Mathspace breach exposes data on more than 1 million students, parents and staff
Attackers exploited a flaw in the maths platform's internal reporting tool, part of a wider campaign tied to the ShinyHunters extortion crew.
Key points
- Mathspace confirmed on 3 September 2026 that attackers stole data on 1,079,819 students, parents or guardians, and staff in Australia and New Zealand.
- Attackers got in on 10 August and copied the Australian reporting database on 27 August.
- The break-in used a flaw in Metabase, a self-hosted reporting tool inside Mathspace's network.
- No passwords, academic records, learning results or login tokens were taken.
- ShinyHunters has claimed the broader Metabase campaign, with Framework, Tally and Trezor's logistics provider also confirmed as victims.
Sydney-based Mathspace, an online maths learning platform serving thousands of schools across Australia, New Zealand and two other English-speaking markets, told customers over the weekend that criminals had broken into an internal reporting system and taken personal information on more than a million people.
In a blog post on Saturday, chief technology officer Alvin Savoy said intruders reached the data through a flaw in Metabase, reporting software the company runs on its own servers. The vulnerability let attackers give themselves administrator access without a legitimate login.
All 1,079,819 affected people are in Australia or New Zealand.
What was actually stolen?
Contact-style personal details, not schoolwork or credentials. Mathspace says no academic records, learning activity, test results, password hashes (scrambled versions of passwords), authentication tokens or single sign-on credentials were exposed.
One caveat matters for schools. Stolen records don't name a child's school directly, but where a school uses an obvious email domain, someone reading the data could work out the link.
How did the hackers get in?
Through a known critical flaw in Mathspace's self-hosted Metabase installation. Metabase is business-intelligence software: staff use it to build internal dashboards from company data. The flaw is an SQL injection zero-day, meaning a database-query vulnerability the vendor didn't know about when attacks began, that lets an outsider gain admin rights on the Metabase server. Once in, the attackers could query connected databases and pull the results down.
Timeline of the Mathspace incident
| Date | Event |
|---|---|
| 10 August 2026 | Attackers gain access to Mathspace systems |
| 27 August 2026 | Australian reporting database downloaded |
| 3 September 2026 | Mathspace confirms unauthorised access |
| Weekend of disclosure | Public notice published by CTO Alvin Savoy |
Should parents and school staff be worried?
Be alert, not panicked. Mathspace warns affected people that criminals may use the stolen details against them. Watch for password-reset emails you didn't request, messages saying your account details have changed, and unexpected contact referencing your child's school or the Mathspace service. If a message pushes you to click a link or hand over a code, treat it as suspect and go to the service directly instead.
Who is behind the wider campaign?
ShinyHunters, a long-running extortion group that steals corporate data and pressures companies to pay to stop it being leaked or sold. The gang added Metabase to its dark-web leak site on 11 August. As first reported by BleepingComputer, it has sent extortion emails in related cases.
Trezor initially put its exposure at nearly 14,000 customers on 13 August after attackers hit its shipping and logistics provider ShipMonk, then revised that figure to 81,000 last Friday. Framework and Tally have also confirmed breaches tied to hijacked Metabase servers.
ShinyHunters has been linked to intrusions at more than a dozen Snowflake customers, campaigns hitting hundreds of Salesforce tenants, and over 100 companies breached through an Oracle PeopleSoft zero-day. Threat Vectr covered the gang's extortion of McKesson on 28 August and its Carhartt dump on 27 August, where it walked away from a $3.3 million demand and published 12.9 million records. No ransom figure has been reported for Mathspace, and the company hasn't said whether it's been contacted for payment.
For schools, the practical risk here isn't the breach itself but what comes next. A million contact records, tied even loosely to children and education, are exactly the raw material phishing campaigns run on.
