Full Report
Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. [...]
Analysis Summary
# Incident Report: Mathspace Metabase System Breach
## Executive Summary
Mathspace, an online mathematics learning platform, experienced a significant data breach affecting approximately 1.08 million students, staff, and parents in Australia and New Zealand. The incident involved the exploitation of a critical vulnerability in a self-hosted Metabase reporting system, allowing unauthorized access to an internal database. While personal identification data was exfiltrated, sensitive credentials and academic records remained secure.
## Incident Details
- **Discovery Date:** September 3, 2026
- **Incident Date:** August 10, 2026 (Initial Access) – August 27, 2026 (Exfiltration)
- **Affected Organization:** Mathspace
- **Sector:** Education Technology (EdTech)
- **Geography:** Australia and New Zealand (Primary impact)
## Timeline of Events
### Initial Access
- **Date/Time:** August 10, 2026
- **Vector:** Exploitation of a critical vulnerability in self-hosted Metabase software.
- **Details:** Attackers exploited a zero-day SQL injection vulnerability that allowed them to bypass authentication and gain administrator access to the reporting system.
### Lateral Movement
- **Details:** Once administrator access to Metabase was achieved, the attackers leveraged this access to reach the connected Australian reporting database.
### Data Exfiltration/Impact
- **Date/Time:** August 27, 2026
- **Details:** Attackers downloaded records for 1,079,819 individuals. Data included names and contact details of students, parents, guardians, and school staff. Some records could be linked to specific schools via email domains.
### Detection & Response
- **Discovery:** September 3, 2026 (Confirmed unauthorized access).
- **Response actions:** Internal investigation launched; public disclosure via CTO blog post on September 5, 2026; notification of affected users.
## Attack Methodology
- **Initial Access:** Exploitation of a Zero-Day SQL Injection vulnerability in Metabase.
- **Persistence:** Not explicitly detailed, but maintained access for 17 days before exfiltration.
- **Privilege Escalation:** Bypass of login mechanisms to achieve internal administrator status.
- **Defense Evasion:** Exploitation of a self-hosted reporting tool that likely sat inside the trusted perimeter.
- **Credential Access:** None (Attackers bypassed the need for credentials).
- **Discovery:** Reconnaissance of internal reporting databases connected to Metabase.
- **Lateral Movement:** Pivot from Metabase application to the underlying reporting database.
- **Collection:** Gathering of user tables including staff, student, and parent records.
- **Exfiltration:** Direct download from the Australian reporting database.
- **Impact:** Data theft and potential for follow-on phishing/social engineering.
## Impact Assessment
- **Financial:** Undisclosed; potential regulatory fines (under Australian Privacy Act) and increased support costs.
- **Data Breach:** 1,079,819 records containing PII (Names, email addresses, roles). No passwords or academic results were taken.
- **Operational:** Disruption for security auditing and remediation of the reporting infrastructure.
- **Reputational:** Public disclosure required; potential loss of trust among educational institutions.
## Indicators of Compromise
- **Network indicators:** Activity related to known ShinyHunters infrastructure (Attribution suggested by industry trends).
- **File indicators:** Not disclosed.
- **Behavioral indicators:** Unusual administrative logins to Metabase; large data exports from the reporting database on Aug 27.
## Response Actions
- **Containment:** Secured the Metabase instance and patched the underlying vulnerability.
- **Eradication:** Investigation into whether other systems were touched; rotating any potentially exposed service keys.
- **Recovery:** Restoration of secure reporting services; advisory issued to users to watch for suspicious password reset requests.
## Lessons Learned
- **Third-Party/OSS Risks:** Self-hosting open-source tools like Metabase requires rapid patching cycles, especially for zero-day vulnerabilities.
- **Data Minimization:** While academic records were safe, the volume of PII stored in a reporting system (1M+ records) created a high-value target.
- **Detection Gap:** There was a 24-day dwell time between initial access (Aug 10) and discovery (Sept 3), indicating a need for better anomaly detection on database queries.
## Recommendations
- **Patch Management:** Implement an emergency patching protocol for internet-facing or critical internal applications (like Metabase).
- **Network Segmentation:** Ensure reporting systems are isolated and require Multi-Factor Authentication (MFA) at the network layer (e.g., VPN/ZTNA) even if the application has a vulnerability.
- **Monitoring:** Deploy Database Activity Monitoring (DAM) to alert on large-scale data exports or unusual SQL queries.
- **User Education:** Warn users about the increased risk of targeted phishing utilizing their school affiliation and name.