The 23 days that exposed a million Mathspace users

A warning about the flaw was public on 6 August 2026. The patch went on 29 August 2026. In between, attackers took the names and email addresses of more than a million students, parents and teachers.

Education platform Mathspace has confirmed that personal details belonging to 1,079,819 people across Australia and New Zealand were taken in a breach of one of its internal systems. The affected group spans students, school staff, and parents or guardians.

"Attackers exploited a security vulnerability in our self-hosted installation of Metabase, software we use for internal reporting," Mathspace chief technology officer Alvin Savoy wrote in the company's disclosure.

The timeline is the story. Metabase, a widely used data-reporting tool, published a critical security advisory on 6 August 2026. The flaw let an attacker gain administrator access without a legitimate login. Mathspace's own investigation found unauthorised access began four days later, on 10 August 2026. Data was downloaded from its Australian reporting database on 27 August 2026. The fix was applied on 29 August 2026, and the breach was confirmed on 3 September 2026.

Mathspace has been candid about why the gap opened. Its disclosure says its process for tracking software vulnerabilities failed to identify and escalate the advisory. In other words, the warning arrived and nobody acted on it in time.

The data taken includes names, usernames, email addresses, user type, country, time zone and login dates. Mathspace says passwords, login credentials, academic records and assessment results were not exposed, nor were records linking accounts to particular schools. It has found no evidence so far that the data has been published or sold, and told the ABC it does not yet know who was responsible.

Mathspace was not the only target. Framework, Tally and Kilo Code all disclosed breaches in August 2026 after attackers exploited the same Metabase flaw, according to Help Net Security.

The company has notified the Office of the Australian Information Commissioner (OAIC), which runs the notifiable data breaches scheme. It has also told the Australian Cyber Security Centre, New Zealand's privacy and cyber authorities, and state education departments. Individual notifications began on 6 September 2026.

Steve Hunter, an Asia-Pacific director at security firm Arctic Wolf, told the ABC that organisations need "a more risk-based approach" to managing vulnerabilities, starting with knowing what systems they run.

No sophisticated hack was needed here. A known flaw met a missed warning, and the fix came three weeks late. The exposed data looks mundane, but a name, an email and the knowledge that someone uses a school platform is the raw material for convincing phishing aimed at parents. Expect those emails. For businesses, the lesson is uncomfortable because it is ordinary. Most organisations run third-party tools they rarely think about, and patching them is nobody's favourite job. The OAIC will look hard at that 23-day gap, and it should. If you are a Mathspace parent, treat any unexpected message about your child's account with suspicion, and verify it through the school.