Mathspace Says Metabase Flaw Exposed Data on 1.08 Million Students, Parents and School Staff
Mathspace says attackers exploited a known vulnerability in its self-hosted Metabase reporting system and downloaded information tied to 1,079,819 students, parents, teachers and staff across Australia and New Zealand.
Why it matters: The breach combines more than one million affected people, student-related information, a known critical vulnerability and a documented patch-escalation failure.
Education technology company Mathspace has disclosed that a breach of its internal reporting environment affected 1,079,819 people, including students, parents or guardians, teachers and company staff in Australia and New Zealand.
The company says attackers exploited a security vulnerability in a self-hosted installation of the open-source analytics platform Metabase and obtained administrator-level access to the reporting system. Metabase had released a critical security advisory and patched versions on August 6, but Mathspace says its internal notification process did not identify and escalate that advisory for action.
Mathspace says unauthorized access dates back to August 10 and that information was downloaded from its Australian reporting database on August 27. The company updated Metabase on August 29 and later confirmed the breach after historical log analysis.
The exposed information included internal user IDs, usernames, names, email addresses, country, time zone, account type and account activity dates. Mathspace says passwords, password hashes, authentication tokens, SSO credentials, API credentials, academic records, learning activities, assessments and student results were not exposed.
After confirming the breach, Mathspace took the Metabase system offline, revoked relevant API keys, disabled associated database-access accounts and changed related database passwords. The company also notified Australian and New Zealand privacy and cybersecurity authorities and began notifying affected schools and individuals.
The incident illustrates a recurring enterprise-security problem: patches reduce risk only when organizations have reliable systems for recognizing critical advisories, escalating them and checking whether exposed systems were already compromised. For organizations running self-hosted analytics platforms, the operational lesson is to ensure critical vendor security notices reach someone empowered to act quickly.