Mathspace data breach hits over million users across Australia, New Zealand

Mathspace, a leading online mathematics learning platform, has been hit by a major cyberattack, the company confirmed.

The cyberattack has affected over one million users across Australia and New Zealand.

After hackers gained access to internal Mathspace software and stole personal details of over one million students, parents, guardians, and teachers in Australia and New Zealand.

Mathspace is a popular learning platform used by schools to deliver lessons, set work, and track student progress.

This disclosure came after the education platform’s chief technical officer shared a blog post on September 5, 2026.

It revealed that a total of 1,079,819 people, after a data breach by an “unauthorised parties” gained access to an internal company system used for reporting issues.

The data breach happened between August 10 and August 27 when a security update was not applied.

It highlights that the data compromised include details such as names. Usernames, email addresses, and other account details.

However, the company clarified that the exposed data varied by individual and that more sensitive information was not compromised.

The breached details may include user ID, username, first name, last name, email address, country, time zone, user type, email verification status, last active date, last login data, and date joined.

The platform in the blog post stated that no academic records, learning activities, results, assessment records, encrypted passwords, digital passkeys, single sign-on credentials, or API credentials were compromised.

However, Savoy noted that "the exposed data didn’t include records linking user accounts to their schools.”

The company also highlights the measures it took in the aftermath of this cyberattack, stating, "On September 3, after confirming the breach, we:

"Took Metabase, the compromised reporting system, offline, revoked all Metabase API keys, disabled Metabase’s database access accounts in our Australian and U.S. Snowflake environments, and changed the passwords for the Metabase Cloud SQL databases."