Search: “Metabase”

7 stories in the last 30d

Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Mathspace confirmed attackers exploited a vulnerability in its self-hosted Metabase reporting system, gaining administrator access without legitimate login and downloading data on over 1 million people (1,079,819 total) in Australia and New Zealand. Access began August 10, data was downloaded August 27, and the theft was confirmed September 3, 2026. No credentials, academic records, or school-account links were exposed, but affected individuals are warned of targeted phishing. The incident joins a broader campaign against Metabase instances, including Trezor's provider ShipMonk, Framework, and Tally, linked to ShinyHunters via extortion emails and leak-site listings.

BleepingComputerSep 7, 13:05 UTC · 9d agoData breach in the wild

Mathspace Data Breach Exposes Over 1 Million People

Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.

Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.

SecurityWeekSep 8, 10:47 UTC · 9d agoData breach in the wildCVE-2026-72898

Mathspace breach exposes data on over a million students and parents

Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.

Help Net SecuritySep 8, 08:45 UTC · 9d agoData breach in the wild

Trezor data breach impact now reaches 81,000 customers

Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.

Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.

BleepingComputerSep 7, 12:16 UTC · 9d agoData breach in the wild

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.

Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.

The Hacker NewsSep 5, 14:17 UTC · 11d agoData breach in the wildCVE-2026-72898

Trezor warns users of email provider breach, phishing attacks

Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.

Trezor warned customers that threat actors breached its third-party email provider and sent fake 'Critical Security Alert: STM32 Entropy Vulnerability' emails from [email protected], claiming wallet seeds were exposed to brute-force attacks; the phishing domain has been taken down while Trezor investigates. This follows the ShipMonk breach, revised upward from about 14,000 to 81,000 customers (including 67,000 additional US customers) who received orders between May 10 and August 8, 2026. Attackers reportedly exploited a Metabase SQL injection zero-day to access ShipMonk data, and ShinyHunters sent extortion emails.

BleepingComputerSep 10, 06:56 UTC · 7d agoData breach in the wild

Trezor customers hit with phishing calls and letters after shipping-partner breach

A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.

SatoshiLabs, maker of Trezor hardware wallets, confirmed the August 2026 ShipMonk breach exposed names, emails, phone numbers, and shipping addresses for roughly 67,000 US customers who ordered between November 2019 and August 2021, on top of 3,889 customers affected initially. ShipMonk attributed the intrusion to attackers exploiting an SQLi zero-day in Metabase's Cloud SaaS platform and retained data past the 90-day deletion requirement. Trezor's own systems were not compromised; customers are reporting phishing calls and QR-code phishing delivered via physical letters.

Help Net SecuritySep 8, 11:30 UTC · 8d agoData breach