Attackers pulled the records of 1,079,819 people from Mathspace, an online maths platform used by students, parents, teachers and staff in Australia and New Zealand. The company confirmed the breach on September 3.
The way in was a self-hosted installation of Metabase, a reporting tool. Metabase issued a critical security advisory and patched versions on August 6. Mathspace has admitted that its process for flagging vulnerability notices failed to escalate the warning, so the fix was never applied. Unauthorised access goes back to August 10, and data was downloaded from the company’s Australian database on August 27.
What was taken: names, email addresses, usernames, user IDs, countries, time zones, account types, and details of when each user joined or last logged in. Not every account had every field.
What was not taken, according to Mathspace: passwords, authentication tokens, SSO credentials, API credentials, academic records, assessment results and learning activities.
The reporting service has been taken offline. Mathspace has notified affected schools, education departments and cybersecurity authorities. It does not know who the attackers are. “We have no evidence so far that the data has been published, distributed, sold or otherwise misused,” the company said.
It did warn that the stolen details could make scams more believable. “Names, email addresses and account details can make impersonation attempts more convincing,” Mathspace said, and it urged users to be careful with unexpected messages, password-reset emails and requests for verification codes. The company has also apologised: “We’re truly sorry this happened and are taking steps to prevent similar breaches in the future.”
