their schools. BleepingComputer reports that the ShinyHunters extortion gang — which recently hit Trezor’s shipping provider and several other companies via the same Metabase vulnerability — sent extortion emails to one of the firms involved in this campaign.
How to check if you’re affected
Affected products are any Mathspace accounts belonging to students, parents, guardians, or staff at schools in Australia or New Zealand. Mathspace says it is contacting affected individuals directly. If you or your child attends a school that uses Mathspace in those regions, treat any unexpected password-reset emails, account-change notifications, or messages claiming to be from Mathspace as potential phishing attempts and verify them by logging into the platform directly rather than clicking links in email.