Mathspace Data Breach Exposes Over 1 Million People
Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.
Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.
- 1,079,819 individuals affected across Australia and New Zealand.
- Intrusion exploited Metabase CVE-2026-72898, a CVSS 10 SQL injection zero-day exploited in the wild.
- ShinyHunters claimed responsibility for hacking Metabase instances.
- Data exposed: names, user IDs, emails, login dates; no passwords, tokens, or academic records.
- Mathspace delayed patching to August 29 and skipped recommended compromise checks.
- CVEs
- CVE-2026-72898
- Threat actors
- ShinyHunters
- Victims
- Mathspace users
- Countries
- AustraliaNew Zealand
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-72898 | Unauthenticated SQL Injection in Metabase Grants Admin Access | 10.0 | 99% | KEVPoC ×3 | KEV |
From the original article
2 min read at securityweek.com
Hackers stole the information of students, teachers, staff, and parents/guardians from a self-hosted Metabase instance. The post Mathspace Data Breach Exposes Over 1 Million People appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.