Mathspace, an Australian educational technology company, has confirmed a data breach affecting over one million students, parents, and school staff in Australia and New Zealand. The company stated that an unpatched vulnerability in its self-hosted Metabase internal reporting system allowed unauthorized parties to gain administrator access and exfiltrate data.
The breach, which Mathspace confirmed on September 3, 2026, was traced back to unauthorized access beginning on August 10, 2026, Australian Eastern Standard Time. Data was subsequently downloaded from the company's Australian reporting database on August 27. The affected internal reporting system has since been taken offline.
In total, 1,079,819 individuals were impacted. The exposed information includes usernames, first and last names, email addresses, country, time zone, user type, email verification status, last active date, last login date, and join date. Some of these are internal Mathspace identifiers linked to student accounts.
Mathspace emphasized that no academic records, assessment results, passwords, authentication tokens, or API credentials were compromised. The company also stated that records directly linking user accounts to their specific schools were not exposed, though it acknowledged that such links might still be inferable for schools using identifiable email domains.
Due to the nature of the exposed data, Mathspace is not requiring a password reset for its users. However, the company is advising users to exercise caution regarding potential phishing attempts, as the leaked names and email addresses could be used to craft more convincing malicious communications. Users are encouraged to be vigilant about unexpected messages, refrain from sharing passwords or verification codes, and utilize unique passwords for all online accounts.
This incident is not isolated. Several other companies, including Framework, Tally, and Kilo Code, disclosed similar breaches in August 2026, all stemming from the exploitation of the same SQL injection vulnerability in their respective Metabase instances. Metabase is a business intelligence tool used for database exploration, available in both open-source self-hosted and paid cloud/self-hosted versions.
