60
45
45
Mathspace Breach Impacts More Than 1 Million Users in Australia, NZ
Mathspace confirmed a breach affecting 1,079,819 people in Australia and New Zealand after unauthorized parties downloaded user data from an internal system.
Mathspace confirmed on September 3, 2026 that a breach affected 1,079,819 people in Australia and New Zealand. Unauthorized parties accessed an internal reporting system and downloaded user information. Affected records involve students, parents or guardians, teachers, and Mathspace staff, including names and other data.
42
57
45
57
57
60
60
57
57
45
Mathspace discloses data breach affecting over 1 million people
Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.
Mathspace confirmed attackers exploited a vulnerability in its self-hosted Metabase reporting system, gaining administrator access without legitimate login and downloading data on over 1 million people (1,079,819 total) in Australia and New Zealand. Access began August 10, data was downloaded August 27, and the theft was confirmed September 3, 2026. No credentials, academic records, or school-account links were exposed, but affected individuals are warned of targeted phishing. The incident joins a broader campaign against Metabase instances, including Trezor's provider ShipMonk, Framework, and Tally, linked to ShinyHunters via extortion emails and leak-site listings.
78
60
60
57
57
60
57
57
57
57
57
60
57
Mathspace breach exposes data on over a million students and parents
Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.
Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.
72
57
57
60
57
57
57
45
57
57
57
45
57
Mathspace Data Breach Exposes Over 1 Million People
Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.
Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.
68