Mathspace Breach: 10/10 CVE Exploited, 1M+ Records Stolen

For security operations teams, the Mathspace breach illustrates the brutal arithmetic of patch latency: a 10/10 SQL injection in Metabase, patched on August 6 after zero-day exploitation, remained unpatched on Mathspace's self-hosted instance until August 29—while attackers had already exfiltrated data two days before the upgrade. It also shows that applying the patch isn't the same as completing vendor-recommended compromise checks: Mathspace missed the intrusion even during upgrade. Threat intel analysts should track ShinyHunters' claimed pivot against Metabase deployments as a data-extortion vector.

Mathspace, a Sydney-founded online mathematics platform used by thousands of schools in Australia, New Zealand, the United States, and the United Kingdom, has disclosed that attackers breached its self-hosted Metabase reporting system and stole personal data belonging to 1,079,819 students, teachers, school staff, and parents or guardians in Australia and New Zealand. The breach, confirmed on September 3, 2026, and disclosed in a Saturday blog post by CTO Alvin Savoy, stemmed from a known vulnerability in Metabase that Mathspace failed to patch for more than three weeks after a fix was available. According to the company's incident notice, unauthorized access began on August 10, 2026, Australian Eastern Standard Time, and data was downloaded from its Australian reporting database on August 27.

“

The breach, confirmed on September 3, 2026, and disclosed in a Saturday blog post by CTO Alvin Savoy, stemmed from a known vulnerability in Metabase that Mathspace failed to patch for more than three weeks after a fix was available.

The security defect at the center of the incident is CVE-2026-72898, an SQL injection vulnerability in Metabase with a maximum CVSS score of 10.0. Metabase patched the flaw on August 6 after it had already been exploited in the wild as a zero-day. Shortly after the patches were released, the extortion group ShinyHunters claimed responsibility for hacking Metabase, although Mathspace has not publicly attributed its specific intrusion to that group. Crucially, Mathspace did not apply the update until August 29, more than two weeks after attackers first accessed its instance, and the company acknowledged that it failed to escalate Metabase's critical advisory internally. It also did not complete the compromise checks Metabase recommended and did not identify the intrusion when it applied the update. The gap between the August 6 patch and the August 29 upgrade created a large window in which a public, in-the-wild vulnerability could be leveraged against unpatched infrastructure.

Mathspace says the exposed data includes names, user IDs, usernames, email addresses, email verification status, time zone, country, date joined, and last login and active dates. It does not include academic records, learning activities, results, assessment records, password hashes, authentication tokens, SSO credentials, or API credentials. That distinction matters for damage assessment: the absence of grades and credentials lowers the immediate harm, but the combination of student names, email addresses, usernames, and school-linked account metadata still enables phishing, social engineering, and account enumeration. Because the affected population includes minors, the breach also carries heightened privacy sensitivity and obligations under Australian and New Zealand privacy regimes, including the Australian Privacy Act and the Notifiable Data Breaches scheme.

For edtech providers and their school customers, the incident is a reminder that internal data tools are not separate from student-data security. Metabase is a widely used open-source business intelligence platform, and self-hosted instances often sit outside formal patching and asset-inventory programs. Mathspace's admission that the critical advisory was not escalated points to a process failure rather than an obscure technical exploit. The company has taken its Metabase instance offline, revoked API keys, disabled database access accounts, changed passwords, and exported logs for investigation. It is also investigating why checks were not completed sooner and says it is changing both escalation and compromise-check processes. Those are appropriate containment steps, but the breach may still invite regulatory scrutiny, parent and school inquiries, and ongoing monitoring for misuse of the downloaded dataset.