Mathspace, a mathematics learning platform used by schools in Australia and New Zealand, has disclosed a data breach affecting 1,079,819 students, parents or guardians, teachers, and employees.
The incident stemmed from the exploitation of a critical vulnerability in a self-hosted Metabase reporting deployment, which gave an attacker administrator-level access without legitimate credentials.
Mathspace said it confirmed the intrusion on September 3 after reviewing access logs. The company determined that unauthorized access began on August 10, Australian Eastern Standard Time, and that data was exported from its Australian reporting database on August 27.
Hackers Exploit Metabase Flaw
The breach followed Metabase’s publication of a critical security advisory and the release of patched versions on August 6. Mathspace acknowledged that its vulnerability-notification process did not identify and escalate the advisory.
It updated the Metabase instance on August 29 after learning of a subsequent notice, but did not complete compromise checks recommended for potentially affected environments. Subsequent log analysis established that the attacker had accessed the system before the patch was applied.
The exposed export contained user IDs, usernames, first and last names, email addresses, country and time zone data, user types, email verification status, and account metadata, including last active, last login, and account creation dates.
The affected database held both current and former users, meaning people who left a school or stopped using Mathspace may still be included.
Mathspace said academic records, learning activity, assessment results, passwords or password hashes, SSO tokens, other authentication credentials, and API credentials were not exposed.
The data also did not directly map accounts to schools. However, email domains can make school affiliation inferable, increasing the value of the records to phishers.
The combination of names, school-associated email addresses, internal account identifiers, and activity information creates a social-engineering risk.
Attackers could craft convincing breach notifications, password reset lures, or messages impersonating school administrators or education platforms.
Users should independently verify any message through official channels, avoid unsolicited links and attachments, never disclose passwords or verification codes, and replace reused passwords with unique credentials.
For containment, Mathspace took Metabase offline, revoked all Metabase API keys, disabled Metabase database-access accounts in its Australian and US Snowflake environments, and changed passwords for the Metabase Cloud SQL databases.
It also preserved the Metabase application database and exported access logs for forensic work. The reporting system will remain offline while the company removes unauthorized accounts and sessions and validates recovery conditions.
Mathspace began notifying school contacts on September 4 and affected individuals on September 6. It reported the incident to Australia’s OAIC and ASD’s ACSC, New Zealand’s privacy and cyber-security authorities, and Australian education departments.
The attacker’s identity remains unknown, and Mathspace says it has no evidence that the data has been published, sold, distributed, or otherwise misused.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
