Organization

Mathspace

0 mentions in 7 days · 3 in 30 days · 3 total · first seen Sep 7, 2026 · last 7d ago

Timeline3 articles

Mathspace Data Breach Exposes Over 1 Million People

Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.

Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.

SecurityWeekSep 8, 10:47 UTC · 7d agoData breach in the wildCVE-2026-72898

Mathspace discloses data breach affecting over 1 million people

Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Mathspace confirmed attackers exploited a vulnerability in its self-hosted Metabase reporting system, gaining administrator access without legitimate login and downloading data on over 1 million people (1,079,819 total) in Australia and New Zealand. Access began August 10, data was downloaded August 27, and the theft was confirmed September 3, 2026. No credentials, academic records, or school-account links were exposed, but affected individuals are warned of targeted phishing. The incident joins a broader campaign against Metabase instances, including Trezor's provider ShipMonk, Framework, and Tally, linked to ShinyHunters via extortion emails and leak-site listings.

BleepingComputerSep 7, 13:05 UTC · 8d agoData breach in the wild

Mathspace Breach Impacts More Than 1 Million Users in Australia, NZ

Mathspace confirmed a breach affecting 1,079,819 people in Australia and New Zealand after unauthorized parties downloaded user data from an internal system.

Mathspace confirmed on September 3, 2026 that a breach affected 1,079,819 people in Australia and New Zealand. Unauthorized parties accessed an internal reporting system and downloaded user information. Affected records involve students, parents or guardians, teachers, and Mathspace staff, including names and other data.

DataBreaches.netSep 7, 12:30 UTC · 8d agoData breach

Related CVEsby mentions

CVE-2026-7289810.094%
Unauthenticated SQL Injection in Metabase Grants Admin Access
CVE-2026-72898 is a critical SQL injection flaw (CWE-89, CVSS 4.0 score of 10) in Metabase, a widely used open-source business intelligence platform. A remote, unauthenticated attacker can send crafted input to the '/reset_password' database endpoint to inject arbitrary SQL into the underlying database. Successful exploitation grants the attacker administrator access to the connected Metabase instance, with confidentiality, integrity, and availability impacts rated high in the CVSS 4.0 vector. Any organization running an affected Metabase instance, particularly one exposed to the internet, is at risk. The flaw is a zero-day being exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11, and carries a 94.2% EPSS probability of exploitation within 30 days (100th percentile).
· Metabase KEV PoC large

Appears with

threat actor ShinyHunters 2 product Metabase 2 vendor Mathspace 2 vendor Metabase 2 victim Mathspace users 2 product Mathspace 1 victim Mathspace 1 organization Framework 1 organization Metabase 1 organization Tally 1 organization Trezor 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.