Reported by 5 outlets

Timeline

1. original reporting

   Mathspace discloses data breach affecting over 1 million people

   bleepingcomputer.com · 36d ago · September 7th, 2026

   Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. Founded in Sydney in 2010, Mathspace is now used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom (3,432 in Australia and 3,557 abroad according to statistics reported by the company in 2023). In a Saturday blog post, Mathspace CTO Alvin Savoy said that unknown attackers gained access to the company's systems and stole personal information belonging to school staff and students, as well as their parents and guardians. "On 3 September 2026, we confirmed that unauthorised parties had accessed an internal reporting system used by Mathspace and downloaded information on students, their parents or guardians, and school staff. Mathspace staff records were also affected," Savoy said . "Attackers exploited a security vulnerability in our self-hosted installation of Metabase, software we use for internal reporting. The vulnerability allowed attackers to obtain administrator access to that system without a legitimate login." While the data theft was confirmed on September 3, the threat actors gained access to the compromised systems on August 10 and downloaded the data from Mathspace's Australian reporting database on August 27. Savoy noted that only students and school staff from Australia and New Zealand had their data stolen in the inc

2. update from malware.news

   Mathspace Breach Impacts More Than 1 Million Users in Australia, NZ

   malware.news · 36d ago · September 7th, 2026

   Ashish Khaitan reports: The Mathspace data breach has affected 1,079,819 people in Australia and New Zealand after unauthorized parties accessed an internal reporting system and downloaded user information. The company said names,… Source Article Link: https://databreaches.net/2026/09/07/mathspace-breach-impacts-more-than-1-million-users-in-australia-nz/

3. update from gbhackers.com

   Mathspace Data Breach Exposes Personal Data of Over 1 Million Students, Parents and Staff

   gbhackers.com · 36d ago · September 8th, 2026

   The company stated that attackers exploited a critical vulnerability in its self-hosted Metabase reporting environment, allowing them to gain administrator-level access without legitimate credentials. Mathspace Data […] The post Mathspace Data Breach Exposes Personal Data of Over 1 Million Students, Parents and Staff appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Hackers Exploit Metabase Flaw in Mathspace Data Breach Affecting 1.07 Million Users

   cyberpress.org · 35d ago · September 8th, 2026

   The incident stemmed from the exploitation of a critical vulnerability in a self-hosted Metabase reporting deployment, which gave an attacker administrator-level access without legitimate credentials. Hackers Exploit Metabase Flaw The breach followed Metabase’s publication of a critical security advisory and the release of patched versions on August 6. Mathspace acknowledged that its vulnerability-notification process did not identify and escalate the advisory. It updated the Metabase instance on August 29 after learning of a subsequent notice, but did not complete compromise checks recommended for potentially affected environments. Subsequent log analysis established that the attacker had accessed the system before the patch was applied. The exposed export contained user IDs, usernames, first and last names, email addresses, country and time zone data, user types, email verification status, and account metadata, including last active, last login, and account creation dates. The affected database held both current and form

5. update from securityweek.com

   Mathspace Data Breach Exposes Over 1 Million People

   securityweek.com · 35d ago · September 8th, 2026

   The incident, it says, was discovered last week, roughly three weeks after hackers compromised its self-hosted Metabase instance using a known vulnerability. The security defect, tracked as CVE-2026-72898 (CVSS score of 10/10) and described as an SQL injection issue, was patched on August 6 , after it had been exploited in the wild as a zero-day. Shortly after the patches were released, the notorious extortion group ShinyHunters claimed responsibility for hacking Metabase. “Our investigation identified unauthorised access dating back to 10 August 2026, Australian Eastern Standard Time. “We are investigating why the initial advisory was not escalated and why those checks were not completed sooner. We are changing both processes as part of our incident response,” the online platform says. Mathspace has taken its Metabase instance offline, revoked API keys, disabled the dat