Mathspace Data Breach: A Missed Security Advisory Exposed Data on 1.08 Million People
Part 6 of 8 in Recent Cyberattacks: Fall 2026 Briefings
Mathspace, an online maths-learning platform used by schools in Australia and New Zealand, confirmed on September 3, 2026 that unauthorized parties had accessed an internal reporting system (BleepingComputer). The company says a vulnerability in its self-hosted Metabase reporting software let attackers gain administrator access, after its own process failed to escalate the vendor’s security advisory (Mathspace statement; iTnews). The data of 1,079,819 students, staff and parents was affected (Mathspace statement). Mathspace’s unusually candid account makes it a clear lesson in patch management.
| Organization | Mathspace, education technology (Australia and New Zealand) |
|---|---|
| Confirmed | September 3, 2026 (BleepingComputer) |
| How | Vulnerability in self-hosted Metabase reporting software allowed administrator access without a login, per Mathspace (Mathspace statement) |
| People affected | 1,079,819 students, staff and parents or guardians (Mathspace statement) |
| Data | Names, user IDs, usernames, email addresses and account activity dates; Mathspace says passwords, tokens and academic records were not exposed (Mathspace statement) |
| Attacker | Unknown, according to Mathspace (Mathspace statement) |
Each item is linked to its source. Verification status reflects the strongest source available on the verification date.
What happened
- Aug 6. Metabase publishes a critical advisory and patched versions; Mathspace says its notification process did not escalate it (Mathspace statement).
- Aug 10. Unauthorized access begins, according to Mathspace (Mathspace statement).
- Aug 27. Information is downloaded from the reporting database (Mathspace statement).
- Aug 29. Mathspace updates Metabase after a later notice from the vendor (Mathspace statement).
- Sept 3–6. Breach confirmed; schools and regulators notified; individual notifications begin (Mathspace statement).
The vulnerability
SecurityWeek reports the Metabase flaw as a critical SQL-injection vulnerability that had been exploited in the wild before the patch (SecurityWeek). Mathspace has not published the CVE or the version it was running, so the specific flaw used against Mathspace is as reported by the media, not confirmed by the company (Mathspace statement; SecurityWeek).
Mathspace’s chief technology officer told iTnews its vulnerability-notification process did not identify and escalate the advisory for action (iTnews). Patches were available for about three weeks before data was downloaded (Mathspace statement).
What is still unknown
- Who carried out the attack; Mathspace says the attacker is unknown (Mathspace statement).
- Which Metabase version was in use and whether the media-reported CVE is the one exploited.
How organizations can close the patching gap
The CISA #StopRansomware Guide stresses prompt patching of internet-facing systems, especially known exploited vulnerabilities (CISA #StopRansomware Guide). In practice:
- Keep an inventory of every self-hosted tool that is reachable from the internet, including reporting, dashboard and analytics software.
- Assign a named owner who receives each vendor’s security advisories, and track critical ones to closure.
- Set a deadline for critical, internet-facing patches measured in days, not weeks (CISA #StopRansomware Guide).
- Put admin and reporting tools behind VPN, SSO or IP restrictions so a single flaw is not exposed to the whole internet.
- Scan your external attack surface regularly to find what you forgot you had.
How OC Security Audit can help
We find exposed and unpatched systems before attackers do, and help you set up a patch process that holds.
- Network vulnerability assessment: internal and external vulnerability scanning with prioritized fixes
- External security audit: internet-facing attack surface review
- Firewall security audit: exposure and access-rule review
- Vulnerability Management assessment: free self-assessment tool
Ali Hassani, CISSP, C|CISO, is based in Irvine and works with organizations on-site across Southern California and remotely nationwide.
Schedule a consultationCall 949-777-5567An audit shows where your controls are weak and what to fix first. No audit or service can guarantee that an organization will not be attacked; the goal is to lower the likelihood and the impact.
More in this series
See all briefings and their verification status in the recent cyberattacks and data breaches tracker.
Sources
- Mathspace, September 5, 2026 (updated September 8). https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/
- BleepingComputer, September 7, 2026. https://bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people
- iTnews, September 8, 2026. https://www.itnews.com.au/news/late-patching-of-metabase-sqli-bug-claims-sydneys-mathspace-628745
- SecurityWeek, September 2026. https://securityweek.com/mathspace-data-breach-exposes-over-1-million-people
- CISA, accessed November 1, 2026. https://www.cisa.gov/stopransomware/ransomware-guide
About this briefing. This page summarizes publicly available information from the sources linked above, as of the verification date shown. OC Security Audit was not involved in responding to any incident described here and has no inside knowledge of them. Organization names are used only to identify the subjects of the cited public reports. Statements made by attackers are labeled as claims and are not treated as fact; details that the sources do not confirm are marked as unknown. Facts may change as investigations continue.
This content is for general educational purposes. It is not legal advice, a forensic conclusion or a finding about any organization’s security practices. See our editorial standards. To report an error, contact support@OCsecurityAudit.com and we will review it and publish a dated correction where needed.