Mathspace Data Breach
Online mathematics education platform Mathspace, utilized extensively across schools in Australia and New Zealand, disclosed a significant data security incident involving unauthorized database access.
Exposed Data Types
5- Names
- Usernames
- Email addresses
- Geographic locations
- Account activity
About This Breach
The breach stemmed from the exploitation of a critical SQL injection vulnerability (CVE-2026-72898) within its self-hosted Metabase internal reporting server in August 2026. Attackers exfiltrated 1,079,819 user records spanning students, educators, school administrators, and parents. Compromised fields include first and last names, usernames, internal user IDs, email addresses, verification statuses, country, time zone, and account activity timestamps. Student grades, test answers, and login passwords were not stored in the reporting system and remained uncompromised.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
