Learning platform Mathspace breached via unpatched Metabase flaw, exposing about 1.08 million students and parents in Australia and New Zealand

Mathspace said attackers exploited a vulnerability in its self-hosted Metabase internal reporting system to gain admin access, with access dating back to August 10 and data downloaded from its Australian reporting database on August 27; Metabase had released patches on August 6, but Mathspace only updated on August 29 ^[1]. A total of 1,079,819 students, parents or guardians and staff in Australia and New Zealand were affected, with names, emails and account details exposed, but not passwords, SSO tokens or academic records ^[1][2]. Affected people should verify unexpected messages independently, never disclose passwords or verification codes in response to a message, and report suspicious messages to data-breach-response@mathspace.co ^[1].

Industries mainly affected: Education

1. Verify unexpected messages independently using contact details from the official website ^[1].
2. Do not disclose passwords or verification codes in response to a message; avoid unexpected attachments and unfamiliar sign-in links .