Mathspace Data Breach Exposes Over 1 Million Users in Australia and New Zealand Australian edtech platform Mathspace has disclosed a data breach affecting more than 1.07 million students, parents, teachers, and staff across Australia and New Zealand. The incident, confirmed on September 3, 2026, stemmed from an unpatched vulnerability in the company’s self-hosted Metabase reporting system. The breach occurred after an attacker exploited a known flaw in Metabase, disclosed on August 6, 2026, which Mathspace failed to address due to an internal oversight in its vulnerability notification process. Unauthorized access began as early as August 10, with data exfiltrated on August 27, before the company detected the intrusion on September 3. Exposed data included names, email addresses, user IDs, usernames, account creation dates, last login timestamps, and email verification statuses though passwords, SSO tokens, and authentication credentials remained secure. No academic or learning data was compromised. Mathspace has since taken its platform offline to remediate the issue and has notified regulators, including Australia’s OAIC and ACSC, as well as New Zealand’s Privacy Commissioner and NCSC. The company is conducting a post-incident review to improve its vulnerability management and response processes. Notifications to affected individuals began on September 6, with no threat actor yet claiming responsibility.