Mathspace discloses data breach affecting over 1 million people
Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.
Mathspace confirmed attackers exploited a vulnerability in its self-hosted Metabase reporting system, gaining administrator access without legitimate login and downloading data on over 1 million people (1,079,819 total) in Australia and New Zealand. Access began August 10, data was downloaded August 27, and the theft was confirmed September 3, 2026. No credentials, academic records, or school-account links were exposed, but affected individuals are warned of targeted phishing. The incident joins a broader campaign against Metabase instances, including Trezor's provider ShipMonk, Framework, and Tally, linked to ShinyHunters via extortion emails and leak-site listings.
- 1,079,819 students, parents, guardians, and staff affected, all in Australia and New Zealand
- Attackers abused a Metabase flaw for admin access; exfiltration on August 27, confirmed September 3
- No passwords, tokens, or academic records stolen, but phishing risk remains
- Part of a wider Metabase campaign including Trezor, Framework, and Tally
- ShinyHunters extortion gang linked to the broader Metabase breach campaign
- Vendors
- Metabase
- Products
- Metabase
- Threat actors
- ShinyHunters
- Victims
- Mathspace
- Countries
- AustraliaNew Zealand
From the original article
3 min read at bleepingcomputer.com
Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.