Mathspace, a leading online mathematics learning platform, has been hit by a major cyberattack, the company confirmed. The cyberattack has affected over one million users across Australia and New Zealand after hackers gained access to internal Mathspace software and stole personal details of over one million students, parents, guardians, and teachers.
Mathspace is a popular learning platform used by schools to deliver lessons, set work, and track student progress. The disclosure came after the education platform's chief technical officer shared a blog post on September 5, 2026, revealing that a total of 1,079,819 people were affected by the data breach after unauthorized parties gained access to an internal company system used for reporting issues.
The data breach occurred between August 10 and August 27 when a security update was not applied. The company highlighted that the compromised data included details such as names, usernames, email addresses, and other account information. However, the platform clarified that the exposed data varied by individual and that more sensitive information was not compromised. The breached details may include user ID, username, first name, last name, email address, country, time zone, user type, email verification status, last active date, last login date, and date joined.
The platform stated in the blog post that no academic records, learning activities, results, assessment records, encrypted passwords, digital passkeys, single sign-on credentials, or API credentials were compromised. The company also noted that the exposed data did not include records linking user accounts to their schools.
Highlighting the measures taken in the aftermath of the cyberattack, Mathspace stated: On September 3, after confirming the breach, we took Metabase, the compromised reporting system, offline, revoked all Metabase API keys, disabled Metabase database access accounts in our Australian and U.S. Snowflake environments, and changed the passwords for the Metabase Cloud SQL databases.