Mathspace Data Breach Affects More Than One Million Users

Mathspace says attackers exploited a security vulnerability in its self-hosted installation of Metabase, software used for internal reporting. Metabase published a critical advisory and patched versions on 6 August, but Mathspace says its notification process did not escalate the advisory and the installation was not updated until 29 August.

The company's investigation identified unauthorised access from 10 August and confirmed that information was downloaded from its Australian reporting database on 27 August. Mathspace discovered the earlier access during a later log review and says it did not complete the additional compromise checks recommended for potentially affected systems when it first updated the software.

Mathspace says 1,079,819 students, school staff, parents or guardians and company staff were affected in Australia and New Zealand. Exported fields included user IDs, usernames, names, email addresses, country, time zone, user type, email-verification status, last-active date, last-login date and account-creation date, although not every field was present for every person.

The company says academic records, learning activity, results, assessments, password hashes, authentication tokens, single-sign-on credentials and API credentials were not exposed. It also says the exported records did not directly link users to schools, although an identifiable school email domain may allow that connection to be inferred.

Mathspace began notifying school contacts on 4 September and affected individuals on 6 September. Verify any message independently by navigating to the company's site yourself or starting a new message to the incident address published on its official notice. Do not trust a link or attachment merely because it uses a real name, school reference or breach detail.

Watch for unexpected sign-in prompts, password-reset messages and requests for verification codes. Use a unique password for every service and change reused passwords, even though Mathspace says its password hashes were not in the exported data. Students who are unsure should involve a parent, guardian or teacher rather than responding alone.

A reputable VPN can encrypt supported traffic on an untrusted local network and reduce IP-based visibility while a user visits the genuine service. An organisation may also use a controlled administrative VPN to limit public access to internal systems, but that architecture must still be patched and monitored.

A consumer VPN cannot patch Mathspace's reporting software, prevent a flaw inside the provider's system, retrieve exported records or identify a genuine breach email. Software inventory, prompt patching, compromise checks, secure notifications and independent message verification address this incident more directly.

This incident shows why installing a security update and checking for earlier compromise are separate jobs. A vulnerable system can be patched after attackers have already entered, so organisations need escalation processes, preserved logs and a clear investigation plan.

For families, the immediate risk is not evidence that every account has been taken over. It is that real names, email addresses and account context can make impersonation more credible. Verify the channel first, then act on confirmed account evidence rather than pressure in an incoming message.