If your child uses Mathspace (or your school does), it’s fair to feel that stomach-drop moment: “Was it us?” Mathspace says attackers got into an internal reporting system and downloaded personal info tied to students, parents/guardians, and school staff in Australia and New Zealand—1,079,819 people in total . The good news: no passwords, tokens, SSO/API credentials, or academic/learning records were exposed . The bad news: the kind of data that did leak is perfect for phishing, scam calls, and “helpful” fake school emails that try to trick you into handing over access.
What actually happened (timeline + the weak point attackers used)
Here’s the part that matters for families: the Mathspace data breach wasn’t someone guessing your kid’s password. Mathspace says attackers got into a behind-the-scenes system used for internal reporting, then pulled data out in a targeted way.
The timeline (why the dates don’t all match)
When a company says “we confirmed it on X date,” that’s usually the day they had enough evidence to say it out loud with confidence—not the day the attackers showed up.
Mathspace’s own incident description breaks down like this:
- August 10, 2026 — initial access
- Attackers gained access to Mathspace systems on Aug 10.
- This is the “entry” date, not necessarily the day anyone at Mathspace noticed.
- August 27, 2026 — data download
- Mathspace says the attackers downloaded data from its Australian reporting database on Aug 27.
- That phrasing matters: it suggests this wasn’t accidental exposure. It was a deliberate pull.
- September 3, 2026 — confirmation
- On Sept 3, Mathspace says it confirmed unauthorized access to the internal reporting system and the download of personal information tied to students, parents/guardians, and school staff (plus Mathspace staff records).
- Confirmation tends to come after log review, forensic work, and narrowing down what was accessed.
The weak point: Metabase (and how “no login” can still happen)
Mathspace says the attackers exploited a security vulnerability in its self-hosted Metabase installation (Metabase is a reporting/analytics tool companies use to query databases and build dashboards).
The key line: the vulnerability “allowed attackers to obtain administrator access… without a legitimate login.”
In plain English, that means the attackers didn’t need to trick a teacher into giving up a password to get into that reporting layer. They found a technical flaw that let them act like an admin anyway.
This also fits a wider pattern being reported publicly: multiple organizations have disclosed breaches after attackers exploited a critical Metabase SQL injection zero-day to gain admin access and steal data.
Was your family’s data exposed? What was taken vs. what wasn’t
If you’re trying to figure out “Is this our problem?”, start with Mathspace’s own scope statement: only people in Australia and New Zealand were affected, and the impacted group includes students, parents/guardians, and school staff.
That still covers a lot of families. Mathspace says 1,079,819 people were affected.
What wasn’t exposed (the stuff that usually leads to instant account takeovers)
Mathspace says the breach did not include:
- Passwords (hashes)
- Authentication tokens
- SSO credentials
- API credentials
- Academic records / learning activities / results / assessment records
Real-life translation: you probably don’t need to assume someone can log into your Mathspace account just because this happened. The “keys” to the account weren’t part of the stolen dataset, based on what’s been disclosed.
What was exposed (and why it still matters)
Mathspace’s statement says attackers downloaded information on students, their parents or guardians, and school staff.
Even without passwords, personal info can be enough to run very convincing scams:
- A message that uses your child’s name, your name, and school context feels “safe” at first glance.
- Parents are busy. Staff are busy. Attackers count on rushed clicks.
Can attackers link your account to your school?
Mathspace says the exposed data did not include records linking user accounts to their schools.
One catch: Mathspace also notes that for schools with identifiable email domains, linking impacted accounts to a school may be possible.
So if your family uses a school-branded email (or staff do), assume scammers can “connect the dots” and impersonate:
- school admin
- IT/support
- billing/permissions teams
- “security verification” workflows
Your real risk now: phishing, impersonation, and account takeover attempts
When attackers walk away with personal details, the “win” usually isn’t logging into Mathspace directly. It’s getting you to hand over access somewhere else—your email, your phone number, your payment details, or a school portal login.
Mathspace itself warned that impacted people may be targeted using the stolen data and should watch for suspicious account activity like changes to details and password-reset messages.
The most likely playbook (what this looks like at home)
Expect messages that feel uncomfortably specific. Names, school references, and “helpful” urgency are the whole trick.
Common angles to watch for:
- “School admin” emails that claim you must “verify your child’s details” or “confirm consent forms.”
- Fake invoice or payment requests dressed up as “excursion fees,” “device insurance,” “past-due statements,” or “subscription renewals.”
- Parent portal / learning platform reset links that push you to click fast (“account locked,” “new security policy,” “action required today”).
- SMS or phone calls posing as school IT or Mathspace support, using real names to sound legitimate.
Quick tells it’s a scam
- They pressure you to act fast (same-day cutoff, threat of account suspension).
- They ask for codes, passwords, or to “confirm” details they should already have.
- The link domain looks close, but not right (extra words, odd hyphens, misspellings).
Why this breach is showing up alongside other incidents (Metabase campaign)
Mathspace’s entry point matters because it isn’t isolated. Reporting says this incident “adds to a string of other incidents” where attackers hit organizations’ Metabase instances.
Security reporting also connects these to a wider wave where threat actors exploited a critical Metabase SQL injection zero-day to gain administrator access and steal data.
And when extortion enters the picture, the pressure ramps up. The same reporting notes ShinyHunters activity around Metabase—ShipMonk reportedly received extortion emails, and ShinyHunters “added Metabase” to its leak site on August 11.
What “account takeover attempts” really means here
Even if Mathspace credentials weren’t taken, attackers can still aim for:
- your email account (because it can reset other accounts)
- school communication channels (to impersonate staff)
- any reused passwords if they can trick you into entering them on a fake page
That’s why the next step isn’t panic. It’s tightening the few places a scammer can turn personal info into real access.
What to do next (a practical checklist for parents + educators)
If you do one thing after the Mathspace data breach, make it this: treat every school-related message like it could be a targeted phishing attempt until you verify it. Mathspace has already warned impacted users to watch for suspicious account activity like changes to account details and password-reset messages.
The 20-minute checklist (do this today)
- Sweep your inbox and SMS for “account” noise
- Search for: “password reset”, “verify”, “security alert”, “invoice”, “payment”, “statement”
- If a message tries to rush you, stop and verify using a known school contact method (call the front office number you already have saved, not the one in the email).
- Check for profile changes anywhere school-related
- Look at your Mathspace profile (and any connected parent/school portals) for:
- changed email/phone
- added “recovery” details you don’t recognize
- new notification rules or forwarding settings (especially in email)
- Lock down your email (because it’s the reset key to everything)
- Turn on MFA/2FA for your primary email account.
- Review:
- account recovery email/phone
- recent logins/devices
- email forwarding rules (attackers love silent forwarding)
- Turn on MFA anywhere it’s offered (especially staff accounts)
For educators and school staff, MFA isn’t optional anymore. Add it to:
- HR/payroll
- parent communications tools
- finance/payment systems
A simple privacy move that cuts future damage
Even when passwords aren’t part of a breach, your contact details become a long-term magnet for scams.
If you can, stop using your real phone number and primary inbox for every school signup. Use separate contact details for school platforms, newsletters, and vendor tools.
Tools like Cloaked can help here in a practical way: you can create alternate emails and phone numbers for school-related accounts, so if one platform gets hit, your family’s main inbox/number doesn’t become the default target for phishing and scam calls.
For schools: one policy change that protects families fast
- Set a rule: no payment requests or account resets via email alone.
- Tell parents the exact process (and the official sender addresses) in a single notice.
- If you need families to click a link, publish it on the school website too, so parents can navigate there directly instead of trusting a message.
