Egidio

The Threat Laboratory → Mathspace

Case file · 9 September 2026

Mathspace: 1.08 million accounts exposed, no academic records taken

Mathspace confirms 1,079,819 accounts exposed across Australia and New Zealand, via a flaw in its reporting tool. No passwords, academic records or school links were included — Mathspace says so directly. Confirmed by the company itself.

Protect my phone with Egidio Free for calls · 100% on your phone · no account needed
✅ Confirmed by Mathspace itself. This is not a hacker claim — the company disclosed it directly, with an official statement. What matters most here is what was not taken, and Mathspace says so explicitly.

The numbers

1,079,819
Students, teachers, staff and parents/guardians affected across Australia and New Zealand.
ABC News, 7 September 2026. Accessed 09/09/2026.
Aug 10–27
Window of unauthorised access before Mathspace confirmed the theft on 3 September — over three weeks unnoticed.
BleepingComputer, 8 September 2026.
0
Passwords, academic records, learning activities, results or assessment records exposed, per Mathspace's own statement.
ABC News, quoting the Mathspace disclosure.
0
Records linking a student's account to their specific school were included in the exposed data.
ABC News, 7 September 2026.

What actually happened

Attackers exploited an unauthenticated SQL injection in Metabase, the analytics tool behind Mathspace's internal reporting system — the same class of flaw ( CVE-2026-72898) that hit a crypto hardware wallet vendor's fulfilment partner the same week. A vendor patch existed; BleepingComputer reports it "had not been installed" when the access window opened.

Timeline

CONFIRMED
10–27 August 2026
Threat actors access Mathspace's Australian reporting database through an unpatched Metabase instance and download data on 27 August.
CONFIRMED
3 September 2026
Mathspace confirms the data theft internally.
CONFIRMED
7 September 2026
Mathspace discloses publicly. Official statement : "We're truly sorry this happened and are taking steps to prevent similar breaches in the future. Protecting the information entrusted to us by students, families and schools is our responsibility."

🎒What was actually exposed

User IDs, usernames, first and last names, email addresses, country, time zone, user type, email verification status, and account activity dates. Names and email addresses are enough to build a convincing scam message that references a real learning platform a family actually uses — even without a single password or grade being touched.

ABC News, BleepingComputer, 7-8 September 2026.
🔒 If your child uses Mathspace at school. No password reset is required — none were exposed. Treat any email or message that references Mathspace, a school account or a maths result as unverified if it asks for a login, a payment, or a click to "secure your account".

Frequently asked questions

Is the Mathspace breach confirmed?

Yes. Mathspace disclosed it directly with an official statement — this is not a hacker claim.

Were passwords or grades exposed?

No. Mathspace states explicitly that no passwords, academic records, learning activities or assessment records were taken.

Can the data be linked back to a specific school?

No. The exposed data did not include records linking user accounts to their schools.

📌 Last checked: 9 September 2026. Verifiable correction: contact@egidio.app.

Read next

Australian data breaches: what the OAIC records Back to the Threat Laboratory All our sources
Cite this page Egidio — Threat Laboratory, « Mathspace: 1.08 million accounts exposed, no academic records taken », egidio.app/en-au/laboratoire/mathspace-metabase-breach/. CC BY 4.0.

Free to reuse, including commercially, with attribution. Reuse terms.

Sources. ABC News, BleepingComputer and SecurityWeek, 7-8 September 2026, all citing Mathspace's own disclosure. Checked 09/09/2026.