Mathspace breach exposes data on over a million students and parents
Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.
Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.
- 1,079,819 individuals affected across Australia and New Zealand
- Breach via unpatched self-hosted Metabase business intelligence instance
- No passwords, academic records, or authentication tokens exposed
- Same Metabase flaw hit Framework, Tally, and Kilo Code in August
- Vendors
- Metabase
- Products
- Metabase
- Victims
- Mathspace
- Countries
- AustraliaNew Zealand
From the original article
2 min read at helpnetsecurity.com
Mathspace has confirmed that attackers broke into its internal reporting system through an unpatched Metabase vulnerability and stole data belonging to more than a million students, parents, and school staff.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.