NSW Primary Mathematics Curriculum Lead - Project Manager

Mathspace discloses data breach affecting over 1 million people BleepingComputer 07 Sep 2026

Mathspace: Data of more than one million people exposed during breach. Australians students, parents, guardians and staff have been caught up in the major cyber attack. The personal data of more than one million students, parents, guardians and school staff in Australia and New Zealand has been exposed during a cyber security attack on online learning platform Mathspace. "Unauthorised parties" accessed an internal reporting system in August to swipe names, email addresses and user IDs, among other information. Mathspace staff records were also affected. "We're truly sorry this happened and are taking steps to prevent similar breaches in the future," the company's chief technology officer Alvin Savoy said. "Protecting the information entrusted to us by students, families and schools is our responsibility." Savoy said there is no evidence the data has been "published, distributed, sold or otherwise misused". "Identity of the attacker remains unknown," he said. Savoy said customer passwords, academic records and results, single sign-on tokens and other customer authentication credentials were not exposed during the digital breach. Hackers were able to obtain administrator access to software used for internal reporting as early as August 10, before names and other data was downloaded on August 27. The breach was confirmed and the compromised system taken offline on Thursday. Authorities in Australia and New Zealand have been alerted, and state and territory education departments have been informed. "A total of 1,079,819 people were affected, comprising students, staff, and parents or guardians combined. Only people in Australia and New Zealand were affected," Savoy said. Former users may be impacted too, because an "account does not need to be currently active for information retained in the reporting database to be affected". Lingering threat from data breaches. Savoy said the "incident is real" but that not every message referring to it will be genuine. Mathspace said caution should be shown and that any email or call relating to the breach should be checked independently. It was only in late August that experts warned about the lingering threat Australians face in the wake of recent cyberhacks. Digidentity managing director Fred Slikker said the danger is not just confined to the weeks after a breach. "Stolen information can be retained, traded and combined with data from future incidents," Slikker said. "Australians affected by a breach therefore face a continuing risk of impersonation and identity misuse, even after they have changed their password or replaced a compromised card."

Mathspace discloses data breach affecting over 1 million people. * September 7, 2026 * 09:05 AM * 0 Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. Founded in Sydney in 2010, Mathspace is now used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom (3,432 in Australia and 3,557 abroad according to statistics reported by the company in 2023). In a Saturday blog post, Mathspace CTO Alvin Savoy said that unknown attackers gained access to the company's systems and stole personal information belonging to school staff and students, as well as their parents and guardians. "On 3 September 2026, we confirmed that unauthorised parties had accessed an internal reporting system used by Mathspace and downloaded information on students, their parents or guardians, and school staff. Mathspace staff records were also affected," Savoy said. "Attackers exploited a security vulnerability in our self-hosted installation of Metabase, software we use for internal reporting. The vulnerability allowed attackers to obtain administrator access to that system without a legitimate login." While the data theft was confirmed on September 3, the threat actors gained access to the compromised systems on August 10 and downloaded the data from Mathspace's Australian reporting database on August 27. Savoy noted that only students and school staff from Australia and New Zealand had their data stolen in the incident. Although the attackers didn't steal credentials, academic records and information, in some cases they may have been able to link some impacted accounts to their schools. "A total of 1,079,819 people were affected, comprising students, staff, and parents or guardians combined. Only people in Australia and New Zealand were affected," he added. "No academic records, learning activities, results, assessment records, passwords (hashes), authentication tokens, SSO credentials, or API credentials were exposed. The exposed data did not include records linking user accounts to their schools. However, for schools with identifiable email domains, we understand this may be possible." Savoy also warned affected students and school staff that attackers may target them using the stolen data, and advised them to watch for suspicious account-related activity, such as changes to account details and password-reset messages. Metabase breaches claimed by ShinyHunters. This breach adds to a string of other incidents impacting the Metabase instances of multiple other companies worldwide over the last month, As BleepingComputer previously reported, threat actors exploited a critical Metabase SQL injection zero-day vulnerability to breach customer instances and steal data after gaining administrator access. Trezor revealed on August 13 that attackers stole the data of nearly 14,000 customers after hacking its shipping and logistics provider, ShipMonk. On Friday, it warned that the number of affected individuals has risen to 81,000. Although Trezor has yet to attribute the attack to a specific threat actor or hacking group, BleepingComputer has learned that ShipMonk has received extortion emails from the ShinyHunters extortion gang. ShinyHunters also added Metabase to its dark web leak site on August 11. The list of affected companies in this campaign also includes laptop maker Framework and online form-building platform Tally, which have also disclosed data breaches after their Metabase instances were hijacked. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.