Sydney, September 8 — A significant data breach has been disclosed by learning provider Mathspace, affecting over 1 million users across Australia and New Zealand, according to the company. The company said in a blog post that unauthorised parties had accessed an internal reporting system used by Mathspace, exposing names and email addresses. This breach occurred between August 10 and August 27, during a period when a security patch had not been installed, exploiting a security vulnerability in Mathspace’s self-hosted installation of software.
A total of 1,079,819 people were affected in Australia and New Zealand, including students, school staff, and parents. The hackers exported information including user IDs, usernames, first names, last names, email addresses, countries, time zones, user types, email-verification status, last-active date, last-login date, and date joined, though not every person had all fields stolen.
Mathspace made clear that no academic records, learning activities, results, assessment records, passwords, authentication tokens, SSO credentials, or API credentials were exposed, and that the exposed data did not include records linking user accounts to their schools. The compromised reporting system has been taken offline.
Response and Investigation
Mathspace said it had contacted schools, cyber security authorities, and education departments and was now contacting affected individuals. The company said it did not yet know who was responsible for the breach and had found no evidence so far that the stolen information had been published, shared, or sold.
Mathspace apologized, stating, “We’re truly sorry this happened and are taking steps to prevent similar breaches in the future,” and “Protecting the information entrusted to us by students, families and schools is our responsibility.” Steve Hunter, director of engineering, APAC, at cybersecurity and AI company Arctic Wolf, commented that the incident highlighted how difficult it could be for organisations to keep on top of software vulnerabilities, saying, “Rather than playing ‘Whack-a-Mole’ every time a new vulnerability appears, organisations need to take a more risk-based approach.
The priority should be knowing what systems and software you have, understanding where the biggest risks sit, and having a clear process for acting when a critical security warning comes through.”
Next Steps
Mathspace advised people to watch for unusual account activity and to report suspicious messages or activity to [email protected]. As the investigation continues, users affected by the breach will be looking for reassurance that their information is secure, and the company’s response will be closely watched. The company said users should remain vigilant and take necessary precautions to protect their personal information. Analysts note that this breach serves as a reminder of the importance of robust cybersecurity measures, particularly for organisations handling sensitive user data.
