Intruders reached Mathspace's unpatched Metabase four days after the fix shipped
Metabase published a critical fix on August 6, Mathspace's escalation process never surfaced it, and by the time the update went in on August 29 an intruder had been inside the reporting instance for 19 days and had already exported 1,079,819 records.
The Watch · Security desk
What happened
- Mathspace confirmed on September 3, 2026 that unauthorized parties reached its self-hosted Metabase reporting system and downloaded records covering 1,079,819 students, parents, teachers and staff in Australia and New Zealand.
- The export carried user IDs, usernames, names, email addresses, country, time zone, user type, email-verification status and last-active, last-login and joining dates, with no credentials, tokens or academic records taken.
- Mathspace reported the incident to Australian and New Zealand privacy and cyber agencies and to state and territory education departments on September 4, told schools the same day and began notifying individuals on September 6.
Why it matters
- Who has to decide decision Any team running self-hosted internal tooling outside its patch pipeline now has a concrete interval to test its escalation path against: four days between a vendor's critical advisory and someone using the bug in production.
- What it limits constraint Applying the fixed version removed the entry route but could not answer what had already been taken, and skipping the vendor's recommended compromise checks left historical log review as the only detection path.
- Who's exposed exposure Internal student user IDs, verified email addresses and last-login dates are the raw material for messages that look like they came from the product, and school affiliation can be inferred from email domains even though no school linkage was exported.
- What it costs cost No credentials were in the export, so the loss is the reporting system itself, dark for an open-ended period while recovery and compromise checks run.
Next story · Security · 3d ago
Phase Eight, Hobbs and Whistles owner discloses a cyber incident a week after AsosConfirmed9 publishers
Four days separated the fix from the break-in. Metabase shipped patched versions alongside a critical advisory on August 6 [16]. Mathspace's investigation puts the earliest unauthorized access at August 10, Australian Eastern Standard Time [5]. The advisory was never identified or escalated internally [17], and the instance stayed vulnerable until August 29, when a subsequent Metabase notice prompted the update [6]. That is 23 days after the fix existed [23] and 19 days after someone was already inside [24]. The export from the Australian reporting database ran on August 27 [7], two days before the patch went on [25].
Mathspace also says it did not complete the additional compromise checks recommended for potentially affected systems when it applied the update [18]. That omission is why August 29 produced no detection. The Metabase flaw handed out administrator access without a legitimate login [4], so installing the fixed version closes the route and says nothing about what came through it. The intrusion was confirmed on September 3 by a review of historical logs [8], five days after the patch [27] and 24 days after the first access [26].
What the reporting instance could reach shows up in the cleanup. On September 3 Mathspace took Metabase offline, revoked its API keys, disabled Metabase database-access accounts in both its Australian and US Snowflake environments, and changed the passwords on its Metabase Cloud SQL databases [14]. A self-hosted BI front end holds standing credentials into the warehouse because that is what it is for, which is the argument for patching it on the vendor's release schedule rather than the internal ticket queue.
The public record is thin where it counts. No CVE identifier, affected Metabase version, or statement about whether the instance was reachable from the open internet appears in the account of the incident [29]. Whether this was opportunistic scanning for a freshly disclosed pre-auth bug or a targeted operation is not established; Mathspace says the attacker's identity remains unknown [15]. Its finding that there is no evidence the data has been published, sold, distributed or misused [19] describes what Mathspace can see; it says nothing about what the attacker holds.
Mathspace is not requiring password resets, because no authentication credentials were in the export [12]. On the evidence, that holds. The one user-side action that changes an outcome is retiring any Mathspace password reused on another service [12].
What to watch
- Whether the OAIC or New Zealand's Privacy Commissioner opens a formal inquiry into the notification-process failure instead of closing on the breach report alone.
- Whether the exported records surface for sale or in phishing runs against school email domains, which would retire the no-evidence-of-misuse finding.
- Whether Mathspace's completed compromise checks find activity beyond the August 27 export, including in the US Snowflake environment.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+5
- Incentives45
- Confidence74
Perspective Coverage
4 publishers- Builder
- Builder 36%
- Operator
- Operator 53%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Mathspace data breach affected 1,079,819 people in Australia and New Zealand after unauthorized parties accessed an internal reporting system and downloaded user information.
- [2]
Mathspace confirmed the incident on September 3, 2026, and said affected records involve students, parents or guardians, teachers, and Mathspace staff.
- [3]
Mathspace said names, email addresses and account details were exposed, but customer passwords, single sign-on tokens and other authentication credentials were not.
- [4]
The incident resulted from a vulnerability in Mathspace's self-hosted Metabase installation used for internal reporting; the flaw allowed attackers to obtain administrator access without a legitimate login.
- [5]
Mathspace's investigation found unauthorized access dating to August 10, Australian Eastern Standard Time.
- [6]
Mathspace updated its Metabase instance on August 29 after seeing a subsequent notice.
- [7]
Information was downloaded from Mathspace's Australian reporting database on August 27.
- [8]
Historical log reviews confirmed the unauthorized access on September 3, and the access had occurred before the update was applied.
- [9]
The exported data included user IDs, usernames, first and last names, email addresses, country, time zone, user type, email-verification status, last-active date, last-login date and joining date, though not every field appeared for every affected person.
- [10]
No academic records, learning activities, results, assessments, password hashes, authentication tokens, SSO credentials or API credentials were exposed.
- [11]
The data did not contain records directly linking accounts to schools, but Mathspace said school affiliations could potentially be inferred where identifiable email domains were used, and former or inactive users may also be affected because retained information could remain in the reporting database.
- [12]
Mathspace is not requiring password resets because customer authentication credentials were not exposed, but said anyone who reused a Mathspace password elsewhere should change those reused passwords and monitor accounts.
- [13]
Mathspace said names, email addresses and account details could make phishing or impersonation attempts more convincing, and advised users to verify unexpected messages independently and never supply passwords or verification codes in response to unsolicited contact.
- [14]
After confirming the breach on September 3, Mathspace took Metabase offline, revoked its API keys, disabled Metabase database-access accounts in its Australian and US Snowflake environments, changed passwords for its Metabase Cloud SQL databases, copied the application database and exported access logs; Metabase remains offline while recovery and compromise checks continue.
- [15]
The attacker's identity remains unknown.
- [16]
Metabase issued a critical security advisory and patched versions on August 6.
- [17]
Mathspace said its vulnerability-notification process failed to identify and escalate the August 6 Metabase advisory.
- [18]
Mathspace acknowledged that it did not complete additional compromise checks recommended for potentially affected systems at the time of the update.
- [19]
Mathspace said there is currently no evidence the information has been published, sold, distributed or otherwise misused.
- [20]
Mathspace began notifying school contacts on September 4 and started notifying affected individuals on September 6, earlier than the date previously communicated to schools.
- [21]
On September 4 the incident was reported to Australia's Office of the Australian Information Commissioner, the Australian Signals Directorate's Australian Cyber Security Centre, New Zealand's Office of the Privacy Commissioner and National Cyber Security Centre, and Australian state and territory education departments.
- [22]
Four days elapsed between Metabase's August 6 advisory and the earliest unauthorized access Mathspace found, on August 10.
- [23]
Mathspace ran the vulnerable Metabase instance for 23 days after patched versions were available.
- [24]
The August 29 update landed 19 days after the earliest confirmed unauthorized access.
- [25]
The Australian reporting database was exported two days before Mathspace applied the Metabase update.
- [26]
Confirmation of the intrusion came 24 days after the earliest unauthorized access.
- [27]
The intrusion was confirmed five days after the patch was applied, via historical log review rather than at patch time.
- [28]
Four national agencies across two countries were notified, in addition to Australian state and territory education departments.
- [29]
The available account of the incident does not identify the CVE, the affected Metabase version, or whether the self-hosted instance was reachable from the open internet.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMathspace discloses data breach affecting over 1 million people
1 article · September 7, 2026
- helpnetsecurity.comMathspace breach exposes data on over a million students and parents
1 article · September 8, 2026
- securityweek.comMathspace Data Breach Exposes Over 1 Million People
1 article · September 8, 2026
- thecyberexpress.comMathspace Breach Impacts More Than 1 Million Users in Australia, NZ
1 article · September 7, 2026
Topics and entities
Topics
- Education technology and student privacy
- Business intelligence tools
- Patch And Redeploy Latency
- Data Breach
Entities
- Office of the Privacy Commissioner (New Zealand)
- Office of the Australian Information Commissioner
- National Cyber Security Centre (New Zealand)
- CVE-2026-72898
- Snowflake
- Metabase
- ShinyHunters
- Australian Cyber Security Centre